> This is a little concerning for privacy; while the filename is easy to disguise, hiding the SHA256 sum requires modifying the file in some way. Of course, thi

> This is a little concerning for privacy; while the filename is easy to disguise, hiding the SHA256 sum requires modifying the file in some way. Of course, this might only be a concern for uploading known files, but it's still a bit of an infoleak. Does it matter? The file is behind a URL with a random id (and the hash expires from redis after a day). Even if someone guessed your id within a day, they know essentially nothing about your file or you. And if they had your URL, they could download the file anyway, making it moot. > Hence the 1GB soft-limit. Mozilla stores the files on S3. That needs a reasonable limit.