76
12
submitted 10 months ago* (last edited 10 months ago) by [email protected] to c/[email protected]

I noticed while creating a new post that if I provide a Thumbnail URL with an external (not hexbear.net) URL, then the original image gets used when viewing the post. I first noticed it on this post where I added a youtube thumbnail icon (check it in the browser console).

I tried researching if there's a bug for this in upstream Lemmy:

This one seems like it would have fixed it: LemmyNet/lemmy-ui: Update post listing to prefer local image when available

And see also this: LemmyNet/lemmy: Add initial skeleton of image proxy improvements for feedback

Unfortunately I'm not that familiar with the Lemmy codebase, but how possible would it be to proxy+cache thumbnails? I don't quite mean store it permanently in the database, just proxy the source image and cache it for performance reasons. Otherwise, maybe we should disable the thumbnail URL for now until this support is added upstream?

77
14
submitted 10 months ago by [email protected] to c/[email protected]

Take for example my banner image. On mobile you can see Isabelline standing at the opening of whatever the fuck that is, looks great. Roughly a 16:9 window, maybe 1.85:

On desktop she is cut out desolate scope asspect ratio looks awful. Mods pls i-spil-my-jice

78
71
submitted 10 months ago by [email protected] to c/[email protected]

502 errors, 502 errors everywhere kitty-cri-potato

79
88
Link trackers (hexbear.net)
submitted 11 months ago* (last edited 11 months ago) by [email protected] to c/[email protected]

Hi folx

Not much has changed since we last brought this up half a year ago, which is probably a mistake as link trackers have become more ubiquitous, and the corporations that know our names and addresses have built up shadow profiles on us, but better late than never.

Anyway, cutting to the chase. This bot will warn you in DMs when you share a tracking link. That's it. Post over.

Read on if you want to see my unhinged tracking link rants.

What are link trackers?When you share a youtube link you may notice an ?si=(random gibberish) at the end. You may notice the same with Instagram, except here it's ?igshid. On Twitter, it's ?t. On TikTok and Reddit you have urls that end in gibberish like vm.tiktok․com/blahblah or reddit․com/r/blahblah/s/blahblah.

These URLs are artisanal. They are made only for you.

Other site's URLs can also be called "high entropy" URLs, for example, they may contain the time down to the millisecond, in one case.

When you share these URLs to the world wide web, you broadcast to this service (to YouTube, to Google, to TikTok, to Reddit etc.) that "Hey! This previously-anonymous account is actually me!". When you share this link to your friend halfway across the world who only talks to you on Discord, and they click it, you broadcast to this service that actually you two are buddies. Same here on Hexbear. This sharing helps these sites build a social graph on us.

The threat is two-fold. Google has a powerful search crawler, and also runs a massive ad network. They could sift through the pages they indexed on Hexbear and link the exact Hexbear account to your real name. People who have clicked on your shared link will also be exposed as having been on that exact page to which you shared the link. This kind of metadata leak can be dangerous, as law enforcement has previously asked Google to reveal people who watched so-and-so YouTube video at so-and-so time.

This bot also handles TikTok, Yandex, Snapchat, Meta/Facebook trackers that all have this same ad-related threat.

What can mods on Hexbear do?If you're a mod and you think this is important, you can @ mention this bot on a community you moderate. The bot should reply to you with some cringe, and then you can appoint it as a mod. When given mod powers, it will remove any comment/post that contains tracking links if the user has not fixed it after a day.

I will probably add functionality to sift through old comments that have dangerous trackers (like TikTok, which exposes your name and picture to anyone who clicks it) and remove/report them soon.

How to protect yourself on other sites and on your phoneInstall the ClearUrls extension on desktop (if you're on Chrome... please switch, that is another privacy issue entirely). ClearUrls will cut down on most of your worries.

Be on the lookout for the high-entropy parameters when you share things on your phone as well. Parameters in the url that look like ?si=blahblah, ?igshid, which look like they'd stand for "share ID" or "Instagram share ID", as well as obfuscated TikTok links like vm.tiktok․com/blahblah will all track you and your social circle.

