I posted this in a conversation in /r/netsec today as well. I don't agree that this is a bug. I'm all for having a discussion about whether this is a bug or not

I posted this in a conversation in /r/netsec today as well. I don't agree that this is a bug. I'm all for having a discussion about whether this is a bug or not. I just hope that before the wget developers change anything they engage with those people who prefer this behavior. This is a mirror operation, it's not the standard use of wget where we just download from an untrusted website. If I'm mirroring something I expect everything to copy. Imagine a situation where I'm mirroring something for the purposes of backup. The original site goes down, and I need to restore from the mirrored copy I made with wget. In this instance I want those symlinks to be present. I want everything. -m --mirror Turn on options suitable for mirroring. This option turns on recursion and time-stamping, sets infinite recursion depth and keeps FTP directory listings. It is currently equivalent to -r -N -l inf --no-remove-listing. --no-remove-listing Don't remove the temporary .listing files generated by FTP retrievals. Normally, these files contain the raw directory listings received from FTP servers. Not removing them can be useful for debugging purposes, or when you want to be able to easily check on the contents of remote server directories (e.g. to verify that a mirror you're running is complete). Note that even though Wget writes to a known filename for this file, this is not a security hole in the scenario of a user making .listing a symbolic link to /etc/passwd or something and asking "root" to run Wget in his or her directory. Depending on the options used, either Wget will refuse to write to .listing, making the globbing/recursion/time-stamping operation fail, or the symbolic link will be deleted and replaced with the actual .listing file, or the listing will be written to a .listing.number file. Even though this situation isn't a problem, though, "root" should never run Wget in a non-trusted user's directory. A user could do something as simple as linking index.html to /etc/passwd and asking "root" to run Wget with -N or -r so the file will be overwritten.