3 ms·
It seems more appropriate just to add a ~ to the url, indicating that it's a user-uploaded file from an otherwise trusted domain. Browsers can then warn users a
by Alex3917 9y ago
It seems more appropriate just to add a ~ to the url, indicating that it's a user-uploaded file from an otherwise trusted domain. Browsers can then warn users about that however they want.
- inetknght 9y agoIs that an actual standard or... just common practice?
- Alex3917 9y agoIt's a unix standard, or at least more than just a design pattern. You know how in any unix shell, typing cd ~ takes you to your home directory? This is actually a shortcut for typing cd ~yourusername. So having xyz.tld/~username/... in a url path means that the file is hosted in userland, since ~username is the first part of the filepath hosted behind that URL. Websites have been using this pattern for 25+ years, so it's pretty universal by now.
- gertef 9y agoIt's not a security standard.
- nucleardog 9y agoIt's not even a standard. At best you could call it a convention. And a much more narrowly defined one than you seem to think. The `~` or `~username` is expanded by your shell (but not necessarily all shells) and has nothing to do with the operating system. If you pass a filename like `~myusername/test.txt` to any unix's open() syscall, it's going to either fail or open a file in a directory literally called `~myusername`. This means anywhere you're passing a filename into a program that isn't your shell does not generally support that syntax. A narrowly defined, poorly recognized convention is not a great thing to rely on for security purposes.
- Alex3917 9y agoFair enough. What's the process for submitting it as a proposed standard? I'll write it up.
- inetknght 9y agoIt depends on where you want to make the proposal. I'd make a guess with the POSIX standard. At that point, I think you'd submit a proposal somewhere around http://www3.opengroup.org/content/posix® http://www3.opengroup.org/content/posix® Also, that ® at the end of posix is part of the URL, you will unfortunately get a 404 if you don't copy-paste it right. You might be better to search for "site:opengroup.org posix" Good luck, man
- krastanov 9y agoFrom some quick googling, it seems to me that having a ~ in the url is not a standard, rather it is only a coincidence that most of the time it is used in cases where the content is user uploaded (e.g. the user home directory on a UNIX machine).
- Alex3917 9y agoIt's not a coincidence, the reason that universities and other content providers follow this pattern is specifically to signal that the company/institution doesn't vouch for whatever is being hosted.
- kevin_thibedeau 9y agoThey use it because universities traditionally exposed per-user web pages through the Unix shortcut path to their home account directory. The tilde has no other significance and doesn't make much sense outside of a Unix system.
- deleted 9y ago[deleted]
- jlgaddis 9y agoThe reason is because that's how mod_userdir has worked for a couple of decades or so. It was a way to easily allow unprivileged users to share content from their ~/public_html/ directory.
- Alex3917 9y agoInteresting. This makes sense from a technical perspective. Nevertheless, it's clearly associated with UGC content, and as far as I know there have never been any major sites that have hosted non-UGC content using this scheme. (E.g. there is no history of use for things like Amazon product pages or whatever.) And in school we were always taught that content coming from user pages on university systems shouldn't be cited as if it were academic content being published or endorsed by the university. I'm sure others were taught the same.
- dawnerd 9y agoNormal people not familiar with tech wont know what that means. They'll see fcc.gov and think its safe.