Post
Topic
Board Meta
Re: No more signature images
by
Maged
on 08/11/2011, 21:34:53 UTC
Yes, hosting the images is not worth the trouble. Definitely don't do that.
But there are many ways you can prevent the linking of dynamic images, and thus prevent cookie stuffing.
That is impossible. The only way you can prevent people from linking dynamic images without local hosting is by whitelisting image upload sites where you trust that it is impossible to upload dynamic images.
In my mind, a forum is more useful when people can read through a guide with pictures without having to click on each image to display it individually.  But I guess not everyone can look past the fractions-of-a-second lost when scrolling past an off-topic picture.  Roll Eyes

Agreed.  The cookie stuffing exploit is real enough, though. It would be easy enough to add some Javascript to detect whether or not the resource loaded in the img src url is actually an image, and if not, then all users who have Javascript enabled would get a huge warning (and mods could easily see them and delete).

eg:
http://stackoverflow.com/questions/3499941/javascript-check-if-img-src-is-valid
http://stackoverflow.com/questions/3744266/how-can-i-test-if-a-url-is-a-valid-image-in-javascript

All that does is warn the user after the fact. By then, it's too late.