78

Note: Please see this answer for more info on how this poses a security risk.

I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can get all the analytical data you can about their question.

So a malicious user could theoretically post some posts and such with a small 1x1 image, which would allow him to get users IP addresses (thus general location/even workplace), exact times people visited his question, et cetera.

Maybe you don't care—such information isn't that revealing. However, some users might not feel the same.

(Suggested fix: only allow images from a list of image hosting sites you can vouch for.)

  • 22
    Better idea: let SO host all the images. – Earlz Jul 2 '10 at 0:49
  • 19
    And also, security != privacy – Earlz Jul 2 '10 at 0:50
  • 1
    I reported the same thing to the phpbb team a while ago regarding PMs, as most email clients block external images. They didn't see it as worth fixing. – Gelatin Jul 2 '10 at 1:00
  • 1
    Good point about privacy vs security. – Aaron Yodaiken Jul 2 '10 at 3:26
  • 1
    Doesn't SO locally cache externally linked images? Or is that just for the Free OSS ads? – detly Jul 2 '10 at 3:39
  • 1
    @detly, no. It doesn't appear to. – Aaron Yodaiken Jul 2 '10 at 17:47
  • 1
    Is there anything that anybody can do about this? – Aaron Yodaiken Jul 5 '10 at 2:05
  • 3
    Related - The other issue is a potential area where someone can phish for passwords from your users: meta.stackexchange.com/questions/115178/… – Brandon Montgomery Dec 7 '11 at 20:39
  • @Earlz Security != Privacy, but Privacy is really a sub-set of Security - a part of the "C" in "CIA" (Confidentiality, Integrity, Availability). – Iszi Aug 29 '12 at 13:15
  • 1
    This is still an issue on 5/2/2018, users are able to kill entire question pages, chat rooms, profile pages etc for all Chrome users. Not sure how the proposed fix would solve it tho. – DJSpud May 2 '18 at 17:04
  • I just posted this comment re another comment: "... you are violating copy right, amongst other things. Posts to SE are covered by a CC licence and storing images on Imgur is (or was)(see current Meta discussion) claimed to give Imgur the right to do almost anything they wish with them for any reason. | ALL images are copyright except those (perhaps) for which an explicit Public Domain licence exists. By posting an image to Imgur you are ignoring any licencing or copyright issues. <rudemode=1>. By flagging for moderator attention you are calling in a bigger bully. " – Russell McMahon Sep 9 at 20:04
53

I strongly recommend blocking non-Stack-hosted images in posts and messages going forward. The potential harm may not be severe, but it exists and there is no benefit to balance it out.

Reasons to leave them:

Reasons to block them:

  • Eliminate potential dependencies on external resources, as we generally require.
  • Prevent posts from becoming broken if an image host decides to shut down.
  • Prevent images from being changed without triggering an edit in Stack Exchange's system.
    • As an example, image host ImageShack once decided to use old, broken image URLs for advertising purposes.
  • Avoid sending traffic to servers that may not want it.
    • As a consequence, if the server owner decides to prevent hotlinking (such as what happened with Photobucket), posts won't break
  • Prevent silent analytics of posts/tracking of users.
  • Prevent phishing of user credentials with browser authentication dialog. (Some browsers prevent it, but IE, Edge, and in some cases Firefox, don't prevent it.)

<img src="https://stack-exchange-login-dot-com-dot-me.glitch.me/">

<img src="https://meta.stackexchange.com/questions?sort=frequent&pagesize=1">

  • Prevent users from posting images that can freeze the page, which may be irritating to clean up if moderators and other users are using affected browsers, such as Chrome.

