Currently it is easy to track visitors and their ip address, browser, etc. on your crates at crates.io. One can reference an image in the readme of a crate which is now rendered when viewing the crate. The referenced image is then downloaded by the viewers browser, which means you can simply embed any tracking pixel.

For this reason, on GitHub all embedded images are downloaded by GitHub and the referenced image in a readme is replaced by an address to GitHub.

This issue is similar to comments #460, which proposes to proxy/cache shown badges in the sidebar (even though the title is mainly about Google Analytics). With user defined readmes this can now be more practically exploited.

The CSV package (https://crates.io/crates/csv) currently shows both of these at the same time:

It seems the beta thing may be confusing crates.io to not show the correct Cargo.toml line? I'm not sure, but figured it was worth mentioning.

I tried to run cargo publish --index=my_path/tmp/index-co after following the instructions in docs/CONTRIBUTION.md. I then received the following error:

error: [35] SSL connect error (error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol)

I traced the error back to this block from openssl by using openssl's CLI. I've also attached two files for some extra info: cargo_publish.txt openssl_test.txt

relevant environment info: - OpenSSL 1.1.0g 2 Nov 2017 - OS: Linux - distro: Arch

It appears that the response from the local crates.io server to the initial ClientHello is smaller than an SSLv2 ServerHello which forces cargo publish to abort.

In the search rusult page, like https://crates.io/search?q=unic, the package versions are images, making then not findable in the browser.

IMHO, using an HTML/CSS/SVG approach would better here, or even having the version as plain/rich text instead of badge.

One indicator of the version being different from other badges is the fact the the version badges are not linked, because they are local data.

What do you think?

I think that readme_to_html is supposed to ignore non-markdown files, but relm's asciidoc readme is incorrectly rendered as markdown: https://crates.io/crates/relm