Note: Please see this answer for more info on how this poses a security risk.

I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can get all the analytical data you can about their question.

So a malicious user could theoretically post some posts and such with a small 1x1 image, which would allow him to get users IP addresses (thus general location/even workplace), exact times people visited his question, et cetera.

Maybe you don't care—such information isn't that revealing. However, some users might not feel the same.

(Suggested fix: only allow images from a list of image hosting sites you can vouch for.)

  • 26
    Better idea: let SO host all the images.
    – Earlz
    Commented Jul 2, 2010 at 0:49
  • 24
    And also, security != privacy
    – Earlz
    Commented Jul 2, 2010 at 0:50
  • 1
    I reported the same thing to the phpbb team a while ago regarding PMs, as most email clients block external images. They didn't see it as worth fixing.
    – Gelatin
    Commented Jul 2, 2010 at 1:00
  • 1
    Good point about privacy vs security. Commented Jul 2, 2010 at 3:26
  • 1
    Doesn't SO locally cache externally linked images? Or is that just for the Free OSS ads?
    – detly
    Commented Jul 2, 2010 at 3:39
  • 1
    @detly, no. It doesn't appear to. Commented Jul 2, 2010 at 17:47
  • 1
    Is there anything that anybody can do about this? Commented Jul 5, 2010 at 2:05
  • 3
    Related - The other issue is a potential area where someone can phish for passwords from your users: meta.stackexchange.com/questions/115178/… Commented Dec 7, 2011 at 20:39
  • 2
    @Earlz Security != Privacy, but Privacy is really a sub-set of Security - a part of the "C" in "CIA" (Confidentiality, Integrity, Availability).
    – Iszi
    Commented Aug 29, 2012 at 13:15
  • 1
    This is still an issue on 5/2/2018, users are able to kill entire question pages, chat rooms, profile pages etc for all Chrome users. Not sure how the proposed fix would solve it tho.
    – DJSpud
    Commented May 2, 2018 at 17:04
  • 1
    I just posted this comment re another comment: "... you are violating copy right, amongst other things. Posts to SE are covered by a CC licence and storing images on Imgur is (or was)(see current Meta discussion) claimed to give Imgur the right to do almost anything they wish with them for any reason. | ALL images are copyright except those (perhaps) for which an explicit Public Domain licence exists. By posting an image to Imgur you are ignoring any licencing or copyright issues. <rudemode=1>. By flagging for moderator attention you are calling in a bigger bully. " Commented Sep 9, 2019 at 20:04
  • @DJSpud When you control the images uploaded, you can filter out dangerous ones based on certain conditions. When users can attach images from their own sites, that's impossible. Commented Jun 14, 2021 at 23:10

8 Answers 8


I strongly recommend blocking non-Stack-hosted images in posts and messages going forward. The potential harm may not be severe, but it exists and there is no benefit to balance it out.

Reasons to leave them:

Reasons to block them:

  • Eliminate potential dependencies on external resources, as we generally require.
  • Prevent posts from becoming broken if an image host decides to shut down.
  • Prevent images from being changed without triggering an edit in Stack Exchange's system.
    • As an example, image host ImageShack once decided to use old, broken image URLs for advertising purposes.
  • Avoid sending traffic to servers that may not want it.
    • As a consequence, if the server owner decides to prevent hotlinking (such as what happened with Photobucket), posts won't break.
  • Prevent silent analytics of posts/tracking of users.
  • Prevent phishing of user credentials with browser authentication dialog. (Some browsers prevent it, but IE, Edge, and in some cases Firefox, don't prevent it.)

<img src="https://stack-exchange-login-dot-com-dot-me.glitch.me/">

<img src="https://meta.stackexchange.com/questions?sort=frequent&pagesize=15">

  • Prevent users from posting images that can freeze the page, which may be irritating to clean up if moderators and other users are using affected browsers, such as Chrome.

