5 ms·

SmugBlog: Your private photos are still private (response to "dangers of autoincrementing")

16 points by toffer 19y ago

mhartl 19y ago
This response is too long.
__ 19y ago
"When you set your SmugMug gallery to 'private', this is exactly what you're doing - making the gallery and photos difficult, but not impossible, to find." Is that the usual definition of 'private'?
- scooter53080 19y ago
  I agree it is the term 'private' that is wrong here, not necessarily the behavior (though it obviously could be more secure.)
- brlewis 19y ago
  Yes, clearly not all users understood "private" the way smugmug uses it. I think Don is feeling a little defensive now, but tomorrow he'll probably go ahead and change "private" to "unlisted".
imsteve 19y ago
Thanks for submitting this toffer.
koolmoe 19y ago
His "challenge" is totally missing the point. Just because it is difficult to identify the owner of a random picture doesn't mean that one couldn't use that picture against the wishes of the owner.
bfioca 19y ago
This is a case of serious disconnection with user expectations. You see this all the time - a software company (usually its developers) get so caught up in their code and the way the do things and their own terminology that they forget what users actually want and how they use the products. smugmug should use this as a learning experience, admit their mistake, and remedy the problem. I see this as a missed opportunity on their part.
ajkirwin 19y ago
I had a little fun with that content. Tried things with the site, XSS, fiddled with the API.. Good lord, I could spider and index this site so very easily, and make off with a veritable treasure trove of data. There's no way on the site to properly privatize an image, except putting a password on it.
- hhm 19y ago
  These photos are really useful... I have some code for skin detection I've been writing and I need tests for. Now I can download massive sets of data and test the algorithm against it. I'm not going to do it anyway, but hell it can be _very_ useful if you decide to use it.
- imsteve 19y ago
  Was the target image in his contest password protected?

16 points by toffer 19y ago

This response is too long.

__ 19y ago

"When you set your SmugMug gallery to 'private', this is exactly what you're doing - making the gallery and photos difficult, but not impossible, to find." Is that the usual definition of 'private'?

scooter53080 19y ago
I agree it is the term 'private' that is wrong here, not necessarily the behavior (though it obviously could be more secure.)
brlewis 19y ago
Yes, clearly not all users understood "private" the way smugmug uses it. I think Don is feeling a little defensive now, but tomorrow he'll probably go ahead and change "private" to "unlisted".

imsteve 19y ago

Thanks for submitting this toffer.

koolmoe 19y ago

His "challenge" is totally missing the point. Just because it is difficult to identify the owner of a random picture doesn't mean that one couldn't use that picture against the wishes of the owner.

bfioca 19y ago

This is a case of serious disconnection with user expectations. You see this all the time - a software company (usually its developers) get so caught up in their code and the way the do things and their own terminology that they forget what users actually want and how they use the products. smugmug should use this as a learning experience, admit their mistake, and remedy the problem. I see this as a missed opportunity on their part.

ajkirwin 19y ago

I had a little fun with that content. Tried things with the site, XSS, fiddled with the API.. Good lord, I could spider and index this site so very easily, and make off with a veritable treasure trove of data. There's no way on the site to properly privatize an image, except putting a password on it.

hhm 19y ago
These photos are really useful... I have some code for skin detection I've been writing and I need tests for. Now I can download massive sets of data and test the algorithm against it. I'm not going to do it anyway, but hell it can be _very_ useful if you decide to use it.
imsteve 19y ago
Was the target image in his contest password protected?