It turns out the server is using referer checking and I've got referer disabled. Compare the following curl invocations:
curl 'https://fabiensanglard.net/jurrasic_park_computers/00_11_15_Apple_Powerbook_100.webp' \ -H 'Referer: https://fabiensanglard.net/'
curl 'https://fabiensanglard.net/jurrasic_park_computers/00_11_15_Apple_Powerbook_100.webp'
It turns out the server is using referer checking and I've got referer disabled. Compare the following curl invocations:
vs. just The latter gives a 403.