Hide user gravatar when email not public.

[simi]

• add default RubyGems.org avatar povided by slepchen from @RubyElders
• closes Proxy user Gravatar images #3278 and Prevent disclosure of user emails via Gravatar profile image URLs #3287
• explain how to enable avatar when disabled and share potential risk

@segiddins is it ok to just add images to public/images folder? Would that be served by Fastly in production?

default avatar examples

---

disabled avatar info

[codecov]

Codecov Report

Merging #4104 (02d76a4) into master (0c09a83) will increase coverage by 0.00%.
Report is 6 commits behind head on master.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #4104   +/-   ##
=======================================
  Coverage   98.86%   98.86%           
=======================================
  Files         275      275           
  Lines        6254     6268   +14     
=======================================
+ Hits         6183     6197   +14     
  Misses         71       71           

Files	Coverage Δ
app/helpers/application_helper.rb	97.61% <100.00%> (+0.47%)	⬆️
app/helpers/rubygems_helper.rb	100.00% <100.00%> (ø)
app/models/user.rb	100.00% <100.00%> (ø)

... and 2 files with indirect coverage changes

[indirect]

this looks good to me 👍🏻

[jenshenny]

Thanks for seeing this through!

[martinemde]

Nice to see this improvement. It seems like it's been requested for a long time. My review comment is not important by any means, just something I found useful in the past.

[martinemde]

I've often seen SVGs styled directly in css to change the fill color. Is that worth it here? Something like this with invert() or even inlining the svg so it doesn't take an extra request.

[segiddins]

I think doing it in the CSS makes sense, then the SVG will change without a page refresh

[simi]

This is not related to dark mode, but I'll try to provide inline SVG with styles, that could be possible.

[martinemde]

I was tired when I wrote this. Don't invert() it unless we want emerald users, haha.

[hsbt]

👍

[segiddins]

Maybe a silly question, but I think we could do something like add a /users/:id/avatar_:size.png endpoint that would proxy to gravatar, and then fastly would cache that, allowing us to continue showing avatars for everyone without leaking the email directly in the avatar link?

[segiddins]

I think doing it in the CSS makes sense, then the SVG will change without a page refresh

[indirect]

I thought about the proxy as an option to hide the gravatar hash, and then I realized that if we are serving the image, anyone can download the image and reverse-image-search to find some other place serving the image with the hash in the URL. The information leakage remains the same as long as we serve the image at all, so I think we need to hide the image if the user wants to keep their email address private.

[martinemde]

There's all different levels of privacy. Not sharing email easily vs staying totally anonymous. Is there any evidence that there's overlap between the totally anonymous users and gravatar users?

The only downside I can see is that a gem will look like it's published by a bunch of generic users if everyone has a private email.

This feels like bikeshedding. I bet this current solution is going to solve for the private email use case and then we could deal with the subset of users that want a profile image, but not gravatar, after we get requests for that feature.

[simi]

ℹ️ I'll check out possible SVG inlining and open other PR if needed.

[dentarg]

The only downside I can see is that a gem will look like it's published by a bunch of generic users if everyone has a private email.

Yeah I noticed this.. I thought something was broken, like some cache or something :) Just happened to see this PR. I understand the info leakage issue. I wonder if it was worth it. I think the avatars served a really good purpose. I imagine very few users will make their email public. Oh well...

[simi]

The only downside I can see is that a gem will look like it's published by a bunch of generic users if everyone has a private email.

Yeah I noticed this.. I thought something was broken, like some cache or something :) Just happened to see this PR. I understand the info leakage issue. I wonder if it was worth it. I think the avatars served a really good purpose. I imagine very few users will make their email public. Oh well...

No worries, there are plans to update those pages to be more friendly again. This PR was just to fix the reported issue as quickly as possible for now.