The ongoing shift of people’s memories from analog to digital formats led to the creation of ever-expanding storage options. But even the most substantial memory cards fill to capacity, leaving people looking for either more cards, or an option to store their images externally.

SmugMug CEO Don MacAskill said his company’s new service, SmugVault, picks up where SmugMug leaves off in terms of storing images. SmugMug provides unlimited storage of common JPEG, GIF, and PNG files; photographers who wish to keep RAW, TIFF, and PSD files among others can opt for a SmugVault subscription.

SmugMug offers SmugVault via Amazon’s S3 storage service. They plan to charge 22 cents per gigabyte of storage per month, plus a recurring $1 monthly fee. Data transfer fees vary on gigabytes in and out of SmugVault.

Users manage the storage through their existing SmugMug interface. SmugVault accepts other file types like Word and Excel documents for storage.

The service should appeal to the casual photographer who wish to ensure the safety of their photos and other electronic documents on an ongoing basis. CenterNetworks cited Zoomr’s Thomas Hawk on the expense heavy photographers would incur: someone with only 500GB of images would have to pay $110 per month for the storage.

The site claims to have over 270 million photos, and as I’ve failed to convince the site makers this vulnerability is worth fixing, I’m posting it here now as a warning: you must set photos you want to keep fully private to be password protected, too, not just private… and even then, we’re not fully sure it will cover all cases, though in my test that did the job. Co-editor Tony Ruscoe and I first noticed SmugMug’s photo saving scheme when pics of Google employee and SmugMug user Niniane Wang were popping up in RSS aggregator Friendfeed.com. Niniane was shocked when I told her about the security issues at the site, especially the fact that SmugMug doesn’t fix this.

To explain what’s happening so you can judge for yourself if this is worth fixing, here’s how SmugMug saves galleries and photo sources: they simply iterate the same number (ID) in the URL. You can use a user name as sub-domain or just write “www” and it will both work. Like these gallery URLs, which are public or “private”:

http://www.smugmug.com/gallery/1000
http://www.smugmug.com/gallery/1001
…
http://www.smugmug.com/gallery/4210001
http://www.smugmug.com/gallery/4210002
etc. …

Or these partly public, partly “private” photo sources:

http://www.smugmug.com/photos/10000-M.jpg
http://www.smugmug.com/photos/10001-M.jpg
…
http://www.smugmug.com/photos/247000001-M.jpg
http://www.smugmug.com/photos/247000002-M.jpg
etc. …

Tech blogger Andy Baio, who I asked for a comment on this, put it this way: “Oof, that’s awful. And it’s unbelievable that they don’t realize that it’s a security hole.” He added, “Smugmug’s users deserve to know their private photos aren’t private, and as soon as possible.” It took Andy only 15 seconds to launch and configure a Firefox download manager extension of his to start downloading 10,000 partly public, partly “private” photos of good resolution (10,000 being an arbitrary limit he picked, as he could have downloaded more). In my own tests of downloading just private galleries, I saw many mundane photos like vacation pics or animals, but also rarer pics of people skinny dipping, posing in the bed room with lingerie, modeling for artistic nude photos and so on. (And whatever you may think of these subject matters, their owners apparently tried to set them private for a reason.)

Now, SmugMug says they want to keep these private gallery URLs shareable, so that’s why they are still public in some way, and that they just don’t get linked from the homepage. But anyone with user security in mind will know that you can’t just iterate a predictable number if you want to keep these URLs even remotely safe – you would need to use a randomized string (GUID) for saving… something along the lines of the following (the specific length needed is debatable):

http://smugmug.com/gallery/20080128-ewi23wqo23sdjisdoi2w

At the moment, pictures which are not set to password protection but are clearly set to be private – even if other help labels explain that it’s just supposed to keep photos from showing up on the user homepage, the setting name is “public yes/ no” and the gallery will be labeled “private” if you activate this (see red font in screenshot below) – are public. You can’t directly see all the private pics knowing a specific user name (as that would require you to first download all galleries of SmugMug), but you can still grab thousands over thousands of random private pics.

Talking to some SmugMug users, I found out that some realize “private” pics aren’t really hard to find and that they made use of the password protection, while others were surprised that one could find these pics.

