90

TL/DR: You won't be able to switch back to your old Gravatar image if you change your email (or have changed your email in the past). Please save and re-upload your Gravatar image if you want to keep it going forward.

Hi, everyone! I’m Felippe Rangel, a software engineer at Stack Overflow, and I’m here today to talk about a code change that will affect some users’ profile images.

One of the big projects we're working on right now is related to how we do Identity around the company. Over the past 12+ years since Stack Overflow's launch, there have been a lot of changes in the world of authentication and authorization, and although we have done our best to keep up with those changes, we're overdue for an upgrade. As we move towards a more centralized login solution for Stack Exchange, a lot of code cleanup is required, part of which includes having each Stack Exchange network account use one centralized Verified Email, instead of having individual email addresses associated with the user’s profile on each site on the Stack Exchange network.

But didn't you centralize email already, years ago? I can only see one email field in my settings...

Yes, voice inside my head, you are correct; from the user's perspective, this was done a while ago. That's why getting rid of the last traces of Email Per Site is being treated as a code cleanup, one that we've been working on for quite some time. And at this point in the road, it finally caught up with Profile Images, and therefore Gravatar.

Wait, where's my option to use a new Gravatar?

We haven't officially supported Gravatar in a while; we just made an effort to keep the existing ones working.

Why is this change even affecting Gravatar?

Stack Overflow uses a hashed version of your email address to access your Gravatar image. If your email address changes, we simply can no longer access that Gravatar URL. This wasn't a problem when your Per-Site Email was frozen in time. Now that your main email will actually affect that URL, your Gravatar profile image might be lost. We will keep displaying the image as long as you’re using it, but it will disappear from the image selector if you change your email.

But, but, I will really miss my Gravatar! How can I save it from doom?

We apologize for the inconvenience. To guarantee that you will keep the same image in your profile going forward, we humbly request that you download that image and re-upload it to your profile. It will be saved with our managed image provider (Imgur) and kept throughout this identity transition.

Thanks for understanding, folks! We hope it isn't too much of a bother to re-upload those images. We will do our best to keep displaying Gravatars from unchanged e-mail addresses, but we won't guarantee those forever (as we no longer officially support Gravatar).

Improve this question
21
  • 14
    I personally am OK with this, as Gravatar has seemed pretty problematic (and not just back in the day either: meta.stackoverflow.com/questions/409143/…). Also, welcome to Meta!
    – Ollie
    Commented Sep 23, 2021 at 17:33
  • 38
    Uploading to imgur is NOT going to work at all, because at gravatar they respect transparency in an image. While imgur also does that, the logic that is used especially for user profiles is to add white in place of transparency. Uploading the image to imgur to use it for as a profile avatar is not a solution to users on Stack Overflow since that has both light and dark mode and retaining the transparency is important.
    – Unconsidered
    Commented Sep 23, 2021 at 17:49
  • 9
    So this issue is being fixed?
    – Sonic the Anonymous Hedgehog
    Commented Sep 23, 2021 at 20:19
  • 11
    This would be a good use of a banner. Not that it would make a difference anyway since the company has already trained users to ignore banners ¯\_(ツ)_/¯
    – 41686d6564
    Commented Sep 23, 2021 at 20:39
  • 14
    Are there plans to remove Facebook avatar support too, or just Gravatar? I use tracking protection in my browser, so I get broken images when Stack Exchange tries to make a cross-site request to Facebook's CDN.
    – Maximillian Laumeister
    Commented Sep 23, 2021 at 21:51
  • 1
    Y'all haven't supported Gravatar in how long?? Wait, that's what I've always used to upload my avatar. I get the whole legacy support angle, but when were we going to be told about the lack of capabilities? But in your defense, my email isn't likely to change anytime soon, so I'm largely unaffected; just feels awkward to have this sprung on me.
    – Makoto
    Commented Sep 24, 2021 at 5:18
  • My avatar URL is i.sstatic.net/b6aMa.png?s=48&g=1 will it stick?
    – Joshua
    Commented Sep 24, 2021 at 14:03
  • Seeing this made me realize my gravatar image changed a while back, unintentionally, probably due to changing the primary email address on my account. Is there any way to get the old one back still (aside from looking for screenshots) or is that no longer an option due to this change?
    – R.. GitHub STOP HELPING ICE
    Commented Sep 24, 2021 at 14:04
  • @R..GitHubSTOPHELPINGICE: I suspect since you have your email there's a way to determine the hash to look it up and download it.
    – Joshua
    Commented Sep 24, 2021 at 14:04
  • 2
    People are still using gravatar O_O?
    – Optimus Prime
    Commented Sep 24, 2021 at 23:13
  • 3
    Upvoted because it's very well explained and clear and I understood it; despite of the fact I don't work with computers (at all) and I don't have a gravatar thingy.
    – Mari-Lou A Слава Україні
    Commented Sep 25, 2021 at 12:13
  • 2
    Well-written post! I would like to see all images (including profile images) hosted by StackExchange, and not third-party companies, each with their own policies.
    – End Antisemitic Hate
    Commented Sep 26, 2021 at 2:46
  • 6
    The title has been changed to better fit in the featured post box
    – Yaakov Ellis
    Commented Sep 26, 2021 at 18:23
  • 1
    @YaakovEllis You are probably aware of this already, but in case you were not, announcement/HNQ titles that overflow (and thus get truncated with an ellipsis) are hoverable, and the displayed tooltip shows the full title! Reference: meta.stackoverflow.com/questions/273003/…
    – TylerH
    Commented Sep 27, 2021 at 19:56
  • 1
    You also can upload your own Avas there and it had a reasonable way to manage multiple Avas. It wasn't completely junk, and served its purpose
    – Journeyman Geek
    Commented Oct 1, 2021 at 9:44

