Locally mirrors commenters' Gravatar, Libravatar and Mastodon avatars and serves them from your site, rather than loading them from a third-party web site upon each page load.<\/p>\n\n
This has several effects:<\/p>\n\n
If most of the comments on a post have no avatar, those turn into one<\/em> load of a shared image, instead of one for each comment, that happens to return the same \"mystery\" image.<\/p><\/li>\n You will be serving more (small) images.<\/p><\/li>\n If a commenter's URL looks like a link to a Mastodon \/ ActivityPub profile, their Mastodon account's avatar will be displayed.<\/p><\/li>\n When commenting, a live preview of the avatar tracks the contents of the \"Email\" field.<\/p><\/li>\n gravatar.com<\/a> and libravatar.org<\/a> no longer have a web-bug on your blog that is loaded by each viewer. Instead of being loaded at every page view, the avatar is loaded just once, on the server-side, at the time each new comment is posted.<\/p><\/li>\n If someone changes or deletes their avatar, your site continues displaying the image that was their avatar at the time that they last posted.<\/p><\/li>\n Likewise, the user's Gravatar or Mastodon profile is saved along with their comment, viewable by admins even if they later change or delete it.<\/p><\/li>\n<\/ul>\n\n Libravatar<\/a> is open source. Gravatar is owned by WordPress<\/a>, and their privacy policy<\/a> says that they don't monetize that info. But hey, corporate policies change, subpoenas exist, and domain names get sold.<\/p><\/li>\n Should you trust Gravatar with user data? Well, in 2024, Gravatar announced that they are pivoting to blockchain<\/a>, whatever that means, so that's fairly disqualifying. See also WordPress \"growth hacking\"<\/a> and WordPress sells users' data to train AI tools<\/a>.<\/p><\/li>\nSecurity and Privacy<\/h3>\n\n
\n