Failing to convince SmugMug this is an issue worth fixing

When I emailed SmugMug support to alert them of this issue, they got back to me to tell me this is “expected behavior” in order to keep galleries shareable. Which would still be the case if they were using GUIDs, except then the galleries wouldn’t be shared with the whole world, potentially! I was stuck in a long thread with them trying to convince them. Here are some of their answers – from their first reply:

Thanks for writing. This is expected behaviour. A private gallery just means that that gallery will not show up on your Smugmug homepage but it is accessible by knowing the direct URL to it. You do have the option of turning off external links so that no one can link to an individual photo. You may also password protect galleries so that no one can access them without a password.

After two more emails of mine, their second reply:

This is correct and is how private galleries work. A user needs the access key (the specific URL) in order to access the gallery or image within the gallery but that gallery will not be visible on your Smugmug homepage.

By now, I was talking to another support person already, and he even told me he’d escalate it to reply. Here’s some of what he said:

The photos you see in the manner below are public – ANYone can find it by search and browse

I told the support person that while he was referring to public photos, which indeed do pop up in the same matter, the issue was that private photos pop up as well! Writing again, I get this reply:

“Private” means it won’t be on the homepage. If you want them to not be found in this manner you describe, then you set SmugIslands to “no” and you can set a gallery password, or site password, in addition to disabling originals, and external links.

I continuously asked SmugMug for confirmations that all this is expected behavior, and was always surprised when they emphasized it is. By now, I really tried to go from support to CEO though. I told them that they should call their boss, that they should use GUIDs, that I was preparing a blog post on this, that one could see e.g. “private” galleries of people skinny dipping, that they should hire a security consultant and so on. After some time, here’s what the SmugMug CEO Don MacAskill replied:

I’m the CEO & Chief Geek at SmugMug, and I’m terribly sorry this is so confusing. Security & privacy are huge issues here at SmugMug, and we take them very seriously.

First of all, we view security and privacy as two separate, but related, issues. Security is like locking your front door (no-one can get in with out a key) and privacy is like closing your window drapes (no-one can look in from the outside, but you can tell people where you live and they can visit without a key).

At SmugMug, the feature you’re talking about, private galleries, falls under the privacy umbrella, not security. It’s intentionally designed so that you can “tell other people” about your photos (share a URL in an email, embed or hyperlink on your blog or message forum, etc) without having to share something like a password. Only people you’ve shared this URL with can find the gallery and/or photos in question.

And that last sentence above is perhaps their main misconception – e.g. Andy Baio was able to download 10,000 photos, including private ones, without any owner sharing their gallery URL with him… and anyone else can do the same. Don however goes on to admit that there’s a “loophole” but says that guessing specific photos is incredibly difficult, and that in fact the problem would become smaller the more photos are getting added to SmugMug. Don also goes on to admit GUIDs would help:

I’m in completely agreement, that GUIDs would help greatly here, but I’m afraid our system wasn’t built for GUIDs, and retrofitting our code and database to support GUIDs would be an extremely expensive proposition.

Don said that it’s not necessarily that they’re not willing consider doing it, but that mine is the first “request” he’s seen in years to fix this (SmugMug exists since 2002). Don also mentioned he wanted to look into other (unspecified) issues in the future but it became very clear SmugMug doesn’t consider the main issue I brought up with them currently worth fixing. Later in the mail Don said:

You are, of course, free to blog about our settings – we’re very open about them and what the tradeoffs for the various options are. In fact, if you let me know about it, I’m likely to link to it from my blog. We’re also very open to change – nearly every feature, bug fix, and enhancement is driven by customer feedback, like yours. If our customers (or potential customers) asked us to adopt GUIDs because this was a bigger issue than we were aware – we would.

[Thanks Andy, Niniane, Jason, Scott and Tony!]

Comments

But I always assumed that companies would have at least one server keeping things up, just in case Amazon went down. Or just because.

I was wrong.

Last night Mogulus’s CEO, Max Haot, was here at my house to film something fun for my show. Mogulus is the company that, yesterday, provided the live video for Om Malik’s NewTeeVee conference. It was so good I stayed home and watched almost the whole day on the NewTeeVee channel. But more on that when we get the video up.

At one point Max seemed like he was joking around with me when he told me “we don’t own a single server.”

I asked him FOUR more times to make sure I heard him right. I even got incredulous with him at one point saying something like “what the f*** do you mean you don’t own a server?” and “you mean not a single bit of your Web site comes from servers that aren’t owned by Amazon?”

He nicely and calmly explained that, yes, every server the company owns is actually running on Amazon’s S3 and EC2 services.

