so what i'm talking about are posts that log identifying user information in order to serve you a specific thing. the post i'm talking about rn is one that's going around that gives you a fake little "post viewing debt" counter that will update every time your computer loads the post. an older, more Blunt example is the "spongebob literally doxxes you" post, where it's a randomly-selected image from spongebob squarepants with a text element overlayed that reads out your physical location.

both of the authors of these posts have stated that they went through the effort of anonymizing the data, and the spongebob poster specifically said that the information is not logged. and again, i do believe them! the people who made those posts seem trustworthy and i don't really feel like there's anything malicious at play whatsoever.

However . the issue i have is that when users are empowered to that extent, when the only restriction on their power is their own model of ethics, what is stopping someone from building a much more sinister machine. who's to say someone hasn't Already built a much more sinister machine, hidden in a completely innocuous image post that is already circulating.

the question of "malware on cohost" is not an if but a when, and honestly there probably already Are pieces of malware circulating that no one has yet been made aware of. i'm not a compsci major, i don't know how to solve this problem without gutting the user-accessible css tools, but its something that i think would probably be an extremely high priority problem to solve if i was running the show here.

there's a difference between a website knowing identifying information about me and a semi-anonymous user knowing identifying information about me. hope this helps!

how did you achieve that, might i ask?

btw, requests to images on external servers can do the same thing, the server can log the request. if you want to prevent any potential external ip logging, you have to prevent any requests that go off the cohost domain & cdn. cohost themselves could do this with a content security policy if they wanted, but it would break lots of posts.

that's not going to solve anything

the external server can serve anything at any url, it can have .png extension and work the same, or it could have no extension.