3 ms·
> While this issue should be obvious to anyone knowing basic web security, I have never seen it being discussed publicly. It was discussed here: https://news.y
by Alex3917 7y ago
> While this issue should be obvious to anyone knowing basic web security, I have never seen it being discussed publicly.
It was discussed here: https://news.ycombinator.com/item?id=15141594 https://news.ycombinator.com/item?id=15141594
I'm still of the opinion that there should be an RFC around tilde urls, making it official that they're for hosting static content that isn't vouched for by the owner of the main domain. This has been an important part of our culture for decades, and it should be formally recognized and codified so that people can do it in a secure way.