<img src="https://uhoh.s3.amazonaws.com/lol.svg">

  • 14
    Warning for Chrome users: do not go to the revisions page, as it will freeze your current tab. – Shadow The Princess Wizard May 25 '16 at 21:30
  • 2
    Well, at least now I know why my page sort randomly switched to "frequent" and I couldn't open this question without my tab freezing. I'd call that a decent demonstration of the point. – Kendra May 25 '16 at 21:41
  • @Kendra well, Jeremy fixed this by pushing the poisoned parts into snippets. : – Shadow The Princess Wizard May 26 '16 at 6:01
  • 5
    I'd almost say you could strike that one "reasons to leave them" item. The shorteners are disallowed for all new posts, and according to that Meta thread you can't keep them in edits of old posts either. So, the only ones left are those in old posts that haven't been edited since the change. We could do the same with external images, though I'd think it would actually be better to do a one-time mass download and link replacement instead. – Iszi May 26 '16 at 15:18
  • 1
    @ShadowWizard I only went to the revisions page because of this comment. i.ytimg.com/vi/sVkhqf4Dxx4/hqdefault.jpg – Rob May 27 '16 at 4:52
  • That was real nice @ShadowWizard – naru sin Mar 21 '17 at 1:50
  • Recopying images to the SE Imgur account could pose a copyright risk. I can't find the discussion about that now. – Sonic the Reinstate Monica-hog Mar 25 '18 at 22:07
  • 3
    One item you could add to the "reasons to leave them" list is that imgur still doesn't support SVG. That said, in practice SVG images are very rarely used on SE, precisely because imgur doesn't support them. And in any case, as the lol.svg exploit demonstrates, it seems that the web (or at least the part of the web using Google Chrome) still isn't quite ready for unrestricted SVG images in user-supplied content. – Ilmari Karonen Mar 26 '18 at 18:34
16
+100

Yes PLEASE. I have spent a lot of time Removing link shorteners from posts! and many of the blacklisted link shorteners are actually image hosting services, so I have experience dealing with this.

Many image hosting services delete their images after a certain period of time. After this has happened, it can be IMPOSSIBLE to get a replacement.

There is only one image I can remember that I was able to find a suitable replacement for. The only reason I could was because it was of a pop up in a very popular tool, and the question essentially dictated what it said.

There is still a lot of work to be done with removing banned image links. yfrog.com alone has 200 hits.

A number of questions relied on now broken images to be coherent. It's impossible to answer a question when all it says is:

How do I get this effect in jQuery?

I want to do this in jQuery:

<image src="dead.li/nk">

(Yes, this is loosely based off personal experience.)

By my calculations, there are about 20k+ different posts (on Stack Overflow alone) that have inlined images that aren't from i.stack.imgur.com:

Select id as [Post Link], body
from posts

where body like '%<img src="http://[^i]%'
   or body like '%<img src="https://[^i]%'

This probably misses a great deal, like ImageShack images. It's also not running quick enough on some sites, so it may need to be tweaked if you're going to run it (e.g. by returning top 100 only).

I think that the best solution would be to automate as much of this as possible. Would it be possible to have Community find all the posts with live inlined images, upload them to Imgur, and replace it with the new link? In the past it helped to transition links during the great meta schism and then again during the switch to HTTPS. (The latter change also messed up posts with inlined external HTTP images, something that still needs fixing on most sites.)

Another solution would be to give a warning when editing a post that contains an inlined external image. While this doesn't solve the problem directly, it at least makes sure that people know it's a problem so it can be fixed on a case-by-case basis. It would look something like this:

It's a yellow popup box to the side of the post editor saying: "The post you're editing contains an external image. Please upload the image via the image uploader instead"

8

Now that image hosting on imgur.com is supported perhaps all other sources should be blocked?

It isn't nice to hotlink anyway.

  • 19
    That would break a lot of questions and answers if the block was retroactive. Besides, banning hot linking from XKCD might result in a revolution. – Tim Post Aug 24 '10 at 13:54
  • I can has tommy drop tablez som moar? (I'm so sick of that strip) – jjnguy Aug 24 '10 at 14:09
  • 7
    @jjnguy: His name is "Little Bobby Tables". – zneak Aug 24 '10 at 17:37
  • @zneak, whatever his name is...I hate him! :P – jjnguy Aug 24 '10 at 17:40
  • @TimPost 1. you don't need to make it retroactive (make the filter only affect post created after 1st January 2019 or something), 2. the percentage of images being on-topic XKCD images is probably low on nowadays posts. – Cœur Nov 26 '18 at 5:31
5

So what? Folks can track your viewing habits - that's a part of using The Web. Hopefully you already have off-domain cookies turned off, but if not then do that. If you're really concerned about it, use a proxy...

