Re: Never send user email address in HTTP requests

["T.V Raman" <raman@google.com>]

Yuri Khan <yuri.v.khan@gmail.com> writes:


Just let-bind url-privacy-level to paranoid
> On Sun, 17 Dec 2023 at 19:36, Eli Zaretskii <eliz@gnu.org> wrote:
>
>> Sorry, but I disagree.  Emacs should not second-guess the users, and
>> should certainly NOT force them into what we consider to be the secure
>> environment.  It is okay to behave securely by default, but if someone
>> wants to be insecure, for whatever reasons, we should let them have
>> the old, insecure behavior.  Certainly when we first change the
>> default, since there's a possibility that something will break for
>> someone due to this change, and we need to let users have a fire
>> escape in those cases, until we get our act together in the next
>> release.
>
> The header in question, From, is governed by RFC 9110 § 10.1.2[0], which says:
>
>     The From header field is rarely sent by non-robotic user agents.
>     A user agent SHOULD NOT send a From header field
>     without explicit configuration by the user,
>     since that might conflict with the user's privacy interests
>     or their site's security policy.
>
>     A robotic user agent SHOULD send a valid From header field
>     so that the person responsible for running the robot can be contacted
>     if problems occur on servers,
>     such as if the robot is sending excessive, unwanted, or invalid requests.
>
> [0]: https://www.rfc-editor.org/rfc/rfc9110.html#section-10.1.2
>
> That is, it’s not intended for web browsers or interactive
> applications acting on the user’s behalf. It’s for spiders and other
> automation.
>
> Surely a user who is writing a spider in Elisp can take the extra
> conscious step of filling out the general fire escape,
> ‘url-request-extra-headers’, and deciding which email address to
> expose.
>
> It is good that the default value of ‘url-privacy-level’ is (email),
> preventing the leak by default, but there is no reason to make it
> possible to configure url.el to leak it with every request made from
> Emacs. If you’re running a spider and also just browsing the Web with
> EWW, you probably only want requests from your spider to be attributed
> to you as the spider maintainer.
>

--