Hi Eric,

>> Is it possible to disable fetching remote files by some setting?
>
> I would not want automatic retrieval of URLs without confirmation.

This already occurs with #+setupfile.

I think this is a good point to raise, but a slightly separate one as it
concerns the pre-existing behaviour of org-file-contents.

A new patch set introducing a defcustom with three values (t, prompt, nil) and
accompanying modification to org-file-contents (it’s the only use of
`url-retrieve-synchronously' other than org-feed I see) would probably be a decent
idea. If nobody makes such a patch in the next week or so I’ll take a punt at
this.

All the best,
Timothy