The trick is that to embed images in Lemmy, you’re basically hot linking them. That means any kind of tracking your average web server can do, is possible through Lemmy’s image embedding feature.
I’ve explicitly disabled any kind of logging for the proof of concept above (it’s generated in the fly by the server, not cached on my end, no IP logs or anything) but it’s not hard for a malicious user to abuse this. It basically takes your IP address, looks up an estimated town based on some free geoip database you can download, and renders that as text inside an image.
This could be solved by rewriting comments to force image URLs to be loaded through your home server, but I don’t know if anyone has started work on that yet.
It basically takes your IP address, looks up an estimated town based on some free geoip database you can download, and renders that as text inside an image.
wtf
The trick is that to embed images in Lemmy, you’re basically hot linking them. That means any kind of tracking your average web server can do, is possible through Lemmy’s image embedding feature.
I’ve explicitly disabled any kind of logging for the proof of concept above (it’s generated in the fly by the server, not cached on my end, no IP logs or anything) but it’s not hard for a malicious user to abuse this. It basically takes your IP address, looks up an estimated town based on some free geoip database you can download, and renders that as text inside an image.
This could be solved by rewriting comments to force image URLs to be loaded through your home server, but I don’t know if anyone has started work on that yet.
OK, less magic than expected.