broken links for placeholdit

[runephilosof-abtion]

Describe the bug

Seems placeholder.com has been bought by someone else.

Maybe replace with something like https://placehold.co/600x400

https://via.placeholder.com/450x250.png - Failed to load resource: net::ERR_NAME_NOT_RESOLVED

[stefannibrasil]

A while ago, we decided that instead we should deprecate generators that rely on external services. See #2852. This specific generator was missed during that work.

Could you add a deprecation to this instead so we can later remove this generator?

The generator we have control of and recommend using for this purpose is LoremFlickr.

[runephilosof-abtion]

@stefannibrasil How about we merge my PR #3056 as is and then I make a follow up PR to deprecate it?

[runephilosof-abtion]

LoremFlickr does not have the same functionality as PlaceholdIt.
It is missing text and text color.
LoremFlickr returns much larger images.
Also, it currently has some problems which the author describes as crippling

[sadiqsid]

Replace with https://placeholdit.com/600

I’ve switched to placeholdit.com — honestly, it’s even better. High-quality placeholders, blazing fast, and super easy to use. Definitely my go-to now for prototyping and mockups.

[viktorianer]

A while ago, we decided that instead we should deprecate generators that rely on external services. See #2852. This specific generator was missed during that work.

Could you add a deprecation to this instead so we can later remove this generator?

The generator we have control of and recommend using for this purpose is LoremFlickr.

Just for reference: https://loremflickr.com/ and https://github.com/MastaBaba/LoremFlickr-3

2025-06-04
We've released version 3. More options, and taking into account Flickr API usage limits. But, you have to run the code on your own server.

[connorshea]

It should probably be noted that - while in this case it's extremely unlikely because placeholder.com would cost $200k to acquire - this kind of generator resolving to a dead domain is technically a security risk if any users are loading images from it.

For example:

• Company has a Rails app with a CI job that runs the DB seeds to verify that they work
• Every time a PR is opened, the CI job runs
• The DB seeds include a user record which loads avatars using this generator
• These images are processed using ImageMagick, which has vulnerabilities disclosed/patched every few weeks.
• The domain expires, and then is purchased by a malicious actor.
• The domain starts sending malicious images crafted to exploit a recent vulnerability in ImageMagick to execute a payload in the CI pipeline, or on a developer machine if they manually run the seeder.

An attacker would therefore have code execution on the company's CI pipeline and/or dev machines via this generator.

Again, this is incredibly unlikely and unreasonable to execute on for this generator, because of the specifics of the attack being unlikely to occur (especially with the domain being dead for so long now, any users of this generator have surely moved off it) and the cost of the placeholder.com domain, but I think we should definitely consider what to do if any of the other (likely much less expensive) domains were to expire in the same way.

This concern is moot once we deprecate and remove the external sources as planned, but I figured I'd mention it. I've audited all the generators like this, and all other URLs like this are live and fine at the moment. (there is also the concern of a domain being purchased for malicious purposes or a safe domain becoming malicious, but 🤷‍♂️).