It would be interesting to see just how much info is shared when lemmy requests the image. If there is [potentially] sensitive info being shared, the devs might be interested in working on it too (I have no idea how to check such a thing, this comment is just so I can find the post later when more people have shared their wisdom on it)

Notably, this allows remote parties to associate your IP address with your interests, as revealed by the Lemmy communities that you browse.

I suspect with a coordinated pool of posts or multiple comments on the same post, you could narrow that IP address down to an actual user account.

When a new comment is posted by a user, store, against their username, all IP addresses that visited since the last comment in that thread (by anyone). When a second comment is posted by a user, remove any IP addresses that don’t appear in both lists.

I suspect you would have a very short list after two comments, and a single address after 3. It would also be extremely easy to both lure someone into viewing an image and bait them into multiple replies. Geolocate that IP and you know know vaguely where that user lives.

Time to make sure you’re always on a VPN I guess.

From what I remember, that image was hosted on hexbear.net, so I don’t think so.

Proxying external images means that instead of the image being downloaded from the original link, your Lemmy server would download it and serve it for you. The Lemmy server acts as a proxy.

But it means performing a lot of extra traffic. And realistically you’d want to cache the image because otherwise your server will likely get banned for the high volume of requests you send. But caching the images requires more storage and can have potential for legal issues.

And images are one thing, but literally any content is the problem. Images are just the most obvious because they often load without even having to click on the image and thus you’ll get far higher volume of user data. Literally anything you link to has this issue and you cannot proxy all of it.

It’s just a simple Flask server. I parse the user-agent using the user_agents Python library, apply some conditionals upon the result, render the image using Pillow and send it to the user.

I’m sure it would be better if I paid MaxMind money, but that’d go a bit far for a stupid meme picture that I’ll probably take down in less than a week.

If you live in a dictatorship and this thing can get your location right, you should probably be using some kind of VPN. Wouldn’t want you to run into trouble with the regime!

I’m curious about your choice not to VPN but I also really don’t want to pressure you into saying anything you shouldn’t.

Are you sure you are where you think you are? When’s the last time you looked outside?

That’s a good thing to be honest, but feel free to send in corrections to the data source if you want internet companies to stalk you.

The image is generated on demand by a PHP script. It’s not a static image file. Every time the web browser sends a GET /poc.png, a new image is generated based on the information your browser or app sends the server.

It’s actually how a lot of tracking code works. The image data returned may be the same, but the data collection through cookies and maybe even some passive fingerprinting all happen every time you send a request.

It’s not the image, it’s a normal image. The server does the hard work when you make the request, and then it just builds the image accordingly.

Haha it’s just an IP lookup in a free database I’ve downloaded, I did 0% of the hard work. Thanks for the reply anyway!

Probably has bugs. Probably no security bugs. Feedback is welcome (but I don’t care enough about this to try my hardest).

require_once('/var/www/html/geoip2.phar');
use GeoIp2\Database\Reader;

$ip = $_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'];

$cityReader = new Reader('/var/local/php/GeoLite2-City.mmdb');
$record = $cityReader->city($ip);

header('Content-Type: image/png');

$image = @imagecreatefrompng('lemmybase.png');

$black = imagecolorallocate($image, 0, 0, 0);

// "Some City, SS, Country Name"
$text = $record->city->name . ', ' . $record->mostSpecificSubdivision->isoCode . ', ' . $record->country->name;

/* $font_path = '/tmp/ComicSand.ttf'; */
$font_path = '/usr/share/fonts/ubuntu/Ubuntu-M.ttf';

// Render text
imagettftext($image, 30, 0, 28, 224, $black, $font_path, chunk_split($text, 22));

// Dump image to web server
imagepng($image);

// Free resources
imagedestroy($image);

Edit: damn, Lemmy really hates < ? php. Just imagine that’s the first line in the file.

I originally planned to do something based on the Referer header, but the browser doesn’t send those for linked images.

In theory you can do a lot with this. Detect VPNs based on MTU, for example, or if you’re malicious, turn it into a tracker.

It’s should only be cached in your browser. Try opening the image in a new tab and hitting Ctrl+Shift+R. Opening it in a porn tab or clearing your browser cache should also work.

• Infinity for Lemmy - just says Android

• Connect - also says a mobile client

My connection says that im viewing it from a unknown device

Which would be correct as Voyager is a Web App

it got mine wrong because i change default useragent and platform in the browser.

It said I’m on Mac OS X, but that’s wrong. It’s been macOS for some years now. /s

It still makes me wanna cry.

The user-agent detection definitely isn’t great, this was just meant as a quick proof of concept for anyone curios.