# Defaulting to discourse.org CDN for avatars is a privacy and security risk

**URL:** <https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731>\
**Category:** Feature\
**Tags:** privacy\
**Created:** [25 سبتمبر 2015، 3:35ص UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731 "2015-09-25T03:35:51Z")\
**Posts on this page:** 1\
**Showing post:** 26

<div class="post-metadata">

**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\
**Post date:** [28 سبتمبر 2015، 12:12م UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731/26 "2015-09-28T12:12:44Z")

</div>

BTW, for everyone playing along at home, I’ve created [this pull request](https://github.com/discourse/discourse/pull/3821) to implement avatar proxying. Testing would be appreciated; success/failure comments on the PR preferred.

---

_[View the full topic](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731)._