3 ms·
This is a product decision. It may be partly informed by 1) If anyone sees a photo, they can redistribute it regardless of what our restrictions are serversid
by patio11 13y ago
This is a product decision.
It may be partly informed by 1) If anyone sees a photo, they can redistribute it regardless of what our restrictions are serverside, so might as well not give users unreasonable expectations. 2) We really WANT people to share photos. That's basically what Facebook's core interaction is. 3) Implementing this additional security does not increase any metric which Facebook cares about. 4) Users occasionally rely on this feature to post pictures which they host on Facebook to other sites on the Internet, which we want to support, because it means they post photos on Facebook.
- grinich 13y agoAdditionally, it means serving photo assets can be way faster. The authentication step is done at page generation (essentially inserting an obscure URL), so the photo can be moved to a CDN or non-application code server. It's pretty standard practice. For example, Gmail does something very similar for attachments.
- spacemanmatt 13y agoYup, it's the CDN that precludes auth for images. This was one of the bigger nails in my account's coffin.
- bmm6o 13y ago> This was one of the bigger nails in my account's coffin. What are you referring to here?