How to protect your identity from leakage if you accidentally click on a tracking URLIf you're browsing a sensitive website, like Hexbear, and you happen to click a tracking URL that goes to YouTube, Google/YouTube can correlate your click with the appearance of this URL on Hexbear, associating your identity with this site.

To avoid this, you may use Firefox Multi-Account Containers, and make Hexbear use its own container that you keep separate from everything else. Although this solution is not perfect, it will prevent one facet of your identity leaking and make it harder for other sites to correlate your digital footprint.

What other threats exist hidden in URLsThe biggest threat is TikTok, which basically doxxes you when you share a link with someone.

When someone clicks your TikTok link, a big banner on top of their screen shows your profile picture and your name. If you used your real name and picture... well. Uh-oh.

Other "light doxxing hazards" exist on other sites. After looking through Hexbear comments using the search function, you can find comments that link to *****, comments that link to ****, etc. that may include the user's general location down to the city, their preferred language, their screen width and height (in the URL!!! for some reason???), and some very high-entropy parameters that look like a long string of gibberish.

If I sat down today and looking to dox someone by looking at their profile and they shared links willy-nilly, I'd have some pretty good leads.

What can the maintainer of HexReplyBot do?HexReplyBot does not handle YouTube tracking parameters properly. The maintainer can check this RegExr post I made with the modified regex. I bodged it real quick, but it should remove the ?si at least. It will still keep the ?pp parameter, but I got lazy and it's not as common. Please consider changing the regex out, thank you.

Some linkshttps://archive.ph/8c80m - law enforcement using metadata provided by YouTube to find the real name of a suspect
https://hexbear.net/comment/4439859 - someone mentioning that they keep getting a Hexbear user recommended to them on TikTok because they clicked that user's TikTok link months ago
https://archive.is/WD7ke - "We kill people based on metadata" Can't be bothered to find it but ross ulbricht got busted on some metadata links between his email and stackoverflow. Now imagine if they had tracking links back then to triangulate his stackoverflow identity (which now has tracking links) with some other offsite identity.

Share any feedback or thoughts, I'll take it into consideration.

80
20
submitted 11 months ago by [email protected] to c/[email protected]

I understand that the beautiful french Sandy Bridge hexbear server is very busy and hexbear does not want spam. But I gotta post!!!

It's just my inbox hexbear, promise I am not doing spam... I just gotta reply to 40+ messages...

81
76
submitted 11 months ago by [email protected] to c/[email protected]

I think it would be really really really really funny

82
23
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

Canvas is starting in 4 days from time of post on the 12th of July. looks like they did it last year, too (see thumbnail).

i can't find any discussion on it on Hexbear, so i'm assuming this hasn't been properly discussed before. i think it would be really cool imo and we could do what was happening on PixelCanvas but w/ more Hexbear stuff ig

83
24
submitted 1 year ago by [email protected] to c/[email protected]

It would be like the dunk tank but without rule 8. People don't have to subscribe to it. I will continue not posting to it, but you can feel free to make me a mod. I will be there like an absent father.

Also I don't really know where this post should go, I guess we got rid of the user union at some point.

84
17
submitted 1 year ago by [email protected] to c/[email protected]

I just went to enable them only to realize they've been enabled this whole time. I only recently got email working on my website after six months of troubleshooting, so I know the struggle. Do they work on lemmy-ui?

85
23
submitted 1 year ago by [email protected] to c/[email protected]

The bot creation for Lemmy seems easy. I just dont know how to proceed from there.

86
84
submitted 1 year ago by [email protected] to c/[email protected]

This is clearly the superior way to post

87
59
submitted 1 year ago by [email protected] to c/[email protected]

  1. Can this use a fixed-width font? Currently, the timestamp jumps up and down a line depending on the combination of numbers.
  2. Can the date be formatted as yyyy-MM-dd or dd.MM.yyyy? The current format of MM/dd/yyyy is reminding me of America and I don't like it
88
33
submitted 1 year ago by [email protected] to c/[email protected]

I found this website that is a leftist alternative to YouTube but has a separate community instead of just reuploading YouTube videos without ads or tracking like the websites in the Tankie Reply Bot on Lemmygrad.

