I think it’s really bad considering some links unexpectedly want you to download something and you don’t even know what it is. Previously you simply canceled the unexpected save dialog, now the browser automatically starts writing the unknown file to your disk.
But even ignoring the above case, sometimes I don’t want to download a file to the default location but to RAM, and sometimes I cancel the save dialog even though I anticipated it (e.g. once I see the file size).
In the browser settings I enabled “Always ask you where to save files”, but still on some websites it starts writing the file to disk automatically, without asking me where (and if) to save the file first.
OP issue is about the default application Tor browser uses to open a downloaded file; his workflow is: download a file > click on it > it is opened with default application without prompt.
To my understanding, your issue is different: files are downloaded automatically even if you enabled «Always ask you where to save files»; your workflow is: click on download link > file is downloaded without prompt. I can’t reproduce your issue, but I think you can solve it changing your browser settings. Go to Settings > General > Files and Applications > Applications and check that in the table no Content Type has its Action set to Save File. Also check, just under the table, the option What should Tor Browser do with other files?.
You can still do this before the download is complete, I can’t understand what issue you have here.
My assumption is that while the concrete complaints are not the same they are both related to the recent changes in downloading behaviour. I apologize if OP is referring to an older issue.
Correct. I did all of those. For Content Type I set it all to Open in Tor Browser where possible, otherwise to Always ask. I also have Ask whether to open or save files (just under the table) checked.
However Tor Browser still automatically writes files to default download location (which I haven’t touched either) without prompt on certain websites, such as libgen (click “GET” link to reproduce): https://library.lol/main/4E0132B1F9BF0474BD67889EA7954AE9
I’m guessing this behaviour depends on the response headers, specifically because Content-Type is not application/pdf. Here’s the response headers for the PDF above:
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 03 Aug 2023 11:50:02 GMT
Content-Type: application/octet-stream
Content-Length: 225094
Connection: keep-alive
ETag: "5f0da18d-36f46"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="(expository notes) J. Peter May - Notes on Tor and Ext (2011).pdf"
After the PDF is written to the disk to default location, it opens the local file (file:///home/etc/...) in Tor Browser’s built-in reader.
In this case where the browser can’t tell the file is PDF before downloading it because of generic Content-Type header, I would have expected it to offer me an open/save dialog instead. That is the way it worked previously (IIRC before 12.5 release).
As a side note, opening the same online PDF multiple times even creates multiple local copies in the default download location.
It starts writing the file to disk.
It’s unnecessary and wasteful when fetching the response header is enough to read the file size, which I assume is how the save/open dialog manages to do it without downloading the file itself.
I mean that you can mount RAM space as a filesystem and write files to it, thus avoiding writing files to disk. This is useful if you want to keep the file only in memory but need to open it with an external program.
The point is that even if someone wants to write a file outside of the Tor Browser process, it is not necessary that they want the file to be written straight to disk to default download location. Another example would be writing to an encrypted container such as LUKS, or to an external storage.
What’s bad is that Tor Browser now automatically writes to disk for certain websites / response headers, and worse even, it can happen completely unexpectedly because you can’t predict the response header of the link you clicked on.
Since Tor Browser is aimed at providing anonymity, it should also make it possible for its users not to leave unnecessary traces outside of the Tor Browser program, in this case making it possible to not write files straight to disk without asking you first.
That is how Tor Browser worked previously by default. Now this is not possible at all anymore, as far as I can tell with the options provided in about:preferences.
My assumption is that while the concrete complaints are not the same they are both related to the recent changes in downloading behaviour. I apologize if OP is referring to an older issue.
OP is referring to a different issue, and it wasn’t intended to be part of the recent changes to the downloads UX (unless it’s a recent regression – however to the best of my memory Tor Browser has worked this way for some time).
As to this issue:
What’s bad is that Tor Browser now automatically writes to disk for certain websites / response headers, and worse even, it can happen completely unexpectedly because you can’t predict the response header of the link you clicked on.
I completely agree – I think the best approach would be to patch the “Always ask where to save files” preference to prevent Tor Browser writing to disk in the background, although we’re still discussing the ins and outs of this. Then, we can reconsider whether or not this should be enabled by default.
thats seems like a good default not sure why it changed to begin with…
It’s a bit of a tangle of different issues.
Downloading in the background has been a thing in Firefox for a long time – see Bug 438905, for example.
However before Tor Browser 12.0, a custom dialog warning against a proxy bypass scenario by opening downloaded files in external app also prevented background downloading until the dialog had been cleared. This was not obvious, and users were either confused by it or ignored the old dialog completely – rendering it ineffective in practice.
In addition to this issue, new users had to deal with four(!) popups to download a single file as per Tor Browser’s default settings.
To improve all of the above, we moved the proxy bypass warning out of a dedicated dialog and into Firefox’s toolbar popup in Tor Browser 12.0, where it’s performed better than its previous location in usability testing. To help combat the general popup fatigue we also switched the remaining dialogs to Firefox’s defaults, and as of FF98 “Always ask where to download new files” has been off by default: How file downloads are handled in Firefox version 98 and above | Firefox Help
This was done in the knowledge that users could always re-enable these preferences within “General settings > Files and Applications” if they wanted. However as mentioned in my last reply, we now need to fix the issue of Firefox downloading files in the background, regardless of how “Always ask…” is set.