@mjg59 can you link me to source or doc of what you’re referencing?

You said agree, but what you’re saying wasn’t my intent. To me, before your reply, I was okay with libcurl doing this. But interesting response. @bagder, how do you feel if the default remained what you have today, but what @lattera is suggesting can be a global environment variable that must be explicitly set to get the old behavior back. Something like `CURL_ALLOW_INSECURE_TOR`?

@lattera @bagder @jordan as a unbiased third-party let me chime in here for a second… The point of the spec is to not falsely give users of applications, a sense of security and privacy, when the ecosystem of said application leaks information when communicating with Tor. I think the fixes you’re looking for should be placed in the upstream application, trying to utilize curl or its libraries, so that they are compliant with what the Tor project expects.