Hacker News new | past | comments | ask | show | jobs | submit login

Indeed the MR template does not have the security box checked.



My guess is that the username is used in a url somewhere? So browsers might try and interpret it as a file


That's what actual MIME types are for. You can serve a .jpg as a .txt file and still have the browser display it correctly as an image if you use image/jpeg. Same for the other way around or any other combination of file and MIME types.


You're not wrong, but I bet there are lots of things that will assume based on url (rightly or wrongly). e.g. I've seen a lot of nginx reverse proxy setups implement different caching policies based on url suffix (again rightly or wrongly).

Maybe just playing it safe?


Yeah, if you for example use the 1001th hip electron based browser (with some hand-crafted curl workers and custom fetchers with an express based proxy-backend included in the background mangled together with some weird mix of 20% javascript and 80% typescript and a combination of at least 400 different npm packages over a commit history of two weekends) to browse the web ... of course, that assumption might break. :^)


Do you remember when MSIE would ignore the MIME type the server sent, and sniffed the contents of the beginning of the file downloaded and overrode what the server sent?

Good times ..... (rocking in corner ....)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: