Comment by stingraycharles

2 days ago

But what is the root cause, why send the email in HTTP requests in the first place?

Robots are supposed to send one.

https://httpwg.org/specs/rfc9110.html#field.from

  • When fetching a website it's not a robot any more than my browser or curl are.

    These two do not share my email and real name with everyone who wants.

  • Oh that’s interesting, so it’s actually somewhat doing what it’s supposed to do as a “nice actor”.

    Should be more explicit though and users should be able to opt out.

  • For example I had Claude code up integrations with the Federal Reserve, and I pass my email there. They request clients do so.