Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

It is, but it's perhaps incompatible with uploading your private images to a cloud service.


sort by: page size:

On the contrary, it is for any images created with their software, whether you store those images in their cloud or at your own computer.

Yes; this is why the feature is the Cloudimage server, not the JS lib.

This is true. I hint to it in the terms, but I didn't want to break character too much. Basically, I take precautions for both, but it's a one-man side-project, so caveat emptor. Also, images are obviously public (though unlisted), so it's not meant for sensitive data storage.

How is that any different from being able to save the photo as a file and upload it to a free image hosting site? From a security point of view?

Since it can be easily circumvented anyway, disallowing sharing static photo URLs would be the real "pseudo security", in my opinion.


Exactly this with for example cryptomator if you want ease of use. You can then upload the image to whatever cloud provider you want.

It would work on any service that allows you to share an image with one individual user.

> If a user needs a dynamic image he can download it to his own machine and upload it.

Doesn't that somewhat defeat the purpose of a dynamic image?


So, what? Everything is vulnerable.. You're not restricted by official images, just create your custom image that is not vulnerable ;)

This isn't about exposed credentials though. It would be like an autmatic image uploder that could pick an image hosting site such as imgur and upload the image for you and give you a link. Services are offering the ability to host images for you. You aren't stealing imgur's s3 credentials. They just let any user upload images for free despite the fact it technically costs them money to host the file for you. Similarly there are sites offering the ability to serve LLM requests for you for free.

I think it's pretty safe as long as no one without the permissions can find (or guess/extrapolate) that URL. The images are probably just hosted by a CDN and serving up the files with authentication might slow it down or complicate the setup.

>Using a website on the other hand is like exchanging a few nice words

This is absolutely not true if you're supposed to upload (possibly private) images to some random server for e.g. background removal.


It can't be open like that "just use our URL" because it will bring many free-riders and shutdown your server.

But it also can't be a closed system with private keys and all that, because the hassle is too enormous -- the user will need a server to get the key for each image and so on.

I have the impression that all services of this kind suffer from the above dual-problem.


Anyway to download the image for use in a private cloud?

For images, we used to do it ourselves but then moved to hosted images (cloudinary). Much better, and allows stateless web servers.

Well, if it's possible to upload own picture, perhaps it might make sense to cache images in the cloud, at least when hotlinking is disabled.

Many services allow uploading arbitrary images. This is certainly a threat they should mitigate against in their sandboxing strategies.

> It doesn't seem to have the same ability for you to give your users a way to upload their own images in a secure way?

This can be handled by a CMS. E.g. Media Cloud, a WordPress plugin that integrates with IMGIX.


Isn't there a risk for this service to be used as an image proxy? The analyzed images are rehosted on their S3...

Of course it's not, but the method is the same, you append a different picture to the end and modify the original image header to point to it. The encoding or encryption is not relevant.
next

Legal | privacy