this post was submitted on 11 Aug 2023
32 points (97.1% liked)

Sync for Lemmy

15148 readers
9 users here now

๐Ÿ‘€


Welcome to Sync for Lemmy!

Download Sync for Lemmy


Welcome to the official Sync for Lemmy community.

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Community Rules


1- No advertising or spam.

All types of advertising and spam are restricted in this community.



Community Credits

Artwork and community banner by: @MargotRobbie@lemmy.world


founded 1 year ago
MODERATORS
 

A recent post at Lemmy.ml pointed out that images are loaded directly by Lemmy clients, and aren't proxied through any instances.

This has some implications for targeted advertising and tracking. For example, if I ran an ad network, I could post a benign-looking comment that has a tracking pixel embedded as an image. Say I posted one on a Lemmy post about cooking: when a user scrolls near that comment, the image would get loaded and I would be given an association between an IP address and device type โ†’ some interest. If not many people use that IP and device type tuple, I could determine that you were interested in cooking and try to serve you ads for kitchenware.

Adding the option to specify the HTTP user agent when viewing images (or better yet, randomize it between a bunch of valid ones) would be a nice option for privacy-conscious users who don't want advertisers (or websites collecting HTTP request data to sell to advertisers) to be able to build profiles on them.

If you wanted to add extra value to Sync Ultra, you could even offer image proxying as one of its features :)

Edit: According to this comment, the regular Lemmy website will load embeds for direct messages. If that's also true for Sync, it means someone could find your IP address by just sending you a message with an embed. That has some even bigger privacy implications.

Edit: Sync doesn't embed the image, but it loads it to display a thumbnail:
Screenshot of my inbox showing a thumbnail of the image

you are viewing a single comment's thread
view the rest of the comments
[โ€“] red@sopuli.xyz 3 points 1 year ago (1 children)

Ua spoofing will only make you more easily detectable. Every UA string should be a common one, or just empty.

[โ€“] eth0p@iusearchlinux.fyi 1 points 1 year ago* (last edited 1 year ago) (1 children)

The problem with a common UA string is that you would know the request came from someone browsing Lemmy with Sync. Ideally, media requests to any third party should be indistinguishable from a regular web browser. As for empty strings: in my experience, some websites block requests with an empty or missing User-Agent header.

I still think the best approach would be to let the user pick a UA. Having a list of common browser/device pairs that update the version numbers automatically would probably be a good idea, though.

[โ€“] red@sopuli.xyz 4 points 1 year ago

By common, I meant the most used UA string that exists, not a shared Lemmy one