<img src="https://uhoh.s3.amazonaws.com/lol.svg">

  • 20
    Warning for Chrome users: do not go to the revisions page, as it will freeze your current tab. Commented May 25, 2016 at 21:30
  • 4
    Well, at least now I know why my page sort randomly switched to "frequent" and I couldn't open this question without my tab freezing. I'd call that a decent demonstration of the point.
    – Kendra
    Commented May 25, 2016 at 21:41
  • @Kendra well, Jeremy fixed this by pushing the poisoned parts into snippets. : Commented May 26, 2016 at 6:01
  • 6
    I'd almost say you could strike that one "reasons to leave them" item. The shorteners are disallowed for all new posts, and according to that Meta thread you can't keep them in edits of old posts either. So, the only ones left are those in old posts that haven't been edited since the change. We could do the same with external images, though I'd think it would actually be better to do a one-time mass download and link replacement instead.
    – Iszi
    Commented May 26, 2016 at 15:18
  • 1
    @ShadowWizard I only went to the revisions page because of this comment. i.ytimg.com/vi/sVkhqf4Dxx4/hqdefault.jpg
    – ert
    Commented May 27, 2016 at 4:52
  • That was real nice @ShadowWizard Commented Mar 21, 2017 at 1:50
  • 1
    Recopying images to the SE Imgur account could pose a copyright risk. I can't find the discussion about that now. Commented Mar 25, 2018 at 22:07
  • 3
    One item you could add to the "reasons to leave them" list is that imgur still doesn't support SVG. That said, in practice SVG images are very rarely used on SE, precisely because imgur doesn't support them. And in any case, as the lol.svg exploit demonstrates, it seems that the web (or at least the part of the web using Google Chrome) still isn't quite ready for unrestricted SVG images in user-supplied content. Commented Mar 26, 2018 at 18:34
  • if the server owner decides to prevent hotlinking – This once happened to me, except instead of loading a "hotlinked image disabled" placeholder image, it loaded a shock image... Commented Jun 11, 2021 at 3:08

Yes PLEASE. I have spent a lot of time Removing link shorteners from posts! and many of the blacklisted link shorteners are actually image hosting services, so I have experience dealing with this.

Many image hosting services delete their images after a certain period of time. After this has happened, it can be IMPOSSIBLE to get a replacement.

There is only one image I can remember that I was able to find a suitable replacement for. The only reason I could was because it was of a pop up in a very popular tool, and the question essentially dictated what it said.

There is still a lot of work to be done with removing banned image links. yfrog.com alone has 200 hits.

A number of questions relied on now broken images to be coherent. It's impossible to answer a question when all it says is:

How do I get this effect in jQuery?

I want to do this in jQuery:

<image src="dead.li/nk">

(Yes, this is loosely based off personal experience.)

By my calculations, there are about 20k+ different posts (on Stack Overflow alone) that have inlined images that aren't from i.sstatic.net:

Select id as [Post Link], body
from posts

where body like '%<img src="http://[^i]%'
   or body like '%<img src="https://[^i]%'

This probably misses a great deal, like ImageShack images. It's also not running quick enough on some sites, so it may need to be tweaked if you're going to run it (e.g. by returning top 100 only).

I think that the best solution would be to automate as much of this as possible. Would it be possible to have Community find all the posts with live inlined images, upload them to Imgur, and replace it with the new link? In the past it helped to transition links during the great meta schism and then again during the switch to HTTPS. (The latter change also messed up posts with inlined external HTTP images, something that still needs fixing on most sites.)

Another solution would be to give a warning when editing a post that contains an inlined external image. While this doesn't solve the problem directly, it at least makes sure that people know it's a problem so it can be fixed on a case-by-case basis. It would look something like this:

It's a yellow popup box to the side of the post editor saying: "The post you're editing contains an external image. Please upload the image via the image uploader instead"


What is possible with this vulnerability?

Oh, it's way worse than tracking.

