Replying to Avatar ben

I think it’s misleading to say nostrimg can change the content of your image, when the url to the image contains a hash of the content you uploaded
Avatar
Vitor Pamplona 2y ago

Hash urls don't mean that the file you are being provided matches the hash. Most of the time it's just a way to get a unique URL. And since we generally don't know how the hash is computed clients don't implement the verification. Also, it will be hard to clients to implement every single hashing procedure out there.

Anyway... the fact that you are pinging a hashed URL doesn't mean the server is replying with something that matches it.

Reply to this note

Please Login to reply.

Discussion

Avatar
ben 2y ago

from a purely technical standpoint I agree with your points, but from a community standpoint - I don’t. I appreciate the zero trust and verification, but I also think it’s important to “play well” in this new ecosystem. I guess the language in these warnings rubs me the wrong way. I’m not much of a copywriter though so I don’t have any suggestion for you. most I can do is share my feedback.