Unsurprisingly, some folks on raddle and reddit seem to have a big problem with lemmy. A lot of it is pure FUD.
However, this appears to be a valid security concern:
https://raddle.me/f/fediverse/166674/lemmy-is-so-much-like-email-it-even-brought-back-spy-tracker
Any thoughts on how fixable this is?
Of course the general consensus on reddit is “lemmy devs are clueless and dangerous”. I’m pretty sure a lot of it is one guy with multiple alt accounts, tho. He has a Joe McCarthy attitude about lemmy because of one of the primary devs.
Why are people pretending this isn’t an issue??? Of course it is lol.
Luckily the fix is also easy: an image proxy server. Mail clients do this already.
It exposes the bigger problem with Lemmy: lack of auditing.Nah, we’re auditing, just live.
For better or worse, security is in the community’s hands. But that’s why we are here in the first place.
Any thoughts on how fixable this is?
This shouldn’t be hard to fix. Lemmy needs to proxy images, there’s an open issue for this. Right now, I don’t use Lemmy outside of Tor Browser specifically because of issues like this, and the recent XSS vulnerability is making me even more concerned. Lemmy is a great project, but it needs work and probably a security audit.
Can someone with more knowledge on the lemmy protocol/api bring some light into this? The way the linked posted is written, it seems like some random angry guy just hates lemmy for whatever reason.
To me it seems like a complete bs argument. As far as I can tell this tactic is possible with every service where users can provide content. Of course I can link to a site that reads users data. There’s basically no preventing this unless the (lemmy) clients provide their own modified browser that masks the users IP and other metadata.
This is unrelated to the post itself but I really hope Lemmy and the fediverse as a whole don’t start using terms like FUD that originated with Crypto. Crypto went exceptionally badly and was wrought with scams and we should be doing as much as possible to distance ourself from that.
Edit: I’ll take my losses here. The term is much older than it’s recent use in popular culture despite my own lack of experience hearing it prior. I do however stand by wanting to distance from the cryptocurrency crowd as much as possible.
I’m confused. How is this any different getting simply hosting a picture yourself and tracking all the IP addresses via http fetch logs? Why is Lemmy itself being singled out here? Why do you need some CGI script?
I am not a cybersecurity expert. And these are good questions. The problem is certainly not unique to Lemmy.
However, my (limited) understanding of it the opposing opinion is. 1. This is bad for privacy (marketers and other bad actors use these to track down your IP and other metadata) and 2. It should have been thought of before now and already had some protections put into place.
It is being discussed - here is a thread from yesterday:
https://kbin.social/m/support@lemmy.world/t/204434/Tracking-Lemmy-users-by-spy-tracker-pixelsAnd here is an ongoing discussion about a possible remedy:
https://github.com/LemmyNet/lemmy/pull/3550But worth noting, unlike email the ‘view’ isn’t linked to an individual and an email address, and also broadcasting your IP address (yes and some meta data) as you browse isn’t unusual. Every page you visit could be doing this not just Lemmy.
Yes ideally this should be fixed, but in my view it is also a bit of a storm in a teacup.
Raddle user learns how the Internet works 🤯
In all seriousness though, although this is a concern, in Email in particular the solution most choose is to just disable images, so it isn’t really a sincere comparison IMO.
We could maybe mitigate this with…
- Proxying & caching - Instance would cache a copy of the commented image and serve it from there, blocking the IP of the user from being exposed. This could introduce some additional latency and fill up server storage faster
- CSP Header & Local caching - Client could block the name of the instance from being transferred, and also cache a copy of the image locally. This doesn’t protect the user’s IP address in any way, but would hinder the ability to count how many times a particular IP has viewed/accessed a post
- Shared Lemmy image proxies - Image requests are proxied through a randomly selected Lemmy image proxy. This would ‘hide’ the origin IP to all but the volunteer proxy provider. I’d personally be willing to host a few of these if this ever became a thing
