3 ms·

Yes, I was thinking the same thing. This seems like it would also hold true for Slack, Teams, Discord -- any app that would make another request to render the

• consoomer 3y ago
  Most of those apps already had this issue raised/exposed and fixed. It seems to be a very common security measure that is overlooked.
• orf 3y ago
  If you send a message to a channel with 5k people in it, would you expect 5k requests to go to the page in a short interval? How would that work with custom unfurl extensions? It’s all proxies and unfurled on the server, once. Anything else is madness.
  • numpad0 3y ago
    Does that madness help measuring CTR?
  • mh- 3y ago
    Agreed. And iMessage actually has the sender client generate the link preview and bundles that with the message. This sounds weird, but with end-to-end encrypted conversations, it's basically that or have it generated by the recipient. (or have one of the receiving client send it to a service out-of-band, but that "defeats" the end-to-end encryption.)
    • mikepurvis 3y ago
      Having the sender do it also makes sense from an auth point of view— thinking of like a private Github repo, or something like Jira running on your corporate VPN. Presumably the sender intended to share the contents with every recipient anyway and any that don't have access still of course won't be able to click through. But it would be pretty bad UX if the card was just blank in these cases because the messaging server didn't have access.