If an open standard has features that violate user privacy and don't provide sufficient value in exchange to justify it, it's reasonable to discuss violating or reforming that standard for the sake of privacy. The existence of a standard doesn't make the privacy issue go away.

Note that per the report GNU wget does this as well. So other well known, well regarded, widely used tools are following this same standard doing the same thing.

That doesn't excuse the standard, but it does mean Chromium is just matching platform on this, not setting any particular policy on its own.

My beef is with the adverb "secretly".

I don't have an issue with this feature, but to play devil's advocate: it obviously isn't being adequately advertised if it's surprising to so many people on HN. And if many among the audience of HN find it surprising, you can be certain it's even more-so to the general public.

Since the behavior is unexpected and very non-obvious for the average user, I don't see any issue with calling it "secretly".

You confused secrecy with ignorance.

Well I think at least that it does that in incognito mode is a somewhat valid point. I assume that most people are not aware of this feature at all, so incognito mode should just try to do the right thing.

The web is what I know well, this may not be true in other areas, but the W3C has a long history of being hostile to end users, ignoring privacy, and pushing corporate interests over others.

Following their recommendations and doing things just because they were in the spec does make those decisions ethical or even legal. Developers have an obligation to push back against standards boards and corporations that make bad decisions.

Hiding behind the business rules or the standards committee is completely unacceptable anymore. Especially when it comes to bad security/privacy practices that generally favor a market over an end user.

The W3C staff I've talked with seem very decent, in a public-interest kind of way. Though there's always been a tendency of Web standards (de facto, and de jure) to serve the interests of dotcoms, a bit like an industry consortium.

I think that industry-savvy people used to be mainly concerned with avoiding abusive monopolies, since we had examples of that. What I think many early Internet and Web people (who tended to be altruistic) didn't anticipate was the current culture of pervasive sneaky privacy abuses and often questionable engineering.

> Following [the W3C] recommendations and doing things just because they were in the spec does make those decisions ethical or even legal.

The spec being followed here is Freedesktop's, not W3C's https://www.freedesktop.org/wiki/CommonExtendedAttributes/

> user.xdg.origin.url: Set on a file downloaded from a url. Its value should equal the url it was downloaded from.