8 Answers 8

Reset to default
111

Just gonna point out that most folks won't read this thread; it's on a non-site-specific meta, it has a nondescript title, and it isn't featured.

IOW: most folks affected by this will find out after they've already lost their avatar. That's not catastrophic - there are usually ways to find and pull the image (or Identicon) previously used - but it's gonna be more of a hassle than it has to be.

Suggestions:

  1. Obviously the system can know when it's about to change a used hash; insert logic to grab the image and upload it, ensuring an (almost...) seamless transition.

  2. If #1 ain't feasible for some reason, pop up a short message in the same scenario, advising the profile editor that they're about to lose their avatar and linking to this thread for more information.

Improve this answer
7
  • 15
    #1 might not be feasible for legal reason? Similar to why you can't move a jsfiddle to a stack snippet when you're not the OP.
    – rene Mod
    Commented Sep 23, 2021 at 18:22
  • 1
    Just a small update that the question is now featured network-wide, but the title is still worrying since the important bit about Gravatar is cut off...
    – Meta Andrew T.
    Commented Sep 24, 2021 at 4:21
  • 3
    Readers who wonder what does @rene refer to: May I edit a question with a JSFiddle link to incorporate the code?
    – HeyJude
    Commented Sep 24, 2021 at 8:43
  • 1
    @rene: There is no copyright interest in gravatars. They are entirely machine generated, and copyright arises from human creativity, so all gravatars are public domain images. They also contain no PII, because they are made from a hash, not the actual email. Frankly, I find it difficult to imagine a reason why this should not be permitted.
    – Kevin
    Commented Sep 24, 2021 at 8:50
  • 4
    @MetaAndrewT. On the other hand, "You won't be able to switch back to your old..." makes it rather effective clickbait :)
    – GoodDeeds
    Commented Sep 24, 2021 at 10:32
  • 7
    @Kevin Gravatar allows uploading your own images, not just displaying the auto-generated icon you get when you don't (e.g. my Profile image is one I've uploaded to Gravatar, so I'm represented by the same icon everywhere in the internet). I agree that there might be no copyright issue when copying a generated image, but copying user-uploaded images might be more problematic. (I am not a lawyer, though.)
    – Paŭlo Ebermann
    Commented Sep 24, 2021 at 22:44
  • 6
    None of us are lawyers. Or if we are, we aren't SE's lawyers. So the whole legal discussion is kinda pointless. I am pretty damn sure there's a way to do this, but if it ain't in the cards option #2 is definitely on the table - I've written queries that'd suffice for such a warning, they ain't fun but they ain't onerous either. (also, good to see ya around, @PaŭloEbermann!)
    – Shog9
    Commented Sep 25, 2021 at 3:09
102

Please find a way to support transparent profile images

Currently, the only way to have a transparent profile image is to use Gravatar, because Imgur puts a white background on the resized images. Look how nice my usercard looks across different backgrounds:

My usercard on a light background on an answer My usercard on a dark background on an answer My usercard on a light background on a question My usercard on a dark background on a question

Now here it is with the white background behind it as shown in the review queues:

My profile image with a white background

It's designed to look good on a transparent background. It looks worse when it's forced to have an opaque background. Plenty of people have profile images like this. Please let us keep them.

