[ https://issues.jboss.org/browse/JBDS-3163?page=com.atlassian.jira.plugin.... ] Pete Muir commented on JBDS-3163: --------------------------------- The way the download manager works is: 1) Verifies that the person is authorized to download the binary (e.g. check t&c, check login, whatever is required) 2) Contacts the download server and requests a timebombed URL, which is unique to this request 3) Contact eloqua to track the download (two mechanisms have to be used here, this is due to oddities in eloqua) 4) Gives the person the timebombed URL, which works for around 20 minutes At the moment the only server I'm aware of that hands out these timebombed URLs access.cdn.redhat.com. The download manager does not actually store or deliver files itself. The approach Nick suggests is "security through obscurity" and hence I don't support it. It looks to me like you are trying to handle this for staging builds (as opposed to prod builds). I believe that most products don't make staging builds public. -- This message was sent by Atlassian JIRA (v6.3.8#6338)