This is not correct
I’m glad you implemented EFF’s DNT standard, but no, this doesn’t address my concern.
EFF’s DNT standard is great, but you’re still collecting logs in one place, and your servers still learn about everyone’s behavior. I’d rather have the DNT policy on record than not, but fundamentally we have to trust Discourse (the company) to obey it. That’s not nearly as private as simply never talking to your servers at all.
And all of the elements of this policy only apply to people who have the DNT header set in their browser, so there are no formal guarantees in place for users without it. Even if you informally apply the policy to everyone, this still doesn’t protect against someone compromising your servers.
DNT policy or not, using avatars.discourse.org by default materially increases the privacy and security risks of your users, for dubious performance gain.
The issue is not serving these letters, it generating them at scale, especially when algorithms change. Its 300ms of work to generate the original and then another bunch of work for each resize, in scale this adds up.
I understand this route is expensive, and you detailed a number of other options you could pursue. I also noted that the only one that worked well for email is the hosted version.
What I don’t understand is why the majority of size/letter combinations can’t be computed ahead of time, so that you only take the performance hit for novel sizes.
Another alternative would be having the Discourse server instance proxy to avatars.discourse.org server-side. This would leave the security risk in place from a compromised avatar CDN, but would remove the privacy risk almost entirely.
Another alternative is to use the SVG approach you outlined, but export it to an image in the size you need – that seems offhand like it would be faster. Another alternative is to pursue tuning image generation itself in some way. Another alternative is to do nothing at all.
I’m not trying to armchair-engineer Discourse for you, but of all of those, precomputing sounds the simplest and most helpful to me.
In any case: DNT or not, making Discourse instances phone home by default is a bad move, for small benefit, and Discourse should find another way forward.