@mapkyca good point, I hadn’t considered this problem with hotlinking profile photos before. I think some webmention implementors have started doing this, and I intend to do it within Shrewdness.

It’s worth noting that the attack is not at all limited to profile photos though, rather any photo or otherwise automatically loaded content in the comment e.g. images or audio. Whilst caching profile photos is feasible, caching any media in comments is more difficult, and therefore a good reason for text-only comments.

Text-only content is not an option in Shrewdness, but perhaps instead images could be cached, and other media loaded upon demand, removing the ability to arbitrarily spy on people.