  • 9
    I dunno. It seems a bit dodgy that you can post an image link in chat and suddenly get an instant snapshot of everyone’s IP who is in that room — plus the occasional ghost-mod who is tail -fing the log without being “in” the room. Since you see when people show up to the room, and you see the new IP appear at the same time, it is pretty easy to see who is who. Is this desirable? – tchrist Jan 13 '13 at 13:51
  • If you want, you can come talk to us about it at ELU chat, where we were discussing it this morning. And yes, I’ve turned off the tracker. :) – tchrist Jan 13 '13 at 15:50
  • 4
    I donno... You might find out roughly where I live without looking at my profile; that'd be... terrible? – Shog9 Jan 13 '13 at 17:22
  • 1
    Yeah, it means I could invite you to coffee in Boulder. :) – tchrist Jan 13 '13 at 17:23
  • 4
    I originally down-voted just for the callous attitude towards user privacy. If I could down-vote again though, I would. Although not stated in the question for this thread, the use of external images is not only a privacy problem. It's also a content management issue. This is addressed in Jeremy Banks' answer ("Eliminate potential dependencies on external resources, as we generally require.") and, ironically enough, exemplified in another answer by uɐɯsO uɐɥʇɐN. – Iszi May 26 '16 at 16:03
  • 2
    Because empty gestures fixes this, yeah @Iszi? I wrote this almost 6 years ago, and the situation for passive browsers has only gotten worse in this time. If you're not blocking images, ads, scripts and cookies, then you can pretty much guarantee someone is tracking you. Blocking off-site images would make avoiding link-rot, implementing secure transport, and a bunch of other maintenance tasks a hell of a easier, but if we're gonna do it for those reasons then let's be honest about it & not hide behind some privacy pageantry that won't help anyone. – Shog9 May 26 '16 at 16:45
  • 3
    Unlike web tracking in general, the problem here is abuse of a trusted resource by untrusted parties. Privilege escalation, in other words, however informally. This is (presumably) why Wikipedia does not permit external images. Put another way, "Untrusted websites can track you" is not a good reason to allow untrusted users here to track everyone using SE. – Nathan Tuggy May 26 '16 at 23:11
  • 1
    You lost me at "unlike web tracking in general", @nathan. – Shog9 May 26 '16 at 23:54
  • 3
    I don't fully agree with Shog's implied privacy threat model, but do agree that it's not worth focusing on this potentially-controversial point when there are several other compelling arguments that folks can probably agree on. – Jeremy Banks May 27 '16 at 0:00
  • 2
    @Shog9: Most web tracking is performed by, or at least with the explicit permission of, the same party you think you're visiting. This is not. This disconnect between who you think you're trusting and who you're actually allowing to do things is one of the most basic security problems. – Nathan Tuggy May 27 '16 at 0:01
  • 3
    Shog9: Arguably, ad networks have a similar threat model in some cases; the site is trusted by the user, the network is trusted by the site, and ads are trusted by the network, and the result is that the user trusts the ads by mistake. This is a known issue, and ad-served malware is no small problem. Logically, though, images included in SE posts are not generally going to be blocked by even software designed to block ads, so dedicated mitigation techniques for that threat aren't usually going to work here. @JeremyBanks is right, though; there are other benefits of higher immediate importance. – Nathan Tuggy May 27 '16 at 0:05
0

A fairly high fraction of questions and answers get edited by high-rep users, and an unexpected image link in there would likely attract both deletion and a flag for moderators to squelch the user.

  • 7
    It could also be a totally legit-looking URL. Besides, prior to reading this, would I see a link to an image that didn't show up, I don't think I would have done anything about it. – zneak Aug 24 '10 at 17:36
0

Depending on the available bandwidth, SO could also act as a proxy server (obviously caching the images).

0

What external images bring to a conversation

The Good

  • A more relate-able way for many people to understand the metaphor you want to use
    Many people aren't able to visualize what you mean, so visualizing it for them helps
  • Really fun puzzles
    See puzzling. There are some great image based ones there
  • Troubleshooting through screen grabs
    Many things would be MUCH harder to do without this on many SE sites

The Bad

  • Scripting
    SVGs and other active image content is dangerous here
  • Page size
    The bigger the image, the longer the load
  • Tracking
    A lot of people are concerned about anonymity for the wrong reasons and it breeds some misunderstanding
  • Policing
    We need to make sure things that shouldn't be on SE, AREN'T on SE

My take?

I'm gonna have to say that we need to do it in a way we can trust it. There is a way to do this that most people will probably accept

  • Official Host
    All images need to be posted here, no hot linking
  • Restricted formats
    If it's not PNG, JPEG, or GIF it doesn't get loaded
  • Lazy Loading
    This way if it's a large image it will be loaded only when clicked on or needed, and long page loads won't happen

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .