MHSanaei：3x-ui 赞助展示保留，赞助数据已改从 GitHub 拉取，并说明 IP 日志与内容校验；不计划提供关闭开关

在 3x-ui issue #6824（围绕赞助位远程拉取的隐私与安全威胁模型讨论）下，维护者 MHSanaei 答复：赞助系统保留，但做一处改动。①IP 日志：每个面板在打开仪表盘时本就会请求 api.github.com 检查更新，也会向 GitHub 获取 Xray 版本与地理文件，GitHub 已经能看到哪些 IP 在运行 3x-ui；赞助数据同样由 GitHub 提供，因此没有增加 GitHub 已记录之外的东西，维护者本身不存储任何 IP。②SNI：这一条确实成立。自 35b5e098 起，面板改为从 raw.githubusercontent.com/MHSanaei/sponsors/... 拉取赞助数据，不再使用 sponsors.sanaei.dev；现在链路上可见的只是一个无数工具都在使用的主机名，路径仍在 TLS 之内。若还想对 GitHub 隐藏服务器 IP，可设置「面板设置 → 常规 → 面板出站」。③内容：赞助数据公开且位于独立仓库；面板只接受 https:// 链接、符合严格模式的 logo 名和真实的 PNG/WebP/JPEG 字节，并代理这些 logo，第三方看不到管理端 IP。不计划提供关闭开关，也不计划内置打包。

作者原文@MHSanaei
Thanks for the detailed write-up. The sponsor system stays, with one change.
IP logs: every panel already calls api.github.com/repos/MHSanaei/3x-ui/releases/latest whenever the dashboard opens, for the update check, and also contacts GitHub for Xray versions and geo files. GitHub can already see which IPs run 3x-ui. The sponsor data is served from GitHub too, so it adds nothing to what GitHub already logs. The maintainer stores no IPs.
SNI: this point was valid. Since 35b5e098 the panel fetches sponsor data from raw.githubusercontent.com/MHSanaei/sponsors/... instead of sponsors.sanaei.dev. The only thing visible on the wire is now a hostname that countless tools use, and the path stays inside TLS. If you also want to hide the server IP from GitHub, set Panel Settings → General → Panel Traffic Outbound.
Content: the sponsor data is public and lives in a separate repository. The panel accepts only https:// links, logo names that match a strict pattern, and real PNG/WebP/JPEG bytes, and it proxies the logos so no third party sees admin IPs.
No opt-out switch or bundling is planned.

返回动态列表查看原文