Hacker News Reader

That's a reasonable point. I wonder if returning a default avatar rather than a 404 would be a reasonable deterrent?

Wouldn't they just check for the default avatar then?

Twitter used to have a series of different coloured "Egg" avatars for new users.

But, yes, this might be useful in enumeration attacks - but so is something like WebFinger.

Good points to consider. Thanks!