It's a great discussion. Although URLs work quite well, they are not uniform[1], do not necessarily represent resources[2], and are used for other purposes than location[3]. Thus, there is room for both sides to be right: usually, you should treat a URL as everyone else does, but sometimes, it's smarter not to.
[1] What is uniform about them? They mean different things, depending on the context in which they are accessed. http://experts-exchange.com/whatever returns different content, depending on your user-agent, your /etc/hosts, your firewalls and network filters, and so on. Granted, they satisfy a strict technical sense of the word "uniform", but that meaning shouldn't be conflated with its english meaning, as it is in this article.
[2] "Unlike many URLs, the mailto scheme does not represent a data object to be accessed directly." Section 3.5, http://www.ietf.org/rfc/rfc1738.txt
[3] The ":password" part of many protocols is authentication, not location.
So, that leaves '3', which is not exactly secure and most applications that can use it will also happily ask for a password from the user in interactive mode when it isn't supplied.
Comments
You and I both, especially since it's a repost http://news.ycombinator.com/item?id=1230768
It's a great discussion. Although URLs work quite well, they are not uniform[1], do not necessarily represent resources[2], and are used for other purposes than location[3]. Thus, there is room for both sides to be right: usually, you should treat a URL as everyone else does, but sometimes, it's smarter not to.
[1] What is uniform about them? They mean different things, depending on the context in which they are accessed. http://experts-exchange.com/whatever returns different content, depending on your user-agent, your /etc/hosts, your firewalls and network filters, and so on. Granted, they satisfy a strict technical sense of the word "uniform", but that meaning shouldn't be conflated with its english meaning, as it is in this article.
[2] "Unlike many URLs, the mailto scheme does not represent a data object to be accessed directly." Section 3.5, http://www.ietf.org/rfc/rfc1738.txt
[3] The ":password" part of many protocols is authentication, not location.
[1] experts-exchange is abusing the urls, the fact that they are not 'rest-ful' does not detract from the URL scheme but from experts-exchange.
[2] Mailto is a URI, not a URL. 1738 has long been superseded. http://shadow2531.com/opera/testcases/mailto/modern_mailto_u...
So, that leaves '3', which is not exactly secure and most applications that can use it will also happily ask for a password from the user in interactive mode when it isn't supplied.
Good catch, the dupe checker didn't catch it because of the 'blog' in the original link.