Bitcoin Forum

After changing my avatar and trying to change it again to the original one - a very simple two frame animation of the vegetable you can see now (872 Bytes in total size), the forum did not allow me to add the original animation file which used to be my avatar since years.

Since when is it no longer allowed to add animated gifs and what's the rationale behind this policy? Why does it apply to legacy avatars as well?

Wouldn't it make more sense to restrict the use of avatars via file size only?

Since there was a security issue with avatars.


It doesnt, your avatar is no longer legacy as you changed it.

I don't think so. The file is the exactly the same as was used previously.

I remember the avatar-related security issues in the past. But I'm not aware that these were caused by gif animations.

The only reasonable explanation I could imagine is that animations may distract from content. But the animation I used is so minimal that it's unlikely the case.

Note that my animated avatar used less than 1% of the maximum allowed file size. If I'd be mean, I could upload a new 100 KB static avatar just to express my frustration by draining more forum resources... ;D

Avatars are deleted from the server once changed. It doesn't matter if it's the same file.

I'm unsure if it is the same security issue that the forum had, although it seems like it could be the case, you can read about how an attacker can run arbitrary PHP code through gif images here (https://www.phpclasses.org/blog/post/67-PHP-security-exploit-with-GIF-images.html). As said, I'm unsure, however considering that the security exploit was executed by running arbitrary PHP code (https://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_hacked/ccjyjti/) it could be possible that the two are linked.

I don't think that storage space is the problem with your avatar.

I just noticed this member is using gif avatar,  https://bitcointalk.org/index.php?action=profile;u=878718
He has joined here just 137 days back. Sorry I could not test myself, gif avatars are back ?

Holy cow ! Now I am with an animated avatar. I guess you may get a reward for finding security vulnerability !  ;)

Did you really add that animation recently? That would be very strange indeed.

I tried again, but get the same error message that animations aren't allowed. I even tried renaming the animated gif to .png, but it was still detected as animated gif.

I still don't know, what animated gifs would have to do with security.


Edit: Was able to upload an animated png (APNG). However that only is shown as animated in a few browsers.