8 ms·

Does that mean that the quest of finding a working direct link to the image/video will soon become impossible?

dathinab 5y ago
If site producers want to it's already pretty much impossible today. At least without some "tricks", and nothing prevents your video-downloader from just adding a header which pretend it's origin is a website. (Or more funny you inject the downloading JS code into the website in question extending it with a download functionality ;=) ).
- userbinator 5y ago
  There's a difference between only allowing that behaviour, and explicitly creating features to enable it. This sounds like Referer, but worse.
  - will4274 5y ago
    ? Referer contains tracking information. This doesn't..
  - dathinab 5y ago
    Sec-Fetch-Site: It's more like `Origin`but without actually containing the Origin instead just delivering information about if it's the same site, same origin different origin or has not origin. This makes it much more privacy friendly then both the `Origin` and `Refer` header, it also makes it easier to user for the intended use case and in turn IMHO a strict improvement over both `Origin` and `Referer`. Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-User: Provide a bit more context about how the request was made, while this can leak slightly more information compared to `Origin` or worse `Referer` it's still much better. So from a privacy POV I would say this is a strict improvements. From a functionality POV it might look like it further limits 3rd party resource re-usage but CORS already does so. And like CORS it can be circumvented by using download apps which are not your browsers or servers republishing things or similar. I could imagine there could be some web-extensions which "extend" a website by injecting code or similar which would become harder to do with this. Through I don't know of any where there isn't a reasonable workaround. So from what I can tell the worst thing it might do is that using `curl` for sites where you need to set a `Origin` header now also need you to set some other headers which could be annoying.
  - paulddraper 5y ago
    (1) How is it like Referer? (2) How is Referer bad? Like it "tracks" you? Seems like the 1000th least bad tracker you probably run.
    - naniwaduni 5y ago
      The thousandth least bad thing is still a bad thing.
- deleted 5y ago
  [deleted]
account42 5y ago
Exactly - why do I as a user want this? I already need an extension to fake the Referer...
- The_rationalist 5y ago
  Which extension?
  - Santosh83 5y ago
    You should reach out to dang. You seem to be shadowbanned or something. All your comments show up as grayed out and 'dead'. I 'vouched' for this before I could reply.
  - rhn_mk1 5y ago
    Header Editor is one.
- coldpie 5y ago
  The article explains why you as a user want this.
  - Vinnl 5y ago
    Specifically: > allows web applications to protect themselves and their users against various cross-origin threats
    - account42 5y ago
      Web applications are a mistake. Leaking any information and bloating all requests to work around buggy web applications is not what I as a user want.
- vbezhenar 5y ago
  Developer tools / Network / find necessary resource / Right click / Copy as cURL
- 5y ago
1vuio0pswjnm7 5y ago
Can you provide an example of such a "quest"? The only speed bumps I have encountered are timestamps, i.e., links that "expire".

If site producers want to it's already pretty much impossible today. At least without some "tricks", and nothing prevents your video-downloader from just adding a header which pretend it's origin is a website. (Or more funny you inject the downloading JS code into the website in question extending it with a download functionality ;=) ).

userbinator 5y ago
There's a difference between only allowing that behaviour, and explicitly creating features to enable it. This sounds like Referer, but worse.
- will4274 5y ago
  ? Referer contains tracking information. This doesn't..
- dathinab 5y ago
  Sec-Fetch-Site: It's more like `Origin`but without actually containing the Origin instead just delivering information about if it's the same site, same origin different origin or has not origin. This makes it much more privacy friendly then both the `Origin` and `Refer` header, it also makes it easier to user for the intended use case and in turn IMHO a strict improvement over both `Origin` and `Referer`. Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-User: Provide a bit more context about how the request was made, while this can leak slightly more information compared to `Origin` or worse `Referer` it's still much better. So from a privacy POV I would say this is a strict improvements. From a functionality POV it might look like it further limits 3rd party resource re-usage but CORS already does so. And like CORS it can be circumvented by using download apps which are not your browsers or servers republishing things or similar. I could imagine there could be some web-extensions which "extend" a website by injecting code or similar which would become harder to do with this. Through I don't know of any where there isn't a reasonable workaround. So from what I can tell the worst thing it might do is that using `curl` for sites where you need to set a `Origin` header now also need you to set some other headers which could be annoying.
- paulddraper 5y ago
  (1) How is it like Referer? (2) How is Referer bad? Like it "tracks" you? Seems like the 1000th least bad tracker you probably run.
  - naniwaduni 5y ago
    The thousandth least bad thing is still a bad thing.
deleted 5y ago
[deleted]

account42 5y ago

Exactly - why do I as a user want this? I already need an extension to fake the Referer...

The_rationalist 5y ago
Which extension?
- Santosh83 5y ago
  You should reach out to dang. You seem to be shadowbanned or something. All your comments show up as grayed out and 'dead'. I 'vouched' for this before I could reply.
- rhn_mk1 5y ago
  Header Editor is one.
coldpie 5y ago
The article explains why you as a user want this.
- Vinnl 5y ago
  Specifically: > allows web applications to protect themselves and their users against various cross-origin threats
  - account42 5y ago
    Web applications are a mistake. Leaking any information and bloating all requests to work around buggy web applications is not what I as a user want.
vbezhenar 5y ago
Developer tools / Network / find necessary resource / Right click / Copy as cURL
5y ago

1vuio0pswjnm7 5y ago

Can you provide an example of such a "quest"? The only speed bumps I have encountered are timestamps, i.e., links that "expire".