Are the user's IPs or other connection information being exposed to one another?
Could users fake the upstream response, sending a fake/false image instead?
If a user visits the page over a 14.4 modem, is he equally likely to have other users try to load over his connection as the Google Fiber user?
This seems really cool, but I wouldn't trust my sites with it yet ;)
So what? If I wanted to get a bunch of random IPs to attack, I could host a picture of a cat on my server, log IPs, and post the link on reddit. Or I could just scan random IPs within home ISP IP ranges.
All the security forces would have to do is visit the site then log all the IPs to which they send their copies of the images to.
Using this they could also narrow it down to the exact page being used rather than the IP address
I agree that there's a lot of work to be done to product-ize it-- we just couldn't wait to show off the demo!
We're adding functionality to rate peers by latency and bandwith, so consistently slow peers are removed from the network eventually.
We'll add IP profiling for geolocation and bandwith capability later on.