[Standards] Re: HTTP file upload deletion

On Sun, 8 Nov 2026 at 13:59, Matthew Wild <mwild1@gmail.com> wrote:

The PR for the XEP is at https://github.com/xsf/xeps/pull/1584

I like the text, but as noted elsewhere I feel a bit queasy about putting this into a Stable XEP. I think the Security Considerations should note that a server might not actually delete the file; it may be required to retain it for audit etc. Therefore clients cannot rely on the file actually being deleted. If servers do retain the file, it MUST NOT be accessible via the previously published URL. Dave.