### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 8, 2018, 9:51오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/8 "2018-08-08T09:51:12Z")
I can think of more expensive routes people could hit if they wanted to hurt us, generating the svg cert is super cheap
Also, you can get user lists more efficiently by going to directory which lists chunks of 30 or so to anon
I really see no urgency to change anything here
---
### Author:  [@bkampmeyer](https://meta.discourse.org/u/bkampmeyer)
#### Post date: [8월 8, 2018, 10:24오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/9 "2018-08-08T10:24:23Z")
> [@tgxworld](#):
>
> Hmm but if someone is going to write a script and loop through all the possible user ids, they can do the same with the `/u/` route.
Of couse, but incrementing the user\_id is much more efficient than creating random usernames.
> [@sam](#):
>
> Also, you can get user lists more efficiently by going to directory which lists chunks of 30 or so to anon
Could you specify that? Which directory will list the users?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 8, 2018, 10:27오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/10 "2018-08-08T10:27:14Z")
[https://meta.discourse.org/u](https://meta.discourse.org/u)
You can also just crawl the forum and collect usernames, I am failing to see the drama or urgency here
---
### Author:  [@bkampmeyer](https://meta.discourse.org/u/bkampmeyer)
#### Post date: [8월 8, 2018, 10:40오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/11 "2018-08-08T10:40:06Z")
> [@sam](#):
>
> [Discourse Meta](https://meta.discourse.org/u)
The ‘/u’ doesn’t work if you disable the setting ‘enable user directory’.
> [@sam](#):
>
> You can also just crawl the forum and collect usernames, I am failing to see the drama or urgency here
No urgent drama from my side but if you try everything to hide users who don’t post on public categories this certificate behavior isn’t very pleasant..
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8월 8, 2018, 10:40오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/12 "2018-08-08T10:40:07Z")
At minimum only logged in users should be able to trigger it though.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 8, 2018, 10:43오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/13 "2018-08-08T10:43:35Z")
Oh we will fix this for sure, I just think it can wait till Monday, you should only be allowed to generate the svg file for yourself really
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 8, 2018, 10:48오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/14 "2018-08-08T10:48:48Z")
> [@bkampmeyer](#):
>
> The ‘/u’ doesn’t work if you disable the setting ‘enable user directory’.
You are headed down a long rabbit hole here, what about autocomplete JSON api, type @a in a post and you can see the call. Fishing out all usernames is trivial that way. Seal that and then what about search, it searches for usernames, even anon gets to do that.
At some point you are destroying usability cause of an incorrect assumption
---
### Author:  [@bkampmeyer](https://meta.discourse.org/u/bkampmeyer)
#### Post date: [8월 8, 2018, 10:59오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/15 "2018-08-08T10:59:31Z")
> [@sam](#):
>
> You are headed down a long rabbit hole here
Starting to see that as well, thanks for the other hints regarding the userlists nonetheless!
I’m aware that Discourse wasn’t designed with such use cases in mind and that it’s quite a complex software so ensuring no user information is publicly available is either naive or unrealistic.
Apart from little customization issues we’re really thrilled by Discourse and it’s abilities, thanks for coding/testing/thinking/setting up/sharing!
---
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [8월 20, 2018, 3:27오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/16 "2018-08-20T03:27:33Z")
> [@bkampmeyer](#):
>
> the html ‘title’ tag is “test\_cert”
Fixed in
[https://github.com/discourse/discourse/commit/038de4e037193935565a8835409b39e696ec0eaf](https://github.com/discourse/discourse/commit/038de4e037193935565a8835409b39e696ec0eaf)
Thank you for reporting @bkampmeyer
> [@codinghorror](#):
>
> so at minimum anons shouldn’t be able to do this.
This is done in
[https://github.com/discourse/discourse/commit/07d07c7b5fd598c539d546c469bdce2b0bd957bb](https://github.com/discourse/discourse/commit/07d07c7b5fd598c539d546c469bdce2b0bd957bb)
---
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [8월 20, 2018, 3:27오전 UTC](https://meta.discourse.org/t/discobot-certificate-issues-title-public-access-user-id-information-leak/94177/17 "2018-08-20T03:27:41Z")