4 ms·

How? If you send an email with an image to 15k recipients in a mail server the image would be fetched once and the recipients would only get the cached version.

• kijin 6y ago
  Image URLs often contain identifiers that are unique to each recipient.
  • Pet_Ant 6y ago
    So this would only dissuade that practice as it causes a DDOS against those who do because it causes additional requests and prevents caching.
    • vidarh 6y ago
      The image url can point at an innocent third party.
      • sildur 6y ago
        Which innocent third party provides thousands of unique image URLs?
        • Thiez 6y ago
          https://example.com/img.png?x=1 https://example.com/img.png?x=1 https://example.com/img.png?x=2 https://example.com/img.png?x=2 https://example.com/img.png?x=3 https://example.com/img.png?x=3 https://example.com/img.png?x= https://example.com/img.png?x=... https://example.com/img.png?x=1999 https://example.com/img.png?x=1999 https://example.com/img.png?x=2000 https://example.com/img.png?x=2000 You need but one image, to craft an arbitrary number of unique urls using a querystring. In theory one could also use all permutations of uppercase/lowercase letters in the path to the image. Most webservers are case insensitive so all will yield the same result but I believe the http standard considers the path to be case sensitive so all those urls would be unique.
          • sildur 6y ago
            As I said in another comment, crop all the parameters from the URL, and the problem solves itself. Path is case sensitive, the domain must be lowercased anyways, so no problem either.
            • vidarh 6y ago
              Crop the parameters and you have no reason to assume it points at the same image. Good luck explaining to your customers what happens when someone finds a way to effectively poison your non-unique image cache with something offensive.
              • sildur 6y ago
                > Crop the parameters and you have no reason to assume it points at the same image. Well, that is going to be a problem for the mailer. I'm totally fine with banning dynamic parameter dependent images. > Good luck explaining to your customers what happens when someone finds a way to effectively poison your non-unique image cache with something offensive. I would say it is the email marketer fault for using unsupported parameterized images. I cannot image a legit use for that, and many evil spammy ones.
                • vidarh 6y ago
                  > I would say it is the email marketer fault for using unsupported parameterized images. The problem is this would not just happen to e-mail from email marketers, but also between regular users, and it would take just one particularly nasty exploit of cache poisoning of urls to some site with user-generated content before you suddenly have the press asking you why some innocent picture sent by someone underage to someone else underage was replaced by your site by hardcore porn - or worse. I've run a webmail provider. I've seen the amount of abusive bullshit spammers and scammers do whether for profit or for fun or to get back at someone. It used to be my job to find these kind of issues before bad guys did, and one thing we learned very quickly was that every little thing like this would instantly have people probing it for ways to abuse it to cause grief for someone else. Or for us. If you were going to ban images parameterized by URL parameters (and that would not ban parameterized images, just reduce the number of sites that could be attacked), the only viable choice is not load them at all. Just stripping the parameters would be an absolute disaster and wildly irresponsible.
  • sildur 6y ago
    Crop all the parameters from the URL. Problem solved.
    • sildur 6y ago
      > Just stripping the parameters would be an absolute disaster and wildly irresponsible. It's not worse than allowing a randomly selected subset of HTML in the emails, and nobody is saying it is an "absolute disaster" or saying that google or Microsoft are "wildly irresponsible". The mailers and people will get used to it. As they always do.