technology

hideshow 17 child comments

[–] AernaLingus@hexbear.net 9 points 1 month ago (13 children)

Wait, I thought Hexbear automatically proxied embedded images and videos for privacy reasons. Is that not happening anymore?

hideshow 13 child comments

parent

[–] BoarAvoir@hexbear.net 8 points 1 month ago (6 children)

Hey, following up on this, this feature is not the default behavior in Lemmy, and was disabled in our config inadvertently some time ago. My apologies.

It is now re-enabled, and we're considering if any further remediation is necessary.

Really appreciate the heads-up about this issue.

FYI @piccolo@hexbear.net @reader@hexbear.net @RondoRevolution@hexbear.net @edie@lemmy.encryptionin.space

hideshow 6 child comments

parent

[–] AernaLingus@hexbear.net 3 points 1 month ago (1 child)

Thanks, I appreciate the fix and the reply! doggirl-thumbsup

I had assumed the proxy was dynamic (i.e. the Hexbear server checks for embedded resources hosted on external domains and replaces them with the proxied links on-the-fly when serving requested content), but based on the earlier images/videos in this thread not being proxied even after the config has been updated it looks like it happens when records are committed to the database? That's unfortunate, and I presume that's why you're considering possible further action. In an ideal world the database entries in the intervening period would be amended, but that does seem like a hassle, and I won't pretend to know how involved that might be.

parent

[–] BoarAvoir@hexbear.net 2 points 1 month ago

Yep, that's exactly it.

parent

[–] RondoRevolution@hexbear.net 2 points 1 month ago (2 children)

Thanks for pinging me to let me know, I appreciate the fix! I honestly didn't even thing about that being an issue if not for the other comrades pointing it out.

I have one question, is there a correct place for feedback and feature requests about the funny bear site?

hideshow 2 child comments

parent

[–] BoarAvoir@hexbear.net 3 points 1 month ago (1 child)

c/feedback is the official spot. For more urgent matters, tags/reports/DMs to admins can also work.

Feature requests can be tough because we (currently at least, open to volunteers) have very limited development resources, but feel free to ask, there's always a chance the feature is something that can be done with a config change or a bot or a userscript, or that another user will come along and go "I reckon I could implement that."

parent

[–] RondoRevolution@hexbear.net 3 points 1 month ago

I see, thanks!

There are a couple of issues I noticed here and there on the site that I'll eventually post there then.

parent

[–] piccolo@hexbear.net 2 points 1 month ago

Thanks for the reply and for your hard work! Care-Comrade

parent

[–] piccolo@hexbear.net 7 points 1 month ago* (2 children)

This is concerning to me as well. Since images auto load, it's easy for the computer serving the image to harvest IPs and maybe the server can even tell that hexbear was the source of the request. (I'm on my phone so I can't check right now but this part at least can be disabled on hexbear's side.) But a malicious actor could easily make a hexbear-unique image url even if hexbear is setting the proper headers or attributes on the image.

I suppose a malicious actor could also do this with links to external domains, but I think the ability for it to be passively collected makes it worse.

I noticed that @RondoRevolution@hexbear.net put the image in a spoiler; I wonder if it works even un-spoilered. (Edit: it does.)

hideshow 2 child comments

parent

[–] reader@hexbear.net 7 points 1 month ago (1 child)

I think some domains have always been allowlisted... If it works for arbitrary domains that's a bigger issue.

test

parent

[–] reader@hexbear.net 9 points 1 month ago

Huh yeah not ideal. Maybe @makotech222@hexbear.net knows?

parent

[–] RondoRevolution@hexbear.net 6 points 1 month ago* (1 child)

Never knew that was supposed to happen automatically. There's other stuff broken in the site like youtube title detection and thumbnail embedding too, when I post youtube videos like on c/music and c/videos I need to manually link to the thumbnail.

parent

[–] AernaLingus@hexbear.net 4 points 1 month ago

For years, any embedded images/videos not directly hosted on Hexbear would get replaced by something like

https://hexbear.net/proxy?q=https%3A%2F%2Fexample.com%2Fthing.jpg

It appears to be a built-in feature of Lemmy, and I'm not sure why it has been disabled—I don't remember that being announced, at least.

parent

[–] edie@lemmy.encryptionin.space 5 points 1 month ago

Apparently not?

ⓘ This user is suspected of being a cat. Please report any suspicious behavior.

parent

[–] Enjoyer_of_Games@hexbear.net [S] 5 points 1 month ago (2 children)

Embedding an image only requires an! to be inserted infront which I have left as an exercise for the user at their own discretion.

hideshow 2 child comments

parent

[–] RondoRevolution@hexbear.net 4 points 1 month ago (1 child)

I see, I thought you meant for that to be automatic. The video URL is not copied tho, at least in the example tweet I copied with the script.

parent

[–] Enjoyer_of_Games@hexbear.net [S] 4 points 1 month ago

video link fixed in 1.1 just need to click update on greasy fork

I didn't make images embed automatically because it's not always wanted (size or image is unrelated). Also people tend to to rehost images which is a good idea for resilience considering nitter is under direct attack atm.