Please post again when you get the cease and desist letter!
Stealing from Google
21–30 of 31 posts
Re: Stealing from Google
#22> But there’s a catch: anyone can abuse your app to optimize their own images, which costs you compute. Could anyone explain this?
The components work by requesting the image URL from your own server/API, at a route like `/_next/image`. The actual image URL that's passed as a prop to the component is passed to that API endpoint as a URL parameter. So, the endpoint is essentially a proxy that does additional image processing, like compression and width/height resizing (again, a URL parameter that the Image component or any other client can change…
Thanks for the explanation - I was deeply confused by this article's premise. I've never worked with Next.js or Astro, so I didn't have the background.
Re: Stealing from Google
#23Irony: Claim you're stealing from Google, then post it on a .dev domain, of which Google is the operator.
They sold .dev to Squarespace a couple years ago.
Re: Stealing from Google
#24Earlier quoted context omitted.
The post seems to be written by a developer that has never heard of caching and thinks they have invented some illicit solution by implementing it. It makes very little sense - They don't want to ask users to trust Google's domain despite... integrating the user's google account? What?
And in what way is this stealing? Caching a publicly available asset? Sounds like you are saving Google bandwidth/money.
Yes, quite the opposite. It did remind me of the old days though, when you could do the opposite and "hotlink" pictures from most websites and save yourself bandwidth costs!
Re: Stealing from Google
#25Earlier quoted context omitted.
The post seems to be written by a developer that has never heard of caching and thinks they have invented some illicit solution by implementing it. It makes very little sense - They don't want to ask users to trust Google's domain despite... integrating the user's google account? What?
I think the point is that they’re avoiding whitelisting Google and Github domains which is necessary to preprocess images from and use urls to images to their domain in an Image tag. That allows malicious users to send urls such urls to his _next image preprocess endpoint and get “free compute”. (Not sure why someone would do that other than to just screw with somebody). He’s using BetterAuth hooks to fetch those ima…
That does make sense, but I'm not sure why it was worth sharing.
Re: Stealing from Google
#26If I wanted to achieve the same result, that is to serve assets of others from my own domain, I'd just create a custom endpoint like /api/user-avatar/:userId and an action proxies the actual image from google, maybe keep a cached copy for some time to not have to redownload the image on every request.
Especially since, if you were doing this on CloudFlare—which you can with OpenNext—it's incredibly simple to work with CloudFlare's caches in Workers. For example: https://developers.cloudflare.com/workers/examples/cache-usi...
Plus there's their Images service which could come in handy to transform them a bit, too, if you wanted.
Re: Stealing from Google
#27This seems problematic to me. Beyond just caching issues, did you ever get permission from users to store their personal data? They gave google permission, but not you.
It's a public photo. What's wrong with downloading it?
Re: Stealing from Google
#28This seems problematic to me. Beyond just caching issues, did you ever get permission from users to store their personal data? They gave google permission, but not you.
It's a public photo. What's wrong with downloading it?
Folks, read yourself some GDPR for the greater good. Even just https://gdpr-info.eu/art-4-gdpr/
Public data can be personal data and anyone doing the same as TFA is making itself a liable processor. But, aren't you a processor by using OAuth in the first place? Yes but with what TFA is doing you have a greater liability surface.
(IANAL but I cite GDPR because the broad concepts apply to data privacy laws in other jurisdictions. See also: https://en.wikipedia.org/wiki/Brussels_effect)
Re: Stealing from Google
#29If I wanted to achieve the same result, that is to serve assets of others from my own domain, I'd just create a custom endpoint like /api/user-avatar/:userId and an action proxies the actual image from google, maybe keep a cached copy for some time to not have to redownload the image on every request.
This. Only needs a couple lines of nginx config.