🆕 blog!

[edent@mastodon.social]

🆕 blog! “Alpha launch - .well-known/avatar - feedback wanted”

I've gotten sufficiently annoyed with a trivial problem that I'm preparing to write an IETF RFC. Yeah. That's how ticked off I am!

Every site that I sign up for asks me to upload an avatar to represent myself. Whenever I change my photo, I have to log in to a hundred sites and change it…

👀 Read more: https://shkspr.mobi/blog/2025/10/alpha-launch-well-known-avatar-feedback-wanted/
⸻
#IETF #ReDeCentralize #standards #web

[emily_s@mastodon.me.uk]

@Edent my site is statically hosted, I'm not sure I can return different stuff based on the content header.

What about .well-known/avatar.(json|png|jpg|etc) As a fall back option?

[edent@mastodon.social]

@emily_s That's a reasonable point.

For a static site with only one user, you can just save a .jpg as `avatar` (without the file extension and it'll be served up.

[db@social.lol]

@Edent would using a hash of the email address in its place improve privacy? 🤔

[edent@mastodon.social]

@db Not really. You've given your email address to the service - so they know it.

[db@social.lol]

@Edent I'm just imaging some service hot-linking the image and exposing the URL on the front-end

[db@social.lol]

@Edent and URLs/requests find their way into access logs etc

[edent@mastodon.social]

@db I agree that people shouldn't hotlink the images.

But as for logs, the domain serving your avatar already knows your address and should already restrict sensitive logging.

[tychotithonus@infosec.exchange]

@Edent Big fan of the decentralization goal! Also curious about what can be learned from Gravatar (what to do, or what not to do). Since quite a few sites do use them, I wonder if having some compatibility with their "API" could be beneficial, to reduce implementation friction. (Edit: also curious about what drove their choice to use hashes)

I also wonder about how the standard would handle "wild success" - if Gmail or Yahoo wanted to implement it, how would that shift the requirements (including non-functional requirements like security)?

Great idea, good for you for tackling the general case!

[edent@mastodon.social]

@tychotithonus Gravatar works in a world where everyone only has one email address.

There's always a risk that a large organisation could add weird and proprietary extension.

[tychotithonus@infosec.exchange]

@Edent Could you elaborate a little? Gravatar also works if you have 15 email addresses (source: me 😅).

And good point about proprietary extensions. One design goal might be to try to preemptively solve what they would try to extend in advance. (Not that that's easy.) I only suggested it as a thought experiment for exploring the problem space, for potential improvements to your own standard. 🤝

[edent@mastodon.social]

@tychotithonus
It does - but I've found that I have to add each email address manually.
I can't have a gravatar of *@example.com

[julian@activitypub.space]

edent@mastodon.social if you're tying an avatar to a domain, why not just declare a TXT record instead?

That's software agnostic too.

I will now proceed to read the blog post in case you already talked about that 😝