This is true. I hint to it in the terms, but I didn't want to break character too much. Basically, I take precautions for both, but it's a one-man side-project, so caveat emptor. Also, images are obviously public (though unlisted), so it's not meant for sensitive data storage.
This isn't about exposed credentials though. It would be like an autmatic image uploder that could pick an image hosting site such as imgur and upload the image for you and give you a link. Services are offering the ability to host images for you. You aren't stealing imgur's s3 credentials. They just let any user upload images for free despite the fact it technically costs them money to host the file for you. Similarly there are sites offering the ability to serve LLM requests for you for free.
I think it's pretty safe as long as no one without the permissions can find (or guess/extrapolate) that URL. The images are probably just hosted by a CDN and serving up the files with authentication might slow it down or complicate the setup.
It can't be open like that "just use our URL" because it will bring many free-riders and shutdown your server.
But it also can't be a closed system with private keys and all that, because the hassle is too enormous -- the user will need a server to get the key for each image and so on.
I have the impression that all services of this kind suffer from the above dual-problem.
Of course it's not, but the method is the same, you append a different picture to the end and modify the original image header to point to it. The encoding or encryption is not relevant.
reply