# File attachments in restricted categories should be restricted **URL:** \ **Category:** Feature\ **Created:** [2017 年 4 月 11 日午前 10:25 UTC](https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765 "2017-04-11T10:25:06Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![tophee](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tophee/32/73406_2.png) [@tophee](https://meta.discourse.org/u/tophee)\ **Post date:** [2017 年 4 月 11 日午後 1:33 UTC](https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765/3 "2017-04-11T13:33:03Z")
> [@sam](#): > > That said, I don’t think the current state of affairs is terrible, the actual links to the assets contain “secure random” strings, they are not guessable. Correct me if I’m wrong: but what good are those random links if they are indexed by google? > [@sam](#): > > What if someone with access downloads the paper and then forwards it via email? Maybe I should just save all the papers to `/dev/null`just to be save? LOL But seriously (if this is of any concern here): the default mode of distributing work-in-progress papers at (academic) conferences and workshops is that all authors send their paper to the convenor who then circulates them to the registered participants (or whatever was agreed with the authors). So I’d say that is the security standard to measure this specific use-case against, i.e. the original recipients are by default trusted to not circulate the paper any further, let alone to make it available online. So the question is: what additional threats am I introducing by distributing the papers via the forum? One is the risk of (unintended) online publication via search engines (see above). Another, much smaller one, is the accidental forwarding of the link to wherever due to the fact that some users will not be aware of the link being secret (e.g. when forwarding an email in which they were notified about the topic with the link). Finally, there is perhaps also a small risk of discourse leaking the link for whatever reason (this is something I cannot assess myself). > [@sam](#): > > This is something I want core to support out of the box That is great news! Will this protect content retrospectively? > [@sam](#): > > but it would require a fair bit of internal change. Hm, should I read this as saying that the existing plugin is not doing a good job? --- _[View the full topic](https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765)._