No Stupid Questions @lemmy.world henfredemars @infosec.pub 1 yr. ago

Does Lemmy strip photo GPS data?

Most mature social networks do remove this information to prevent users accidentally sharing their locations. Can someone positively say whether Lemmy is aware enough to strip extra information from photos?

40 comments

Yes, pict-rs which is used b by Lemmy strips exif. Confirmed by the dev themselves.
- What
  
  Pict-rs is a rust library. Lemmy is a rust program. Lemmy uses pict-rs as a dependency. Pict-rs strips exif data. Exif data is the metadata that would include GPS data. Thus, lemmy strips GPS data
  
  Tldr: yes
  
  I don’t think we should be downvoting this guy. Take off your IT hats, folks, it wouldn’t mean much to people outside the industry.
Sal@mander.xyz

"I have just tested by uploading/re-downloading an image, and the EXIF data is removed. I then looked through the Lemmy issues and found this issue related to the image-uploading back-end (pict-rs) removing the EXIF data. In response to this issue, the developer of pict-res (asonix) comments that striping the EXIF data was one of the original motivations for building the uploader. I am not sure about how to search through the source code of pict-rs, and it seems like this step is not properly documented in the readme file, so I have not been able to find exactly where the metadata removal operation takes place. I think that this is done by invoking ‘exiftool’."
Looks that way. I just downloaded a few pictures people have uploaded and checked the meta data, there's not much there.
This is a great question and good to know 🙏
It’s always best to assume nothing strips GPS data. You should strip it yourself if you care.
- Exactly. Even if the standard Lemmy software does it, there's no guarantee that your instance admin hasn't altered the code or done something else to keep that data.
- Do you have any tips for how users can easily manage this, themselves?
  
  I’m hesitant to name anything specific since time exists and tech fluctuates, but there’s definitely a small, free utility app for your device that will strip exif data from your images.
  
  Search for ‘remove exif’ in your App Store and see what people are saying about the top several apps listed.
  
  (EtA: In nongeek, ‘exif’ data includes the photo’s gps coordinates, specific type of camera or device that created the image, timestamp, and other info, and its all quite easily viewable.).
  
  Nerds use these apps more than most, so their reviews tend to go into some detail. There are certainly apps available that are easy to use on your device. Obviously don’t use an online service for this, either.
  
  https://www.xda-developers.com/how-to-view-remove-exif-data-android-ios/
Yeah lemmy strips everything. This comes up with AI stuff because typically the prompt and seed are attached to EXIF with the PNG output.
- Stable Diffusion puts everything into a tEXt chunk not eXIf. (But this is also needlessly pedantic lol.)
  
  No no not needless. I haven't looked into it past what I've seen while lurking. I'm putting together a workstation for SD, but have only used cloud instances so far and haven't tried to use the embedded prompt. I merely noted it exists. Now I have something else to look up and reference. Thanks.
Yes, and it even causes issues with rotation. 😅
- It removed the location data, so now it doesn't know what side of the planet you're on to correctly orient the image.
What about kbin? Does kbin also strip that kind of data?
- What about Ja Rule? Has anyone consulted Ja?
  
  Hehe he probably doesn’t even know who Ja Rule is!
  
  How are we going to make sense of this tragedy without Ja?
- I'll have a look at this when I get a sec. I know the images are re-processed on upload (and cropped etc) so I assume no useful data is preserved in that process. Good to confirm tho
  
  Looking in ImageRepository.php it doesn't appear that images have their extra data stripped. Also testing it on my dev instance showed that GPS data remained in the image. Should be an easy fix since all image uploads are processed through that repository.
  
  Edit: In fact there's already an issue open for it - https://codeberg.org/Kbin/kbin-core/issues/374
It is supposed to be removed by exiftool in the backend by default.
You could check by downloading a bunch of photos and looking at the exif data, I suppose. Someone said the other day it isn't, which would be definitely a problem. It's also possible a specific instance could not strip it, which is worth checking for your own photos. I noticed that photos seem to retain the original filename which is not optimal.
Does pixelfed remove gps/exif data?

You've viewed 40 comments.