Live data from Hacker News

GitHub hands out your repo visitors IP like candy who ask for it politely

11–12 of 12 posts

Re: GitHub hands out your repo visitors IP like candy who ask for it politely

#11

Post by chatmasta » Wed, Apr 05, 2023, 1:07 PM UTC

rtldg wrote: post #10

chatmasta wrote: post #6

Earlier quoted context omitted.

You can just put a JPG hosted on your server in the readme and get their full IP.

Github proxies images so this shouldn't be possible https://github.blog/2014-01-28-proxying-user-images/

Oh wow TIL. Very interesting. And since 2014 too? Nice. They must have done that around the same time Google did it for GMail.

I wonder if it's still true. I imagine they have some Content-Security-Policy preventing it so you can't do hacks like embedding an external URL in an SVG.

Re: GitHub hands out your repo visitors IP like candy who ask for it politely

#12

Post by rtldg » Wed, Apr 05, 2023, 1:34 PM UTC

chatmasta wrote: post #11

rtldg wrote: post #10

Earlier quoted context omitted.

Github proxies images so this shouldn't be possible https://github.blog/2014-01-28-proxying-user-images/

Oh wow TIL. Very interesting. And since 2014 too? Nice. They must have done that around the same time Google did it for GMail. I wonder if it's still true. I imagine they have some Content-Security-Policy preventing it so you can't do hacks like embedding an external URL in an SVG.

Their CSP does seem to prevent an svg I threw in a readme from loading a png so that's good to see. And a test png in the readme was proxied too.

content-security-policy: default-src 'none'; img-src data:; style-src 'unsafe-inline'

Post reply on HN