timescale.info#174 · Link images on the server instead of storing copies; credit their sources
- timeline-app
- pull request
Closes #109. The second half of the pair (#166, the terms review) follows in its own PR. ## The answer to #109 - **Linking vs. copies:** linking to an image where its owner hosts it is largely not infringement: - **US, Ninth Circuit:** the "server test" of *Perfect 10 v. Amazon* (the Google Images case) and *Hunley v. Instagram*; - **EU:** *Svensson*, *BestWater*, *VG Bild-Kunst*, unless framing protections are circumvented or the linker knows the source is unlawful. That protection is contested: the Fifth Circuit rejected the server test in 2026 (*Emmerich*). **Copies are different:** storing and serving them reproduces and distributes the image wherever you are. - **How Google Images does it:** it links to full-size images and keeps only small thumbnails, which were held fair use. Every result names its source, and it handles takedown notices. - **What we did:** **Save to server** stored a copy of each linked image (`assets`), captured by the browser from any host allowing cross-origin access, and the platform served those copies to readers. That was the real exposure, more than browsing linked images. ## What changes (decided on the issue: links only on the server) **The server keeps links, not copies.** - **The editor:** it no longer embeds copies when saving to the server or proposing. - **The server:** it drops any copies it is sent. `withoutImageCopies` is applied in: - the API's `document()` validation, covering create, replace, the changes settings and imports into the server; - pull requests (`collaboration.mjs`); - `store.create` and `store.replace`. - **`.och` export:** the converter route keeps copies, because it returns the requester's own file. **Exports are unchanged:** `.ochx`, `.och`, the offline HTML and desktop files still embed copies, fetched from the source at export time, so they work offline. **Earlier copies removed:** the migration runs `releaseImageCopies` once. It clears copies from timelines, saved-history settings, revision patches, snapshots and pull-request documents. - **Immutability:** saved history is otherwise immutable. This purge is its one exception, made in the migration with the server stopped, like a takedown; the triggers are re-enabled afterwards (tested). - **Storage:** a timeline's storage shrinks by what its copies took. What saved history was charged stays. **Credit:** the hover card shows "Image: example.org". The details' image field reads "Image from example.org · open the original ↗", and asks owners to link only images they may share. **Trade-off (accepted on the issue):** an image disappears from the timeline if its host removes it or stops allowing it to be embedded. Exports keep copies for those who need them. ## Docs - **New `docs/images.md`:** the choice, the law by jurisdiction, and what the service does. - **Updated:** `TERMS.md` (links, not copies; link only what you may share), `PRIVACY.md` (the server stores links), and `docs/plugins.md` and the README. ## Tests - **New:** `test/image-links-postgres.mjs`: - creating, replacing and saving changes with copies stores none; the link stays; - a pull request's revision keeps none; - the purge removes copies from the timeline (its storage shrinks back), snapshots, history settings and pull-request documents; - running the purge again finds nothing; - saved history is immutable again afterwards. - **Updated:** `test/versioning-postgres.mjs`, whose fixture round-tripped copies. - **Results:** - all 42 database tests pass locally, as do 270 unit tests and the typecheck; - all nine browser suites pass in Chromium.