4 ms·

Everything old is new again. I used this same technique on MySpace 15 years ago. I wonder if Github will try to filter that out the same way MySpace did back in

Everything old is new again. I used this same technique on MySpace 15 years ago. I wonder if Github will try to filter that out the same way MySpace did back in the day.

rushter 6y ago
I did some research before writing an article. GitHub started proxying images in 2014, and there are a lot of repositories that use this technique to keep their stats. I think GitHub is OK with that.
- jrrrr 6y ago
  Re: proxy security concerns: >Unlike GitHub, most of them don't even bother proxying the image to hide IP, referrer, and browser agent. If you want to allow external images on your site, you must proxy them and hide everything about a person who requested it. > A person with bad intentions can trick a victim into opening your profile that looks completely legit and detect his IP and a browser. Can you explain this in more detail? Given a profile host that doesn't proxy, how does that attack work?
  - nso 6y ago
    Attack? 1. your browser opens image from external server (in this step the server gets your IP and potentially user agent as that's how browsers communicate with servers) 2. there is no step 2
    - cutemonster 6y ago
      What? My step 2: Go to ip addr and ask your favorite celebrity (whose ip you got) for an autograph and selfie together
  - f311a 6y ago
    The IP itself can be a very valuable information if you target famous people, politicians, criminals and so on. Such people usually know, that clicking on random links is not safe.
alibarber 6y ago
Memories! I hid my top 6 and made a 'random friend' thing. It was an image i.e. http://whatever/random-friend.jpg http://whatever/random-friend.jpg that linked to http://whatever/forward-to-friend http://whatever/forward-to-friend. The server served up a random profile picture - and crucially a cookie header that set the friend-id as a cookie that forward-to-friend would use to send you to the corresponding profile. I was _so_ proud of it at the time...
input_sh 6y ago
> the same way MySpace did back in the day. For us that weren't around in MySpace era, how did they do that?
- alibarber 6y ago
  I can't remember much about images - but basically filtering out question-marks and equals symbols (i.e. ...thing.php?some=value) in a lot of places. I remember getting Facebook and when they first started their API it was a bit better thought out, so they loaded images on the user's behalf. Some great reading about 'hacking' myspace at the time: https://samy.pl/myspace/ https://samy.pl/myspace/
  - oalders 6y ago
    Right. So you just had to serve a counter up via http://example.com/path/to/my/counter.gif http://example.com/path/to/my/counter.gif and embed whatever info you needed in the path to get around this.
vmception 6y ago
I think I did this for emails sometime between 15 years ago and today

Everything old is new again. I used this same technique on MySpace 15 years ago. I wonder if Github will try to filter that out the same way MySpace did back in the day.

rushter 6y ago

I did some research before writing an article. GitHub started proxying images in 2014, and there are a lot of repositories that use this technique to keep their stats. I think GitHub is OK with that.

jrrrr 6y ago
Re: proxy security concerns: >Unlike GitHub, most of them don't even bother proxying the image to hide IP, referrer, and browser agent. If you want to allow external images on your site, you must proxy them and hide everything about a person who requested it. > A person with bad intentions can trick a victim into opening your profile that looks completely legit and detect his IP and a browser. Can you explain this in more detail? Given a profile host that doesn't proxy, how does that attack work?
- nso 6y ago
  Attack? 1. your browser opens image from external server (in this step the server gets your IP and potentially user agent as that's how browsers communicate with servers) 2. there is no step 2
  - cutemonster 6y ago
    What? My step 2: Go to ip addr and ask your favorite celebrity (whose ip you got) for an autograph and selfie together
- f311a 6y ago
  The IP itself can be a very valuable information if you target famous people, politicians, criminals and so on. Such people usually know, that clicking on random links is not safe.

alibarber 6y ago

Memories! I hid my top 6 and made a 'random friend' thing. It was an image i.e. http://whatever/random-friend.jpg http://whatever/random-friend.jpg that linked to http://whatever/forward-to-friend http://whatever/forward-to-friend. The server served up a random profile picture - and crucially a cookie header that set the friend-id as a cookie that forward-to-friend would use to send you to the corresponding profile. I was _so_ proud of it at the time...

input_sh 6y ago

> the same way MySpace did back in the day. For us that weren't around in MySpace era, how did they do that?

alibarber 6y ago
I can't remember much about images - but basically filtering out question-marks and equals symbols (i.e. ...thing.php?some=value) in a lot of places. I remember getting Facebook and when they first started their API it was a bit better thought out, so they loaded images on the user's behalf. Some great reading about 'hacking' myspace at the time: https://samy.pl/myspace/ https://samy.pl/myspace/
- oalders 6y ago
  Right. So you just had to serve a counter up via http://example.com/path/to/my/counter.gif http://example.com/path/to/my/counter.gif and embed whatever info you needed in the path to get around this.

vmception 6y ago

I think I did this for emails sometime between 15 years ago and today