Images now proxied

[theymos]

One thing you can do is whitelist the common image hosting sites that don't provide viewer IP information upon request of the uploader. If the domain is not imageshack, imgur, etc., then send it through the proxy.

What's the point of that, though? Such images are proxied fine.

[1713557102]

1713557102

[1713557102]

1713557102

[1713557102]

1713557102

[1713557102]

1713557102

[Maged]

One thing you can do is whitelist the common image hosting sites that don't provide viewer IP information upon request of the uploader. If the domain is not imageshack, imgur, etc., then send it through the proxy.

What's the point of that, though? Such images are proxied fine.

This would at least somewhat allow animated gifs.

[Raize]

Does weserve.nl delete the logs of served images immediately?

This seems to both eliminate the ability to find IP info of scammers as well as provide a single entity for a state-run organization to target for easy access to user info. I'm not saying it's bad or worse, but is there a reason weserve.nl was chosen? (deleting logs immediately would be a good one).

[justusranvier]

It looks like some avatar images are not being proxied.

[whiskers75]

It looks like some avatar images are not being proxied.

They aren't supposed to be, but hey theymos! Great idea there for you!

[justusranvier]

They are hosted on the forum's server so their would be no benefit to proxing them.

Not all of them are.

Some people have their avatars set as a remote URL.

[whiskers75]

It looks like some avatar images are not being proxied.

They are hosted on the forum's server so their would be no benefit to proxing them.

Well, what if I wanted to serve my avatar from http://whiskers75.com/codercat?

[rme]

Theymos, the little IM status icons are causing mixed content alert:

http://status.icq.com/online.gif?img=5&icq=235892813
http://opi.yahoo.com/online?u=the_spoon.geo%40yahoo.com&m=g&t=0


Fixed:
https://images.weserv.nl/?url=status.icq.com%2Fonline.gif%3Fimg%3D5%26icq%3D235892813&fnr
https://images.weserv.nl/?url=opi.yahoo.com%2Fonline%3Fu%3Dthe_spoon.geo%2540yahoo.com%26m%3Dg%26t%3D0&fnr


Also, you sould urlencode() the image url before concatenating to https://images.weserv.nl/?url=

Still not fixed,

example here: https://bitcointalk.org/index.php?topic=343912.msg3742796#msg3742796

Mixed content

[ReCat]

that's kinda retarded that it breaks gif images. what, was this written by an 8 year old?

[Richy_T]

Does anyone know of another reliable HTTPS proxy that would work? I'd prefer that the forum not do this itself, as we'd then need to worry about abuse, legal issues, etc.

If you or anyone wants a image proxy script that doesn't break the gifs and proxies them as well, you can contact me.

I wrote it in an hour so it could use a few more optimizations but it works for the most part.

I'm guessing the proxy actually re-writes gifs which is what breaks them. If it was simply caching them, it would not be an issue. It depends on whether this rewriting is a requirement or not.

If caching/proxy is all that's required, something like Squid should be able to handle it.

[Richy_T]

They are hosted on the forum's server so their would be no benefit to proxing them.

Not all of them are.

Some people have their avatars set as a remote URL.

I thought the forum reached out and downloaded them locally if that was the case.

[Richy_T]

My own feeling is that it's not worth worrying about. If people are that paranoid about their privacy, they should take their own precautions. Embedded images are the way the web works. If you don't like them, there's lynx or www or you can disable images or there's probably 1/2 dozen plugins for firefox (There used to be a disable images setting. Is it still there?) or you can use iptables or a configured proxy or probably 50 other solutions.

Frankly I'd just like the animated gifs back. Though I'm not upset that the bandwidth bills have dropped for ChartBuddy.

http://kb.mozillazine.org/Permissions.default.image

Possible values and their effects

1
Allow all images to load, regardless of origin. (Default)
2
Block all images from loading.
3
Prevent third-party images from loading.

And is it not an issue that instead of privacy potentially being (minimally) violated by a forum member, our links have now been handed over en-mass to some company in the Netherlands.

[rme]

I have find a solution to animated GIFs

Use CoralCDN (http://www.coralcdn.org/) when the image is a gif to make them move.

Just append .nyud.net to the end of the domain.

Example:
https://i.imgur.com/VfUsRPB.gif
https://i.imgur.com.nyud.net/VfUsRPB.gif

https://i.imgur.com/9qq1xOl.gif
https://i.imgur.com.nyud.net/9qq1xOl.gif




Also, the little ICQ status icon below someone profile (when posting in a thread, below his avatar) is loaded in HTTP.
http://status.icq.com/online.gif?img=5&icq=235892831

Please load it with the proxy.

[theymos]

Coral CDN doesn't support HTTPS.

[nimda]

And it was 404'ing earlier today.

[ReCat]

Coral CDN doesn't support HTTPS.

Is it so hard to make the code a little bit more complicated just to support GIFS? I suppose it renders the image into a buffer and then renders an image from that buffer, to be safe from bad binary data hidden in an image?

If it's not doing that to be super-safe, FOR GOD SAKE PROXY IT BYTE FOR BYTE.

[Raize]

Actually, yeah, it could be difficult to do on the fly without the right libraries to essentially rebuild the animated image or correctly strip identifying metadata (if that's the other reason why this proxy has went in place).

Proxying it byte for byte could have other implications, none of which are present today (that we know of), but that's been used to screw with IE to do XSS in the past (you could muck around with content-type with an old IE by having the .JPG act as HTML or Javascript).

[Richy_T]

The libraries are out there. It would just be finding somewhere that uses them as Theymos has indicated he's not willing to put any effort into this.

[ReCat]

I'm not a programmer and I can do a better job than this.

[gweedo]

It would just be finding somewhere that uses them as Theymos has indicated he's not willing to put any effort into this.

I don't think that is true that all, I just think it is hard to find actual business that does this type of proxing. Remember proxing images isn't easy at all, it takes up a lot of space to cache, bandwidth, and it isn't cheap to run this service. Remember this forum is over 100K+ members and I would say about 65% of post contain some image of some kind. That means you have to have some pretty powerful machines. I would say at least a dedicated server. There is no money that can be made from this service either, it is a very niche situation.

But if anyone has a good dedicated server they are not using, here is the software I built https://github.com/italiano40/image-proxy just requires mysql, php 5+ and ability to add cron jobs, so anyone can host this and try to convince theymos it is the best option if you believe it is.