Hi @KaiKemmann. Do you want to work on this task or I can claim this task?

And, how are these storages be free license licensed?

As far as I know, usually websites which host files under free licenses are added to the whitelist. But these domains can host anything, basically.
(Maybe https://commons.wikimedia.org/wiki/Commons:Upload_tools/wgCopyUploadsDomains and/or https://commons.wikimedia.org/wiki/Commons:Upload_tools#Upload_by_URL need a better explanation of scope because I'm not sure that's a 'rule' or not.)

I am really not very familiar with the procedures and mostly just looking for a way to efficiently upload from a smart phone.

But I understand the "upload_by_url" function is only available to users with special functions ("Image reviewers, Admins, GWToolset users, Extended uploaders") or to reliable users by application.

So having a whitelist for the sources these supposedly trustworthy users can upload files from might be considered an unnessecary precaution.
But who am I to know about the reasons behind these measurements ...

@Zoranzoki21: I am not sure what "working on a task" involves. I would therefore be happy if you would want to "claim the task" and do with it whatever you deem appropriate.

thanks for your attention,
Kai

From a security point of view, the idea of the whitelist is:

• to avoid to DDoS external networks from Wikimedia Cluster
• to avoid the Wikimedia Cluster is DDoSed by external networks

If the domains are as public as usable by any user, that could be a source for a DDoS effort: for example in the past we got the video convert jobs saturated by movies uploads for Wikipedia Zero.

From an usability point of view, those domains are generally protected by login or HTML confirmation from to be able to use them: Google Drive is especially difficult to fetch from (the picture URL won't always work for example).

Related: T210330: Please add https://pbs.twimg.com to the wgCopyUploadsDomains whitelist of Wikimedia Commons

In T211464#4808574, @Dereckson wrote:

From a security point of view, the idea of the whitelist is

Is this true? Uploads-via-URL for Commons are already restricted to a pretty small set of users (sysop, extended-uploader, bot, and Image-reviewer). . I'm not sure the defence-in-depth concern is the main reason we have this, but instead as a community policy thing about what sources are valid (which itself seems a bit odd, as the community normally expects trusted users to use their own judgement on such things).

In T211464#4918526, @Jdforrester-WMF wrote:

Uploads-via-URL for Commons are already restricted to a pretty small set of users (sysop, extended-uploader, bot, and Image-reviewer).

Now I oppose to the implementation of this request, because upload_by_url right will be granted to all autopatrolled users soon (T214003), so we need to have a cherry-picked whitelist.