  • Determining the IP addresses of specific chat users or (with less accuracy) highly active users on main
    • This involves finding mutliple rooms the user is in, scraping the IPs of the users in them, and finding the intersection
    • This can be used to detect when certain people view the transcripts of a room, something often done by moderators specifically to avoid their presence being known
  • Editing the content of an image after some time, such as to make a diagram in an answer into something offensive without bumping the post
    • This could also happen unintentionally, if you lose control of the domain that's hosting the image (and tracing who's responsible would then be difficult)
  • Gaming the Announcer-class badges
  • Making it appear to network administrators that people on school or work computers are navigating to porn sites
  • Phishing passwords from people using old browsers
    • People using older browsers are also more likely to be older, and more likely to fall for phishing attacks
  • Silently taking advantage of certain CORS vulnerabilities in other sites
  • Freezing users' browsers with specially crafted SVGs, or exploiting code execution vulnerabilities in the SVG parser (which are not uncommon)
    • This is difficult to remove
  • Use advertising links to make money
    • This also could include faking view counts on some platforms
  • Feel free to add any others

Additionally, after these "images" (usually not actually images) are removed from an offending post, one can link to the revision page, which appears trustworthy but still contains the payload.

If you know that a post contains an offending image, and must view it, disable images (typically an option under site settings).

If you see a post containing one of these images, flag for moderator intervention, explain the problem, and request for the revision history to be nuked.

  • Freezing users' browsers with specially crafted SVGs yup, I did that once, but I lost the PoC when my browser froze because I'm an idiot and forgot to disable SVG. Commented Jun 11, 2021 at 3:09

Now that image hosting on imgur.com is supported perhaps all other sources should be blocked?

It isn't nice to hotlink anyway.

  • 26
    That would break a lot of questions and answers if the block was retroactive. Besides, banning hot linking from XKCD might result in a revolution.
    – user50049
    Commented Aug 24, 2010 at 13:54
  • I can has tommy drop tablez som moar? (I'm so sick of that strip)
    – jjnguy
    Commented Aug 24, 2010 at 14:09
  • 9
    @jjnguy: His name is "Little Bobby Tables".
    – zneak
    Commented Aug 24, 2010 at 17:37
  • @zneak, whatever his name is...I hate him! :P
    – jjnguy
    Commented Aug 24, 2010 at 17:40
  • @TimPost 1. you don't need to make it retroactive (make the filter only affect post created after 1st January 2019 or something), 2. the percentage of images being on-topic XKCD images is probably low on nowadays posts.
    – Cœur
    Commented Nov 26, 2018 at 5:31

What external images bring to a conversation

The Good

  • A more relate-able way for many people to understand the metaphor you want to use
    Many people aren't able to visualize what you mean, so visualizing it for them helps
  • Really fun puzzles
    See puzzling. There are some great image based ones there
  • Troubleshooting through screen grabs
    Many things would be MUCH harder to do without this on many SE sites

The Bad

  • Scripting
    SVGs and other active image content is dangerous here
  • Page size
    The bigger the image, the longer the load
  • Tracking
    A lot of people are concerned about anonymity for the wrong reasons and it breeds some misunderstanding
  • Policing
    We need to make sure things that shouldn't be on SE, AREN'T on SE

My take?

I'm gonna have to say that we need to do it in a way we can trust it. There is a way to do this that most people will probably accept

  • Official Host
    All images need to be posted here, no hot linking
  • Restricted formats
    If it's not PNG, JPEG, or GIF it doesn't get loaded
  • Lazy Loading
    This way if it's a large image it will be loaded only when clicked on or needed, and long page loads won't happen

Depending on the available bandwidth, SO could also act as a proxy server (obviously caching the images).


A fairly high fraction of questions and answers get edited by high-rep users, and an unexpected image link in there would likely attract both deletion and a flag for moderators to squelch the user.