89
68
submitted 1 year ago by [email protected] to c/[email protected]

Hi, my name is Kody and I am extremely new to being homeless. My food stamps have run out and I don't get more for another week or so. I was wondering if anyone could possibly PLEASE HELP me out with a little bit of relief cash so that I can feed myself. I assure you that I really do in fact need help with food. I promise that every cent will be used for food and only food. Just to be completely honest, I am a recovering alcoholic for 4 years now and I am clean and sober off of opiates for two years. I've recently been through an unfortunate string of events that has through no fault of my own landed me homeless. I just need a hand up. So please, if anyone can help just a little bit with a few dollars then I would be forever grateful. My cash app cash tag is KodyMartinGerba. Thank you

90
29
submitted 1 year ago by [email protected] to c/[email protected]

idk how this would even work but there should be a little button where i can click a little picture of Sartre and it posts the entire "absurdism of the antisemite" quote. Or the "America is a one party state with 2 parties" or anything john brown ever said

91
32
submitted 1 year ago by [email protected] to c/[email protected]

Put your dukes up, let's go.

92
6
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

In my inbox

  1. I marked everything as "read".

  2. I went to "All" and I can't upvote or comment. Clicking on the upvote or reply icon just makes them shake. But if I open a reply in a new tab - everything is normal. I can upvote and reply.

---

Edit

Clearing my cache solved the problem.

93
146
submitted 1 year ago by [email protected] to c/[email protected]
94
131
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

db0 and Unruffled have both been banned for reactionary behavior and, in the case of the former, DM harassment.

Due to these irreconcilable differences we thought it only right to allow the community to weigh in on defederating immediately.

According to this person "tankie" is anyone that criticizes the privilege of white westerners in the imperial core who have been privileged and comfortable their entire lives off of the backs of colonized people.

Further context can be found in this thread

https://hexbear.net/post/2484423

As always, use dean-smile to vote for federation and dean-frown to vote for defederation.

95
16
submitted 1 year ago by [email protected] to c/[email protected]

We got active, new, hot, controversial (which is useless because theres no downvote button why not BOGO?

96
5
submitted 1 year ago by [email protected] to c/[email protected]

A not real thing people believe is real, seem likes a meme to me.

97
46
submitted 1 year ago by [email protected] to c/[email protected]

I had a post removed today for using the word "spook" in reference to government agents, a common usage that I see around the site, because it is a racial slur, although ive never seen it used with that intent (not that it matters), and it only gets removed maybe 10% of the time. In order to be consistent and not offend any comrades I would propose adding it to the word filter so its removal will be uniform and not open to mod interpretation.

98
27
submitted 1 year ago by [email protected] to c/[email protected]

How can I share an archived version of a WSJ journal article? I think the site is actively blocking archive sites but I'm not a tech person so I have no idea if that's true or not.

Example link - https://www.wsj.com/finance/stocks/tesla-stock-fans-not-selling-f45fec37

None of the archive sites listed under "url" work. After the page is saved...

  • At archive.today - loading icon
  • At ghostarchive.org - "Archiving error"
  • At archive.org - It saved the paywalled version of the page.
99
8
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

Maybe this has been discussed before, so feel free to tell me to buz off if so. In the web UI, emojis are rendered at what appear to be a pretty normal size.

two-wolves-1

For example, this is rendering with a fixed width of 60px

Without the Emoji tag, however, this becomes a normal image.

two-wolves-1

This now renders at its full resolution of 129x120 pixels.

This is a pretty small deviation, but some of the emojis are much higher resolution.

Take the Kelly Emoji for example: kelly It's pretty small at a fixed width of 60px; however, its full size is 393x268px.

kelly

The URL could be rendered using the thumbnail param but that isn't a clean looking rescale:

https://www.hexbear.net/pictrs/image/4130400e-bfdb-4b39-bee4-739802528a0f.png?thumbnail=60
kelly

vs

kelly

However, it does reduce the size of the file from 13kb to roughly 1kb.

