Btw: Can someone tell me why he path-guessing is so dangerous?

Cause organizations like Sony have already done things like installed rootkits on people’s computer. Now imagine they realize this is a flaw in some media setups the their legal departments start actioning on it. (generate a rainbow table of common names for files, and common paths used in linux/docker containers… running 10000 http requests on a server over a few minutes is child’s play)

All it takes it one thing to parse on a list that never had a physical release and now your whole server will be subject to discovery at the court case.

If you have literally no illegal content on your server, no problem… other than that you’ll be on the hook to provide proof of rights to have the content… and possibly at worst rights to distribute (they accessed it without authentication, so literally anyone else could have too).

Edit: Oh but hold on! I hear you say that it would be illegal for them to scan your computer like that…

Except it isn’t. There’s no law that says you can’t try to navigate to a URL. There are laws that say that you can’t bypass attempts to authenticate/protect content… but remember the endpoint isn’t behind authentication.