  • 8
    It could also be a totally legit-looking URL. Besides, prior to reading this, would I see a link to an image that didn't show up, I don't think I would have done anything about it.
    – zneak
    Commented Aug 24, 2010 at 17:36

So what? Folks can track your viewing habits - that's a part of using The Web. Hopefully you already have off-domain cookies turned off, but if not then do that. If you're really concerned about it, use a proxy...

  • 14
    I dunno. It seems a bit dodgy that you can post an image link in chat and suddenly get an instant snapshot of everyone’s IP who is in that room — plus the occasional ghost-mod who is tail -fing the log without being “in” the room. Since you see when people show up to the room, and you see the new IP appear at the same time, it is pretty easy to see who is who. Is this desirable?
    – tchrist
    Commented Jan 13, 2013 at 13:51
  • If you want, you can come talk to us about it at ELU chat, where we were discussing it this morning. And yes, I’ve turned off the tracker. :)
    – tchrist
    Commented Jan 13, 2013 at 15:50
  • 4
    I donno... You might find out roughly where I live without looking at my profile; that'd be... terrible?
    – Shog9
    Commented Jan 13, 2013 at 17:22
  • 1
    Yeah, it means I could invite you to coffee in Boulder. :)
    – tchrist
    Commented Jan 13, 2013 at 17:23
  • 7
    I originally down-voted just for the callous attitude towards user privacy. If I could down-vote again though, I would. Although not stated in the question for this thread, the use of external images is not only a privacy problem. It's also a content management issue. This is addressed in Jeremy Banks' answer ("Eliminate potential dependencies on external resources, as we generally require.") and, ironically enough, exemplified in another answer by uɐɯsO uɐɥʇɐN.
    – Iszi
    Commented May 26, 2016 at 16:03
  • 3
    Because empty gestures fixes this, yeah @Iszi? I wrote this almost 6 years ago, and the situation for passive browsers has only gotten worse in this time. If you're not blocking images, ads, scripts and cookies, then you can pretty much guarantee someone is tracking you. Blocking off-site images would make avoiding link-rot, implementing secure transport, and a bunch of other maintenance tasks a hell of a easier, but if we're gonna do it for those reasons then let's be honest about it & not hide behind some privacy pageantry that won't help anyone.
    – Shog9
    Commented May 26, 2016 at 16:45
  • 4
    Unlike web tracking in general, the problem here is abuse of a trusted resource by untrusted parties. Privilege escalation, in other words, however informally. This is (presumably) why Wikipedia does not permit external images. Put another way, "Untrusted websites can track you" is not a good reason to allow untrusted users here to track everyone using SE. Commented May 26, 2016 at 23:11
  • 1
    You lost me at "unlike web tracking in general", @nathan.
    – Shog9
    Commented May 26, 2016 at 23:54
  • 5
    I don't fully agree with Shog's implied privacy threat model, but do agree that it's not worth focusing on this potentially-controversial point when there are several other compelling arguments that folks can probably agree on.
    – Jeremy
    Commented May 27, 2016 at 0:00
  • 4
    @Shog9: Most web tracking is performed by, or at least with the explicit permission of, the same party you think you're visiting. This is not. This disconnect between who you think you're trusting and who you're actually allowing to do things is one of the most basic security problems. Commented May 27, 2016 at 0:01
  • 4
    Shog9: Arguably, ad networks have a similar threat model in some cases; the site is trusted by the user, the network is trusted by the site, and ads are trusted by the network, and the result is that the user trusts the ads by mistake. This is a known issue, and ad-served malware is no small problem. Logically, though, images included in SE posts are not generally going to be blocked by even software designed to block ads, so dedicated mitigation techniques for that threat aren't usually going to work here. @JeremyBanks is right, though; there are other benefits of higher immediate importance. Commented May 27, 2016 at 0:05
  • 8
    This is not only a strawman of the point of this question and its answers, but a particularly dangerous one. This goes way beyond tracking. Commented Jun 8, 2021 at 22:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .