SmugBlog: Your private photos are still private (response to "dangers of autoincrementing")

"When you set your SmugMug gallery to 'private', this is exactly what you're doing - making the gallery and photos difficult, but not impossible, to find."

Is that the usual definition of 'private'?

His "challenge" is totally missing the point. Just because it is difficult to identify the owner of a random picture doesn't mean that one couldn't use that picture against the wishes of the owner.

This is a case of serious disconnection with user expectations. You see this all the time - a software company (usually its developers) get so caught up in their code and the way the do things and their own terminology that they forget what users actually want and how they use the products. smugmug should use this as a learning experience, admit their mistake, and remedy the problem. I see this as a missed opportunity on their part.

This response is too long.

Thanks for submitting this toffer.

I had a little fun with that content. Tried things with the site, XSS, fiddled with the API..

Good lord, I could spider and index this site so very easily, and make off with a veritable treasure trove of data.

There's no way on the site to properly privatize an image, except putting a password on it.