The world has changed. Now ANYONE can build an Internet company and get it up to scale. No more spending nights inside data centers trying to keep servers running.

Let’s go over to Mike Arrington’s CrunchBase and do some research. They pulled in $1.2 million in funding. Yet they don’t own a SINGLE server!

They have about 15,000 people already creating live video channels. They have one of the most innovative Web sites I’ve ever seen.

But they don’t own a server.

How else has the world changed? Where the hell is Microsoft in this whole business? How did Microsoft screw this up so badly? Let’s get this straight. Amazon used to be a book store. Now they are hosting virualized servers for Internet companies. So much for having billions of dollars in the bank like Microsoft does, some of the smartest people in the world working in your research arms and having “monopoly” market share in operating systems.

Heheh, maybe now Amazon can use some of the new money that they’ll be earning from these startups to buy some decent PR. According to Read/Write Web Amazon needs the help in that department.

Oh, back to Max. One tip he gave us is that when using Amazon’s services you have to design your systems with the assumption that they will never be up and running. What he means by that is services are “volatile” and can go up and down without notice. So, he’s designed his systems to survive that. He told me that it meant his engineering teams had to be quite disciplined in designing their architecture.

How many other Internet companies are out there that are “serverless?”

Comments

Plaxo Launches Social Network Pulse

Using "people feeds" users can subscribe to the people in your address book and receive the content they want to share with you from a number of sites. The list of sites that are compatible with Pulse include, Amazon, AOL Pictures, Del.icio.us, Digg, Flickr, Jaiku, Last.fm, LiveJournal, MySpace, Picasa, Pownce, Smugmug, Tumblr, Twitter, Webshots, Windows Live Spaces, Xanga, Yahoo 360, Yelp and YouTube.

The company says they have plans to add more sites that are compatible with Pulse.

"Pulse represents the natural evolution of Plaxo," said Todd Masonis, Founder and VP of Products. "It’s all about keeping you more richly connected to the people you actually know, by transforming your address book into a true social network for your real personal and professional relationships."

Pulse users can share information publicly or only with people within their network. Other features of Pulse include one-to-one connections designed for categorization of relationships into family, friends and business network. It also has a share bar for sending messages, links or videos to those in your network.

A couple of weeks ago, MacAskill cheerily offered disgruntled Flickr users a 50 percent discount off their first year with SmugMug if they wanted to try out the service. That offer came in the wake of Yahoo’s disclosure that Flickr’s “old skool” users would have to get a Yahoo ID to keep using Flickr.

They have a new story to promote, and while it is in the tradition of kind of showmanship we last saw from Moist von Lipwig in Terry Pratchett’s “Going Postal,” it is a nice little tale of kindness that builds goodwill with existing and potential customers.

A SmugMug spokesperson said New Zealand residents Naomi and Roger Smith moved to the Shelter Islands in the UK and immediately encountered an issue with their international credit card payment. So they jokingly wrote to the SmugMug Help Desk and asked if they would accept a sheep as payment.

SmugMug CEO Don MacAskill said, “Smuggy is such a studly sheep we gave them a lifetime account.” In gratitude, Smuggy received a little SmugMug makeover.

And the world is a better place for it, for a little while.

—
Tag:

Add to Del.icio.us | Digg | Reddit | Furl

Bookmark WebProNews:

Commentary on Flickr’s “old skool” forum has been less than enthusiastic about the long-anticipated changeover. Here’s a sample of those feelings:

My gender? what business in hell is it of yahoo’s whether I’m male, female or something else entirely?! not that I’m offered that last option in the form

Yuck. I hate my yahoo signin name. I really hate the inelegant design of the Yahoo sign-in page. And I hate having to keep another login name in my head.

I didn’t like it that yahoo bought flickr but I was fine with it as long as they didn’t mess with it. Well, now they have.

More prominent users have noted how the other announcement by Flickr, a limitation on the number of contacts, impacted the real active Flickr users. Thomas Hawk (CEO of Flickr competitor Zoomr) blogged about the roadblock he hit when trying to add a contact today:

I just tried to add The Searcher as a contact on Flickr. I’ve been impressed with some of his insights in forums in the past and got the following message from Flickr:

“Add The Searcher as a contact?

Slow down there buddy…

You have reached the limit for the number of contacts a user can have. To add another contact, you must first get your total number of contacts under 3,000. Right now you have 5,082 contacts.”

Limiting your most active users from further social networking on a social networking site is the most idiotic thing I’ve seen in a long time.

