Wish: remove ability to hotlink images in signatures

[neogna2]

I noticed a user was hotlinking an image in their signature. That means anyone viewing any of the user's posts connects to a third party site to download that image. That is a possible means of tracking users on the forum. To prevent that I suggest removing the ability to hotlink images in signatures.

I'm not saying that any particular user is trying to track anyone. I only suggest removing an ability to do so.

While at it, perhaps also remove the ability to hotlink inside posts too! New posts, as it would be a lot of work to convert older existing hotlinks I guess. In addition to reducing tracking risk making user attach images instead of hotlinking them means forum post history can be preserved without having to rely on various third party sites to keep hosting the hotlinked images in the future.

[joedf]

I would to see what other think, but here are my my thoughts.

I do prefer images to be independent of 3rd party hosting, but it is much more accommodating for new users to allow them to attach images however they like or know how. Arguably, we could indicate the "how" in the reply/posting section, but this has proven to be ineffective with [\code] tags being the prime example. However, setting the limitation may "encourage" (or maybe discourage) users to figure out how to include images without "hotlinking".

Unfortunately, this does not seem like it is a built-in feature of phpBB. An appropriate plugin or custom implementation would be needed.

[neogna2]

I see that you also hotlink images in your signature though to the old ahkscript domain

[joedf]

indeed

[Marium0505]

Maybe it would be possible to limit to certain URLs (such as the most common places to upload images (Imgur, etc)? Seems like a nice compromise. And then there could be a thread where people could request URL's to be added to the whitelist.

[neogna2]

Marium0505, yeah that could be a middle way.

I hope there is some phpBB plugins or code snippet to block the [img] tag. That can whitelist [img] tags for the imgur.com domain. And apply only to post creation or edits at times after the code is enabled, to avoid breaking older posts that hotlink.

More ambitiously (and beyond the scope of this request) some script could trawl through all older posts and detect [img] hotlinking, retrieve the hotlinked image and make it into an inline attachment.

I wonder why some currently use imgur over of attach+inline. How much is due to UI design?
- The "insert image tag" image icon button is close to the edit box.
- The "add file" button is much further down, users may need to scroll to see it. "place inline" is only visible after attaching a file, so users might not know it is possible. Drag and drop image on edit box attaches it. But there's no hint that that feature exists and again can require scrolling to see "place inline".

UI change ideas for attach+inline. Given it an icon button above the edit box. Or let the image icon button open the "add files" popup. A text hint could say "drop image to place inline". After attaching an image a "place inline" button could show and flash above the editbox. Maybe rename "place inline" to "place image inline" or "place image in text".

In the meantime here is a uBlock origin dynamic rule to on this site show only images hosted on autohotkey.com and ahkscript.org and joedf's specific signature images
.

ublock.png (50.92 KiB) Viewed 1223 times

[tank]

Put together a list of domains. I like this idea enuff to do the enhancement. Once finalized I will do the work of generating a notification to those out of compliance, remove hotlinks in sigs by db and then alter the ucp functions to screen signatures for hotlinks fome unapproved domains

[joedf]

Neat, I think imgur and github.[com|io] are at the top of my list haha

[neogna2]

@tank great, thank you!

Neat, I think imgur and github.[com|io] are at the top of my list haha

Yeah those two (three) seem reasonable. Maybe start with that and if people later ask to whitelist some other image host decide that case by case.