News for hackers. Stuff that matters.

A comment on GitHub hands out your repo visitors IP like candy who ask for it politely. Parent comment

Re:GitHub hands out your repo visitors IP like candy who ask... by rtldg on Wednesday April 05, 2023 @09:01AM (#35453418)
Github proxies images so this shouldn't be possible https://github.blog/2014-01-28-proxying-user-images/
[ Parent | on HN ]
Re:GitHub hands out your repo visitors IP like candy who ask... by chatmasta on Wednesday April 05, 2023 @09:07AM (#35453489)
Oh wow TIL. Very interesting. And since 2014 too? Nice. They must have done that around the same time Google did it for GMail.

I wonder if it's still true. I imagine they have some Content-Security-Policy preventing it so you can't do hacks like embedding an external URL in an SVG.

[ Parent | on HN ]
Re:GitHub hands out your repo visitors IP like candy who ask... by rtldg on Wednesday April 05, 2023 @09:34AM (#35453895)
Their CSP does seem to prevent an svg I threw in a readme from loading a png so that's good to see. And a test png in the readme was proxied too.

content-security-policy: default-src 'none'; img-src data:; style-src 'unsafe-inline'

[ Parent | on HN ]