Private photos are shown in public RSS feeds


	Private photos are shown in public RSS feeds

Croyber

4-10-2007 4:11 PM

278 views

tags:

security, private-photos, webservices, bugs, privacy

Croyber says:

This one is old (6 months ago), but practical to be aware of, to check and verify from time to time. One should be careful when using RSS features for sensitive content. Loopholes may "sneak in" easily. RSS is initially not made with privacy in mind, so it is often necessary with extra efforts and features to secure data properly. This is also a matter of concern during upgrades, to ensure that no new or old loopholes are introduced.

Add a Comment

Login to Comment. Not a member yet? Sign up

Today's Top Clips

visit the Top Clips page

View the Top Clips from April 10, 2007

Embed This Clip In Your Site...

<div style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;"><div class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;"><div style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;" ><a href="http://clipmarks.com/clip-to-blog/" title="see clips that are hot right now"><img src="http://content.clipmarks.com/blog_embed/4830e22e-b81d-4a93-9822-45c112cea8e8/96D6BB33-326A-4F5E-A68B-20C4EA5BDAA7/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.flickr.com/forums/bugs/28681/" href="http://www.flickr.com/forums/bugs/28681/" style="font-size: 11px;">www.flickr.com</a></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://www.flickr.com/forums/bugs/28681/"><DIV>
								Photos that are marked private can inadvertently be made public in an <SPAN>RSS</SPAN> feed.</DIV></blockquote><div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://www.flickr.com/forums/bugs/28681/"><DIV>
To reproduce this bug:</DIV></blockquote><div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://www.flickr.com/forums/bugs/28681/">
1. I upload a public photo.
2. I download my public feed, along with 10,000 feed subscribers.
3. (Short while later) Oops, that's my naked girlfriend. I make the private.<BR /><DIV>
4. Even though the photo is now private, it still shows in everyone's feed because the photo is served up without checking privacy.</DIV></blockquote><div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://www.flickr.com/forums/bugs/28681/"><DIV>
It seems this bug has appeared in the past and was fixed.</DIV></blockquote><div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://www.flickr.com/forums/bugs/28681/"><DIV>
It's back. In the words of Stuart from that first thread: "we'll double-check to make sure that private photos are never included in the feed ..."</DIV></blockquote><div style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;" ><a href="http://clipmarks.com/clip-to-blog/" title="see clips that are hot right now"><img src="http://content7.clipmarks.com/images/clip-icon.gif" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.flickr.com/forums/bugs/28681/142883/" href="http://www.flickr.com/forums/bugs/28681/142883/" style="font-size: 11px;">www.flickr.com</a></div><blockquote style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;" cite="http://www.flickr.com/forums/bugs/28681/142883/"><table background="undefined" bgcolor=""><tr><TD class="Said"><H4>
							    <A href="http://www.flickr.com/photos/richardland/">Richard Cocks</A>
                                 <A title="Find out about upgrading to Pro" href="http://www.flickr.com/upgrade/"><IMG width="20" height="12" class="ProIcon" alt="Pro User" src="http://www.flickr.com/images/badge_pro.gif.v2" /></A> 
							says:</H4>
<P>
								I upload all photos as private by default then only later change to public the ones I want public, this is much safer and also lets me sort out tags, geotags etc before publishing them.
								
<SMALL>
									Posted 6 months ago. 
									( <A class="Plain" href="http://www.flickr.com/forums/bugs/28681/142883/">permalink</A>
)
									 
</SMALL>	
							</p> </TD></tr></table></blockquote></div><div style="margin: 0px 6px 6px 4px;"><table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%"><tr><td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td><td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/96D6BB33-326A-4F5E-A68B-20C4EA5BDAA7/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td></tr></table></div></div>

New from the makers of Clipmarks: Amplify.com - Don't just share the news...Amplify it!

Clipmarks: Home; New Clips; Top Clips; Dashboard

Popular Topics: News; Life; Science; Technology; Entertainment

Get Started: Sign Up; Install Clipping Tool; How Clipping Works; Clip-to-Blog™; ClipSearch

Tools and Resources: FAQ; ClipWeek; Top Clippers; Top Tags; Site Map

About Clipmarks: About Us; Contact; Copyright; Privacy; EULA

Search Options

Today's Top Clips