4 ms·
Aside from the Python related stuff one thing that confuses me about this article is the claim than a browser can put files in your Downloads directory without
by tgflynn 6y ago
Aside from the Python related stuff one thing that confuses me about this article is the claim than a browser can put files in your Downloads directory without you requesting that. Exactly what browser/HTTP feature allows that ?
I don't think I've never encountered this behavior and any time I've downloaded a file I've had the opportunity to see and change the name it is stored under.
- Sebb767 6y agoIt is possibly when you select 'always save to downloads' in your preferred browser.
- minitech 6y ago(And this is the default in all major browsers!)
- tgflynn 6y agoYou're right, if I just click on a link to a file that's not a PDF in chrome (in this case it was a .ps) it does immediately download the file, but it at least displays the filename in the downloads bar below the main window. So as far as I can tell it would be hard for a site to cause a download to occur without the user noticing.
- masklinn 6y agoThe user not noticing is not necessarily relevant if they don’t act on it immediately, browsing to their download folder to remove the offending file. The file could stay in there for years just waiting for the system’s user to slip up. This is obviously not a targeted attack under time constraints.
- AlphaSite 6y agoIn safari it will not let you download without explicit user interaction.
- deleted 6y ago[deleted]
- masklinn 6y agoSafari will absolutely let you do it, though it might not be the default anymore (certainly used to be, and you can configure it in Preferences > Websites > Downloads). Way more problematically, Safari will also open “safe” files (which includes zips and PDFs) by default after having downloaded them.