Bugzilla

(In reply to :Gijs (he/him) from comment #15)
> I don't really understand why we'd use the referrer at all here, unless it's for the reasons I outlined in comment #1. Marco, it's been a long time, but perhaps you remember?

I don't remember, but I assume the scope was to show the closest thing to the origin from which the user downloaded the file, rather than the origin of the file itself.  I also suspect we pretty much kept the behavior of the legacy toolkit download manager.
It's possible we're giving too much importance to the origin, since it's session-only the user is more likely to remember which page the download came from, and more interested to know from where it was actually downloaded.
Off-hand, the simplest approach here seems to just stop using the refererrer. The downside is that the user may be a bit more confused in some cases (like the cdn example you pointed out), but in the end that confusion may actually be a safer path, bringing to more "do I trust this origin" questioning.
I still think the best approach would be to show both info, but considering the UX complications and lack of resources, I'd not hold my breath for that. I'd rather, once a download is complete, show the origin in the Downloads Panel too.

(In reply to :Gijs (he/him) from comment #15)
> I don't really understand why we'd use the referrer at all here, unless it's for the reasons I outlined in comment #1. Marco, it's been a long time, but perhaps you remember?

I don't remember, but I assume the scope was to show the closest thing to the origin from which the user downloaded the file, rather than the origin of the file itself.  I also suspect we pretty much kept the behavior of the legacy toolkit download manager.
It's possible we're giving too much importance to the "user-facing" origin, since it's session-only the user is more likely to remember which page the download came from, and more interested to know from where it was actually downloaded.
Off-hand, the simplest approach here seems to just stop using the refererrer. The downside is that the user may be a bit more confused in some cases (like the cdn example you pointed out), but in the end that confusion may actually be a safer path, bringing to more "do I trust this origin" questioning.
I still think the best approach would be to show both info, but considering the UX complications and lack of resources, I'd not hold my breath for that. I'd rather, once a download is complete, show the origin in the Downloads Panel too.

(In reply to :Gijs (he/him) from comment #15)
> I don't really understand why we'd use the referrer at all here, unless it's for the reasons I outlined in comment #1. Marco, it's been a long time, but perhaps you remember?

I don't remember, but I assume the scope was to show the closest thing to the origin from which the user downloaded the file, rather than the origin of the file itself.  I also suspect we pretty much kept the behavior of the legacy toolkit download manager.
It's possible we're giving too much importance to the "user-facing" origin, since it's session-only the user is more likely to remember which page the download came from, and more interested to know from where it was actually downloaded.
Off-hand, the simplest approach here seems to just stop using the refererrer. The downside is that the user may be a bit more confused in some cases (like the cdn example you pointed out), but in the end that confusion may actually be a safer path, bringing to more "do I trust this origin" questioning.
I still think the best approach would be to show both info, but considering the UX complications and lack of resources, I'd not hold my breath for that. I'd rather, once a download is complete, show the origin in the Downloads Panel too (must test appropriate cropping for long origins).

(In reply to :Gijs (he/him) from comment #15)
> I don't really understand why we'd use the referrer at all here, unless it's for the reasons I outlined in comment #1. Marco, it's been a long time, but perhaps you remember?

I don't remember, but I assume the scope was to show the closest thing to the origin from which the user downloaded the file, rather than the origin of the file itself.  I also suspect we pretty much kept the behavior of the legacy toolkit download manager.
It's possible we're giving too much importance to the "user-facing" origin, since it's session-only the user is more likely to remember which page the download came from, and more interested to know from where it was actually downloaded.
Off-hand, the simplest approach here seems to just stop using the refererrer. The downside is that the user may be a bit more confused in some cases (like the cdn example you pointed out), but in the end that confusion may actually be a safer path, bringing to more "do I trust this origin" questioning.
I still think the best approach would be to show both info, but considering the UX complications and lack of resources, I'd not hold my breath for that. I'd rather, once a download is complete, show the origin in the Downloads Panel too (must test appropriate cropping for long origins), potentially also in a follow-up.

(In reply to :Gijs (he/him) from comment #15)
> I don't really understand why we'd use the referrer at all here, unless it's for the reasons I outlined in comment #1. Marco, it's been a long time, but perhaps you remember?

I don't remember, but I assume the scope was to show the closest thing to the origin from which the user downloaded the file, rather than the origin of the file itself.  I also suspect we pretty much kept the behavior of the legacy toolkit download manager.
It's possible we're giving too much importance to the "user-facing" origin, since it's session-only the user is more likely to remember which page the download came from, and more interested to know from where it was actually downloaded.
Off-hand, the simplest approach here seems to just stop using the referrer. The downside is that the user may be a bit more confused in some cases (like the cdn example you pointed out), but in the end that confusion may actually be a safer path, bringing to more "do I trust this origin" questioning.
I still think the best approach would be to show both info, but considering the UX complications and lack of resources, I'd not hold my breath for that. I'd rather, once a download is complete, show the origin in the Downloads Panel too (must test appropriate cropping for long origins), potentially also in a follow-up.