Flickr needs to reverse the asinine decisions made today to force people to merge their accounts with Yahoo and to place new limits on your contacts and tags.

Another Flickr competitor, SmugMug, moved to capitalize on the unpopularity of the move. SmugMug CEO Don MacAskill promptly made an offer to those users to make the switch:

You asked for it, you got it: SmugMug is offering 50% off to all Flickr refugees. Just sign up for our free trial using the coupon code flickr and if you like what you see, you’ll get 50% off your first year.

I’m afraid this is the dark side of acquisition, especially by a company that doesn’t seem to resonate with Flickr’s core passionate users. Every time someone inquires about acquiring SmugMug, we shut them down immediately because we’re terrified of exactly this happening – our user experience being damaged by a parent corporation that doesn’t “get” our customers.

Walt Mossberg thinks SmugMug is elegant. Maybe over the next few weeks MacAskill and company will be “really busy with new users” as well.

—

Add to Del.icio.us | Digg | Reddit | Furl

Bookmark WebProNews:

David Utter is a staff writer for WebProNews covering technology and business.

I’ve been considering using S3 as the backend to an on-line backup, since I’d been beating that for a while (see: Swimming Pools and Hard Disks and Cheap On-Line Storage Coming Soon).

In a few days I’ll write about how to do this–I’m only partially through the process right now. But right now I want to lay out the motivation for doing this.

The Cost of A Home Server

Amazon’s pricing model is pretty compelling. The current rate is that I’d pay $0.15/GB monthly for the data I store. Data transfer costs $0.20/GB.

My home server is a 2.4GHz Pentium 4 that contains 3 250GB SATA disks in a RAID configuration, plus an 80GB boot and OS disk. I decided to measure its power use using my Kill A Watt and found that it consumes roughly 120 watts of power with the CPU idle and disks spinning. That’s about 80 kilowatt hours every four weeks. According to PG&E’s Residential Rates, the average cost of electric power in San Jose is $0.16247 per kilowatt hour.

My home server costs me a minimum of $13 every four weeks just to leave powered on and idling, or $170 per year. That doesn’t count the roughly $700 I sunk into the disks and the other $700 I likely spent on the motherboard, CPU, case, RAM, and so on. Remember, these are absolute minimums, since the CPU does consume more power when it’s actually doing work.

So if we assume that I spent $1,400 on the server and would keep it for 5 years, that’s another $22 per month (4 weeks) of costs.

If you’re keeping score, that’s $22 + $13 = $35 every four weeks just to have backups of my stuff (most of which lives on servers in a few datacenters).

That puts the total cost for 5 years worth of backups around $2,275 assuming that no hardware breaks.

The Cost on S3

My backups require about 125GB of disk space today without compression. That’d cost me $18.75 per month to store on Amazon’s S3. Let’s further assume that I increase that by 1GB/month for the next five years (mostly photos) and transfer about 2GB every week doing backups (log files, mail, and other temporary stuff is much of that).

2GB every week is 8GB every four weeks, which costs another $1.60 every four week “month” for a total of $20.80 per year or $104 over 5 years.

Assuming that growth rate has me up to 190GB five years from now. Let’s call it 200GB. If I’m growing at a constant rate, I can use the average of 200GB and 125GB, which is 162.5GB. Multiply that by 13 “weeks” and 5 years yields $1,584.

Adding it all up, if those guesses are right and we assume that Amazon’s prices don’t fall (they certainly could in a few years), I’d end up paying $1,688.

In other words, switching to S3 could save me $587 over five years!

Other Benefits

It’s clear that going with S3 could save me money both from a reduced electric bill and not having to buy backup hardware (server and disks). But why else might I do this?

• Availability. It’s less likely that Amazon’s service will go down when compared to my home server and residential grade broadband service.
• Speed. If a remote server dies, I’d need to push all the bits there from my artificially slow DSL or Cable connection at home. Using S3 means I can restore faster.
• Simplicity. This is one less Unix box I have to spend any time administering. Even if it’s only 5 minutes every week or two, that all adds up.

Again, I’ll write up the process (tools and stuff) in a few days (or weeks).

Bookmark WebProNews:

Jeremy Zawodny is the author of the popular Jeremy Zawodny’s blog. Jeremy is part of the Yahoo search team and frequently posts in the Yahoo! Search blog as well.

Visit Jeremy’s blog: Jeremy Zawodny’s blog.