665567 - [Linux] Store that file was downloaded from the Internet (Extended Attribute user.xdg.origin.url)

Status: RESOLVED INVALID

(MailNews Core :: Attachments, enhancement)

Description

[Ben Bucksch (:BenB)]

+++ This bug was initially created as a clone of Bug #665531 +++

On Windows, we let the OS know that this file is downloaded from the Internet. This causes Windows Explorer warn users when they start a downloaded executable.

On Linux, we have Extended Attributes in the filesystem. If available, we can set the attribute "user.xdg.origin.url", which is defined by FreeDesktop as
"Set on a file downloaded from a url. Its value should equal the url it was downloaded from." <http://www.freedesktop.org/wiki/CommonExtendedAttributes>

This may or may not cause the file manager (whatever the user uses, e.g. GNOME Nautilus, KDE Dolphin etc.) to issue a warning, that's up to the file manager. It can also offer other things, e.g. "redownload" or "Share" (to share the original URL instead of re-uploading the file) etc..

I personally would file it useful, because I often save files for personal archive and usage, but then later want to share it with friends via IRC or Web. This is true for particularly interesting articles, comics, and maybe programs. Instead of uploading my copy of the file, and potentially violating copyright with that, I'd prefer to give my friends the original URL. But to find it later, I need to both save the file and bookmark it, and then later reassociate them (given that they are in different stores: filesystem and browser bookmarks). The "user.xdg.origin.url" attribute, automatically saved by Firefox, would solve this problem for me. I could just check where I got the file from, and share that URL.

Ben

Comment 1

[Ben Bucksch (:BenB)]

Nevermind.

Comment 2

[Ben Bucksch (:BenB)]

The spec mentions some specific values for email:

user.xdg.origin.email.subject: Set on an email attachment when saved to disk. It should get its value from the originating message's "Subject" header
user.xdg.origin.email.from: Set on an email attachment when saved to disk. It should get its value from the originating messsage's "From" header. For example '"John Doe" <[e-mail]>', or '[e-mail]'
user.xdg.origin.email.message-id: Set on an email attachment when saved to disk. It should get its value from the originating message's "Message-Id" header. 

But these can cause an information leak, if the file is re-distributed, e.g. via a tar that preserves extended attributes. An email with msg-id "[e-mail]" is pretty sure to come from me, and Subjects can be quite revealing. The combination can be a real problem when leaked to the wrong party or to the public.
Also, the From would leak the email address, which I often don't want to get public, if nothing else then for spammers.

The URL typically doesn't have such problems, but the original URL is usually not available for email attachments, and the mailbox URL is not terribly useful.