[HN Gopher] Stealing from Google
       ___________________________________________________________________
        
       Stealing from Google
        
       Author : dominikdoesdev
       Score  : 44 points
       Date   : 2025-09-29 09:27 UTC (3 days ago)
        
 (HTM) web link (taqib.dev)
 (TXT) w3m dump (taqib.dev)
        
       | gryfft wrote:
       | Nice, but doesn't automatically update when the Google avatar
       | changes. Cache invalidation strikes again.
        
       | DashAnimal wrote:
       | This seems problematic to me. Beyond just caching issues, did you
       | ever get permission from users to store their personal data? They
       | gave google permission, but not you.
        
         | abraham wrote:
         | The users are going through an OAuth flow and creating an
         | account. Presumably they are agreeing to a ToS as part of that.
        
           | mattmanser wrote:
           | It even says in the OAuth flow that the company is requesting
           | your profile image.
        
       | mimsee wrote:
       | If I wanted to achieve the same result, that is to serve assets
       | of others from my own domain, I'd just create a custom endpoint
       | like /api/user-avatar/:userId and an action proxies the actual
       | image from google, maybe keep a cached copy for some time to not
       | have to redownload the image on every request.
        
       | russianGuy83829 wrote:
       | <Furiously typing GDPR data request..>
        
       | xyzzy9563 wrote:
       | Surely you could think of something better to work on
        
       | dakiol wrote:
       | I really didn't get what the post was about. I'm getting old or?
       | And I thought I was clever because I work with distributed
       | databases...
        
         | zaik wrote:
         | The post assumes the reader is familiar with where things are
         | happening and who is involved. Guess I'm not part of the target
         | audience.
        
           | lozenge wrote:
           | Loading an img tag doesn't involve trusting a domain.
           | Especially using crossorigin and refererpolicy attributes.
        
         | devmor wrote:
         | The post seems to be written by a developer that has never
         | heard of caching and thinks they have invented some illicit
         | solution by implementing it.
         | 
         | It makes very little sense - They don't want to ask users to
         | trust Google's domain despite... integrating the user's google
         | account? What?
        
           | valiant55 wrote:
           | And in what way is this stealing? Caching a publicly
           | available asset? Sounds like you are save Google
           | bandwidth/money.
        
       | bitpush wrote:
       | Isn't this just passthrough caching with some persistence?
        
       | reaperducer wrote:
       | Irony: Claim you're stealing from Google, then post it on a .dev
       | domain, of which Google is the operator.
        
       | lelandbatey wrote:
       | Note to the developer: you may want to consider simplifying the
       | CSS you're using to display the "clever" dot in the background of
       | your page. On my computer, opening viewing your site in Firefox,
       | scrolling the page has a nearly 2000ms delay caused by whatever
       | is going on. This is improved but not fixed by disabling the
       | `.bg-dot::before` background CSS property.
        
       | stephenlf wrote:
       | > But there's a catch: anyone can abuse your app to optimize
       | their own images, which costs you compute.
       | 
       | Could anyone explain this?
        
         | samtheprogram wrote:
         | [delayed]
        
       ___________________________________________________________________
       (page generated 2025-10-02 23:00 UTC)