Note: This post now archived and as such no longer works

This post knows where you're viewing it from (Lemmy doesn't proxy external images) [ARCHIVED]
3 years ago by TriLinder to c/technology
Note: This post now archived and as such no longer works

The best part is it also works on DMs, so it's trivial to get any persons IP address. Want an admins IP address? Just DM them a message with an embedded spy pixel.
I emailed the lemmy developers about this a few weeks ago since IMHO it's a pretty big security issue, no reply.
Didn't knew you can DM on lemmy. Maybe the Jerboa devs have not implemented it yet.
Not really.

@lemmy.world
go to feed...
@lemmy.world
go to feed...
This is possible because Lemmy doesn't proxy external images but instead loads them directly. While not all that bad, this could be used for Spy pixels by nefarious posters and commenters.
Note, that the only thing that I willingly log is the "hit count" visible in the image, and I have no intention to misuse the data.
save