Improve this answer
2
  • 16
    Ah, I remember this issue. I was wondering how you solved it…
    – Sebastian Simon
    Commented Sep 23, 2021 at 18:18
  • 6
    The trivial (but not entirely user-friendly) way to support this would be to not muck with the original image at all if it fulfills some simple criteria like already being the correct pixel size etc. Just publish the criteria and an API for uploading images under this regime, and a (raving mad and sarcastic but) competent cadre of volunteers will handle the rest.
    – tripleee
    Commented Sep 26, 2021 at 13:55
30

I think it would be better to remove Gravatar entirely from the system and switch to only self-hosted Avatars. There are privacy considerations when using off-site avatars, so apart from the unreliability of Gravatar there are other reasons to fully move away from it.

I think the transparency issue mentioned in another answer is a major issue though, that really should be supported by native avatars.

Improve this answer
10
  • 1
    I think handling transparency isn't that much of a trick. SOUP does it if you're running that script, so the devs could just take a peek at that.
    – Adrian Mole
    Commented Sep 23, 2021 at 21:43
  • 1
    Here's what I look like without Soup and with it running.
    – Adrian Mole
    Commented Sep 23, 2021 at 21:52
  • 6
    @AdrianMole SOUP "fixes" it by using the original, unmodified Imgur file (when we use size attributes, for example, Imgur removes the transparency when resizing it). That absolutely would not ever happen in live code, because then there would be no limit to file size and we'd be forcing every user to download potentially enormous images. Users are more than welcome to download those images if they want, but it's going to stay in a user script unless Imgur changes their behavior.
    – animuson StaffMod
    Commented Sep 23, 2021 at 23:35
  • 2
    @animuson: Then use imagemagic to resize it rather than imgur.
    – Joshua
    Commented Sep 24, 2021 at 14:17
  • 9
    @Joshua The whole point of sub-contracting to Imgur is that Stack Exchange's servers don't have to handle the bandwidth and processing of images. If they implement their own upload, resizing, and size selection, they might as well just ditch Imgur and buy some S3 space to serve the results from. I very much doubt they care enough about transparent avatars to do that, so it really is up to Imgur to fix this.
    – IMSoP
    Commented Sep 24, 2021 at 15:30
  • 4
    @IMSoP on Teams SE hosts the images themselves, so they have the capabilities for hosting images now. They might still not want to do this themselves for public sites, but this is not as unlikely as it was before Teams
    – Mad Scientist
    Commented Sep 24, 2021 at 16:42
  • 1
    @IMSoP: They could resize the images once and upload them to imgur already the correct sizes the various components use.
    – Joshua
    Commented Sep 24, 2021 at 16:44
  • 4
    @Joshua Sure, that's what I meant be "size selection": they'd have to upload multiple files to Imgur, then store which files correspond to which sizes, and have a way to serve the right file in each location - all things which Imgur currently manage for them (append a query string to the Imgur URL, and they deal with the rest). They might do it to save money, or because the relationship with Imgur turned sour, but "a few users want transparent avatars" isn't going to be enough to sign off several weeks of development work to replicate what they already get from a third-party service.
    – IMSoP
    Commented Sep 24, 2021 at 17:11
  • 16
    @animuson I suppose you (SO) have some kind of contractual relation with Imgur – maybe you can suggest that feature (retain transparency when resizing) to them?
    – Paŭlo Ebermann
    Commented Sep 24, 2021 at 22:42
  • 1
    @PaŭloEbermann maybe post that as a seperate feature request so it gains more attention?
    – Ekadh Singh - Reinstate Monica
    Commented Sep 27, 2021 at 22:53
11

I want to ask if this will fix the security issue described in this post A user's original email address is retained in the system even after they've changed it on all sites (privacy risk, potential Area 51 sync issues)?

In other words, will users be able to change their email on all sites using only the profile settings without having to contact SE to ask for their email to be changed?

Improve this answer
1
  • 23
    No, it will not fix it right now. The issue won't be fixed until the column is actually dropped from the database, which cannot happen until no code in the entire code base references that column anymore. Gravatar is a major step and one of the blocking issues. The entire unregistered user system is another major blocker being worked on.
    – animuson StaffMod
    Commented Sep 23, 2021 at 23:57
9

How do I know whether I have a Gravatar profile picture? I know that I have a Gravatar account, because it was mandatory on another website, but I don't know if I used it here.

This is what I see on my profile settings page:

settings

There's no mention of Gravatar there, does that mean that I'm not using it (here)?

