# Defaulting to discourse.org CDN for avatars is a privacy and security risk

**URL:** https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731
**Category:** Feature
**Tags:** privacy
**Created:** [25 בספטמבר,‏ 2015,‏ 3:35am UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731 "2015-09-25T03:35:51Z")
**Posts on this page:** 4
**Page:** 2

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [25 בספטמבר,‏ 2015,‏ 11:02pm UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731/25 "2015-09-25T23:02:25Z")

</div>

Eric, I am open to working with you on making proxy a default.

Can you do a local Discourse install, then enter your container and mess around with nginx conf until it proxies correctly, once you get it going paste the nginx config section here and I can look at integrating it. It will take a few months to move to local proxy by default cause everyone needs to do a rebuild to get nginx changes.

---

<div class="post-metadata">

### Author: ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [28 בספטמבר,‏ 2015,‏ 12:12pm UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731/26 "2015-09-28T12:12:44Z")

</div>

BTW, for everyone playing along at home, I’ve created [this pull request](https://github.com/discourse/discourse/pull/3821) to implement avatar proxying. Testing would be appreciated; success/failure comments on the PR preferred.

---

<div class="post-metadata">

### Author: ![konklone](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/konklone/32/116763_2.png) [@konklone](https://meta.discourse.org/u/konklone)
#### Post date: [28 בספטמבר,‏ 2015,‏ 12:39pm UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731/27 "2015-09-28T12:39:22Z")

</div>

> [@sam](#):
>
> Eric, I am open to working with you on making proxy a default.

Thank you, I really appreciate you being open to this.

> [@mpalmer](#):
>
> BTW, for everyone playing along at home, I’ve created this pull request to implement avatar proxying. Testing would be appreciated; success/failure comments on the PR preferred.

And thank you @mpalmer for beating me to it. 😄 I’ll move my comments over there.

---

<div class="post-metadata">

### Author: ![chapoi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/chapoi/32/537252_2.png) [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [4 בדצמבר,‏ 2025,‏ 11:37am UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731/28 "2025-12-04T11:37:01Z")

</div>



[Previous page](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731.md?page=1)