# Defaulting to discourse.org CDN for avatars is a privacy and security risk

**URL:** <https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731>\
**Category:** Feature\
**Tags:** privacy\
**Created:** [September 25, 2015, 3:35am UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731 "2015-09-25T03:35:51Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [September 25, 2015, 3:46am UTC](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731/3 "2015-09-25T03:46:55Z")

</div>

> [@konklone](#):
>
> Unfortunately, this also means that Discourse’s servers learn about the browsing activity of all users of Discourse instances which have this default in place,

This is not correct

[http://avatars.discourse.org/.well-known/dnt-policy.txt](http://avatars.discourse.org/.well-known/dnt-policy.txt)

The issue is not serving these letters, it generating them at scale, especially when algorithms change. Its 300ms of work to generate the original and then another bunch of work for each resize, in scale this adds up.

see:

[https://meta.discourse.org/t/optimizing-letter-avatar-rendering/33082](https://meta.discourse.org/t/optimizing-letter-avatar-rendering/33082)

So yeah, if you are not happy with our [do not track policy](https://www.eff.org/dnt-policy) and want to take the hit yourself, disable the site setting.

---

_[View the full topic](https://meta.discourse.org/t/defaulting-to-discourse-org-cdn-for-avatars-is-a-privacy-and-security-risk/33731)._