Privacy: Integration list leaked even with analytics disabled

[esev]

Checklist

• I have updated to the latest available Home Assistant version.
• I have cleared the cache of my browser.
• I have tried a different browser to see if it is related to my browser.

Describe the issue you are experiencing

When visiting the /config/integrations/dashboard page, information about the integrations I have loaded is sent to brands.home-assistant.io. This happens even when all analytics are disabled in /config/analytics.

Describe the behavior you expected

If analytics reporting is disabled, Home Assistant should not expose/report information about the loaded integrations. I'd expect the brand icons to not be loaded from a remote location if the user has disabled analytics reporting. Maybe show a generic icon, or no icon, in this case.

Steps to reproduce the issue

1. Visit the /config/analytics and disable all analytics reporting
2. Open network inspect developer tools in the browser
3. Visit the /config/integrations/dashboard page
4. Observe brand images are loaded from brands.home-assistant.io for each integration enabled in Home Assistant.

What version of Home Assistant Core has the issue?

core-2023.8.2

What was the last working version of Home Assistant Core?

No response

In which browser are you experiencing the issue with?

No response

Which operating system are you using to run this browser?

No response

State of relevant entities

No response

Problem-relevant frontend configuration

No response

Javascript errors shown in your browser console/inspector

No response

Additional information

This seems related to #17560 & #15440.

Note: I don't believe this is a high-priority issue. It just seems like unexpected behavior for users who have disabled analytics reporting. I only noticed it after adding a CSP header similar to the person who reported #15440.

[steverep]

AFAIK, access logs for brands.home-assistant.io are not analyzed, and even if they were, it would be a completely unreliable way to know which IP has which integrations installed, as images might get requested just for checking out an integration or its documentation.

Also, the images are all loaded with a "no-referrer" policy, meaning the website origin making the request is not exposed. (The couple cases where it accidentally wasn't are fixed in #17840.)

[bramkragten]

If would scroll through the list of integrations in the add integration dialog you will also fetch these images, it says absolutely nothing about what integrations you have installed.

But you can always block access to brands.home-assistant.io if you want.