Improve this answer
1
  • 11
    Click on "change picture" and it will display a list of options with a checkmark next to one of them.
    – animuson StaffMod
    Commented Sep 25, 2021 at 23:08
4

First of all, thanks for the TL;DR in a title, it's a nice touch for featured posts in general.
Now onto the topic:

I don't consider myself being overly-stupid in general, but I have to say that (opposed to what some people say in comments) just from reading this post I hardly understood a thing!

We haven't officially supported Gravatar in a while; we just made an effort to keep the existing ones working.

Since when you have stopped supporting it? I had registered in a middle of 2019, it was available at the time and I didn't see any official statements about it being dropped (nor did I see any per-site emails either).

You won't be able to switch back to your old Gravatar image if you change your email [...].

[...]

This wasn't a problem when your Per-Site Email was frozen in time. Now that your main email will actually affect that URL [...]

I understand that this may not be obvious to everyone, but... isn't this how the Gravatar works and how its users expect it to work? New email -> new Gravatar images. Wasn't it always affecting one's Gravatar image?
I think it would be more appropriate to announce such changes when you had actually frozen something.

[...] your Gravatar profile image might be lost. We will keep displaying the image as long as you’re using it, but it will disappear from the image selector if you change your email.

[...]

We will do our best to keep displaying Gravatars from unchanged e-mail addresses, but we won't guarantee those forever (as we no longer officially support Gravatar).

So, what exactly will disappear from the image selector?

  • The old image only (which again should be mostly obvious and not really a problem: nothing is lost, just go to your Gravatar account and get it)?
  • The Gravatar option itself? It looks like an email should affect that, so will it stay?
  • Or everything Gravatar-related, including an Identicon which is also generated by Gravatar from the email? Should we backup them too? And what will be used as a default image, if so?
Improve this answer
4
  • 1
    We actually don't generate the Identicons based on your email, and haven't in a considerable amount of time. They are generated with a salted version of your email or IP address, and already occasionally change for some users.
    – animuson StaffMod
    Commented Sep 26, 2021 at 19:10
  • @animuson Hmm... from the linked question I've got an impression that the email is salted, if specified. Sure it may change, but will it disappear completely?
    – EvgenKo423
    Commented Sep 26, 2021 at 19:47
  • 3
    The Gravatar option itself disappears. The only thing that made the option appear is having a salted email value that matched an existing Gravatar. The option to use Gravatar for new users has been discontinued long before this particular change. So, when you change your email to an email that doesn't map to an existing Gravatar the Gravatar itself and the option to go back to it will disappear from Stack Exchange. It will of course still live on gravatar.com and in the URL matching your hash, but you won't be able to select a Gravatar again. This is only AFTER you change your email.
    – Vinko Vrsalovic
    Commented Sep 29, 2021 at 7:39
  • 1
    Here's what new users get today: imgur.com/a/ojXz4wx
    – Vinko Vrsalovic
    Commented Sep 29, 2021 at 7:54
2

Wait, where's my option to use a new Gravatar?

We haven't officially supported Gravatar in a while; we just made an effort to keep the existing ones working.

Perhaps this is an obvious question, but why not just support Gravatar?

Improve this answer
2
  • 8
    Using Gravatar is not secure and makes it possible for others to reveal your email address by brute forcing the hash, because the hash is generated the exact same way for every single user. This has been done as far back as 2009 because MD5 is relatively weak.
    – animuson StaffMod
    Commented Oct 1, 2021 at 15:13
  • I was not aware of that, thanks.
    – miken32
    Commented Oct 1, 2021 at 15:18
1

So does this mean that we will finally be able to upload an image on Area 51 (and perhaps other sites) without being forced to use Gravatar? I've never wanted to use Gravatar and never will. It seems odd though having a network avatar on the bulk of the sites here, but not having it applicable on the site from which most of these sites were born.

Improve this answer
3
  • I doubt this change will affect A51, as that runs on an way older codebase.
    – Luuklag
    Commented Sep 27, 2021 at 11:40
  • @Luuklag, Unfortunate, but perhaps this will inspire an update there at some point (perhaps to a newer related/shared codebase?).
    – ouflak
    Commented Sep 27, 2021 at 12:11
  • 2
    @ouflak That is already being fleshed out. But it's more likely that the Area 51 profile will wind up being a read-only copy like the stackexchange.com profile is because it's too much to maintain pieces of code in multiple codebases. That's why Area 51 became so out of date in the first place.
    – animuson StaffMod
    Commented Oct 2, 2021 at 1:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .