Here’s something I didn’t know: the “wget” command saves the URL where it got a downloaded file as an extended attribute of the file. This behaviour isn’t mentioned anywhere in the man page or in the info file, that I can find. Unfortunately, this can lead to a security issue where the URL includes confidential password details. And it appears other apps, like Chrome, do a similar thing. <https://www.theregister.co.uk/2019/01/02/wget_bug_fix/>