For UI rendering, it would appear that the only important requirement is that your Markdown has a title/alt text that is emoji followed by an emoji name.

![kelly]( https://www.hexbear.net/ "emoji kelly")
kelly

![this could be whatever]( https://www.hexbear.net/ "emoji sicko-flipped")
this could be whatever

For users who are browsing from a mobile app, they will see a broken image. The UI replaces the rendered image tag, which should look like this:

<img src="https://www.hexbear.net/pictrs/image/4130400e-bfdb-4b39-bee4-739802528a0f.png" title="emoji kelly" alt="emoji kelly">

with this:

<img class="icon icon-emoji" src="https://www.hexbear.net/pictrs/image/4130400e-bfdb-4b39-bee4-739802528a0f.png" title="kelly" alt="kelly">

giving it the classes icon and icon-emoji which then apply some CSS rendering that sets the size to 60px

.icon-emoji {
  width: 60px;
  height: auto;
  max-height: inherit;
}

Even though the UI is scaling these emojis down to a reasonable size, the site still delivers the full resolution file when rendering the page.

The impact of this becomes more apparent when you select the emoji picker. As you scroll through the emoji list, you are generating requests that can total up just over 100 MB of data transferred across just over 2500 files. Obviously, this is an extreme example, one that has more to do with the emoji picker's inefficiencies then anything else.

view larger image here

One of the other side effects (if it really matters to anyone) is that because LemmyUI injects the emoji image via identifying its tag name in the title property and replacing the image tag with the preformed img tag with resizing classes (url and everything), most mobile apps render the inline images at full resolution. It also opens up some shinanigans that I won't outline here, that you won't detect unless you're using a mobile app.

The matter of rendering size appears to be a known issue: https://github.com/LemmyNet/lemmy/issues/3520 or at least an issue that's been reported. I don't know what the ramifications would be in using the /images/process end point for every emoji inserted into a comment. Obviously, it wouldn't be worth it to use that endpoint to receive a resized file via the UI. It doesn't seem to be an endpoint you can call without some kind of authentication anyway. Not as simple as adding ?resize=60 to the end of the URL. If I had to guess, you would want to use that endpoint on upload to save the file at the approprate size. (I think that's how it should work anyway, pict-rs documentation is pretty... sparse).

Just something I've noticed and wanted to put out there to the wider hexbearian audience. I've yet to set up a dev environment for lemmy (it's on my growing list of things I'd like to tinker with); otherwise I'd probably look at this myself, since it could be a simple change (which I admit is a naive thought).

100
7
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

No idea if you do appeals

I sent this DM to avoid the impression on the part of @[email protected] that I was trying to publicly accuse them of being an alt just because we had a disagreement. Making it a DM establishes that it's personal banter.

If this is unacceptable, so be it, but 30 days ban for this waters down the definition of harassment a lot.

view more: ‹ prev next ›

hexbear

10441 readers
44 users here now

Hexbear Proposals chapo.chat matrix room.

This will be a place for site proposals and discussion before implementation on the site.
Every proposal will also be mirrored into a pinned post on the hexbear community.

Any other ideas for helping to integrate the two spaces are welcome to be commented here or messaged to me directly.

Within Hexbear Proposals you can see the history of all site proposals and react to them, indicating a vote for or against a proposal.

Sending messages will be restricted to verified and active hexbear accounts older than 1 month with their matrix id in their hexbear user profile.

All top level messages within the channel must be a Proposals (idea for changing the site), Feedback (regarding non-technical aspects of the site, for technical please use https://hexbear.net/c/feedback), or Appeals (regarding admin/moderator actions).

Discussion regarding these will be within nested threads under the post.

To gain matrix verification, all you need to do is navigate to my hexbear userprofile and click the send a secure private message including your hexbear username.

founded 4 years ago
MODERATORS