exit notation stripping

[grarpamp]

>  >> >  This is why Privoxy includes a filter to strip the exit notation from
>  >> >  the Host header when passing the request through, and why this filter

>  >> Note that this will not work for https obviously.

>  >Yep. The smarter place to put this logic would be inside Torbutton
>  >(or inside something else in Firefox-land).

>  >away. There are too many subtle security and anonymity problems with it.

So long as their browser is set to proxy, I'm not seeing a breach?
Just the issues with website interaction covered by Drake.
I quit it, preferring mapaddress, because it didn't work with https.

>  >option for allowing .exit, disabled by default, this change would happen
>  >faster. That seems to be the best compromise I can see -- keep users
>  >safe by default, and let people screw themselves if they really want

>  the .exit notation is the best tool we (non-developers) have for zooming
>  in on and identifying bad exits.

I think he means optioning out the http[s]://<url>.<fp>.exit you paste in
your location bar... not removing the mapaddress circuit building functionality,
which is a great tool to have.

Though if I'm just hacking about, I'll tack the .exit on as needed.
Then you've got cases where <ip_addr>.exit and <irc|ssh|etc>.exit
are handy too.

Optioning it off wouldn't be a big deal. Mostly because users would view
the website issues as unexpected. And documenting all the caveats
for new users would be hard. Sort of how some apps have basic and
expert mode.

Removing it, not sure, see what other people say.