Files now have a "cacheable" flag, which is approximately equivalent to "public" -- internally, canCDN, i.e., can distribute over a content distribution network.

We currently set this flag on files uploaded as profile images, on generated thumbnails, and on files uploaded as macros.

Files with this flag allow public access without a one-time token. Flags without it require the viewer to carry a token with them, essentially proving they have current access to the file itself (and don't just know the URL). This stuff was added in T5685 and related tasks, primarily to give installs greater confidence about using Phabricator to store sensitive documents. Although the one-time tokens aren't really much more secure than the unguessable URLs alone in a practical sense, they feel a lot more secure.

This doesn't address two use cases, which are sort of the same use case, but not quite:

• sharing arbitrary images with public users;
• sharing arbitrary files (e.g., via Phragment) with public users.

We could do a couple of things here, I think:

1. Let "public" visibility imply the "canCDN" flag. This will fix the images use case for public installs pretty naturally, but leaves the binary use case unaffected and doesn't help non-public installs (although maybe that's OK-ish?).
2. Let users (only users with "Edit" permission?) generate a public link to the file? Or a link with options (expiry, one-time-use, etc)? This seems kind of involved.
3. Let files dropped onto the home page get the canCDN flag.
   • Or, when you hover over the home page, let the user drop on the left half to create a private file (user-only visibility policy) and the right half to create a public (default policy, canCDN) file?
   • Seems sort of tricky for users.
4. Let users turn canCDN on for a file? Also doesn't feel great.

Do any of these feel clearly better/worse to you? I don't really love any of them, but would like to find some solution that allows users to willingly share files with anonymous/public users.

I think public accessibility implying canCDN is the easiest fix here.

Basically the use case was that I dragged a screenshot onto the homepage, which made the file public, but then I couldn't share the direct image link.

Implying canCDN from public visibility should also fix any potential issues with Phragment, since you can just set the top level item to Public, tick the "recursive" option when editing policies, and then everything should work as expected.