Forgetful Flickr

Published 18 years, 4 months past

Jeffrey wrote yesterday about some Flickr problems he’s having, and while he’s found resolution, his post brought to my forebrain some problems I’ve been having with Flickr.  So I’ll record them here.  Wooo!  Flickr pile-on!

Actually, I really only have one problem, but it manifests itself in multiple ways.  The problem is this: any photo with a privacy setting other than “Public” doesn’t ever show up in Flickr RSS feeds.

Here’s why that’s a problem, instead of a good thing:

  • If one of my contacts has marked me as a Friend, and they post a photo that’s visible only to Friends & Family, that photo does not appear in my RSS feed of photos from my friends and family.  These same pictures show up if I go to the “Photos from your Contacts” page on the Flickr site.  In the feed, they’re entirely absent.

  • If I post a photo that’s visible only to Friends & Family, any comments made on that photo do not appear in my “Comments on your photos and/or sets” feed.  So I don’t know what anyone’s saying about pictures of my wife and child unless I go to the “Recent activity on your photos” page on the Flickr site.

  • Bonus related limitation: only comments appear in my recent activity feed; things like added tags and favorite-photo designations don’t show up in the feeds either.  In fact, the feed link on the Flickr site says “Subscribe to recent activity on your photos” but the only activity shown in the feed is comments on public photos.

There may be other, even more subtle hindrances in that vein, but those are the ones that have annoyed me the most.

So why is it that stuff I want to know about—in fact, the stuff that I probably want most to know about—is only available on the actual web site, and not in the RSS feeds?  Flickr knows exactly what it can show me and what it can’t when I visit the site, but when viewed through the lens of RSS, it suddenly forgets what non-public access I’m allowed to have.  To steal a perfectly appropriate line from Jeffrey’s post:

A user experience mistake like this feels quadruply wrong precisely because user experience is what Flickr typically gets so right.

Update: it seems to be a security thing, as a few people have already commented.  I guess I understand the concern, but it’s hard for me to give it a whole lot of credit: if I were that paranoid about people seeing photos I consider truly private, I wouldn’t put them on a central server that anyone can visit in the first place.  Yes, I’ve withheld some photos from being fully public, but that privacy effort is one security breach or late-night coding goof away from total failure.  (Remember when Amazon accidentally showed the real names of reviewers instead of their account names, thus exposing some authors as having slammed books competing with their own?)  So if my personal “recent activity on your pictures” and “photos from your contacts” feeds were based on long randomly generated tokens, and not the discoverable user IDs, that would seem to be private enough—for me, anyway.  Your paranoia may vary.

Comments (13)

  1. I don’t know about you, but if I mark a photo friends or contacts only, I don’t want the rest of the world to see it. On-site authentication prevents that from happening, but as far as I know, RSS security is still an oxymoron.

    Above and beyond HTTPS authentication — which doesn’t work universally amongst RSS readers — the only other method of actually keeping a feed private is a unique, non-guessable URL. But that smacks of security through obscurity, and I’m not inclined to trust private photos and comments to a method like that.

    So, I agree with their current practice, at least in relation to RSS.

  2. As Dave has already said, RSS security isn’t particularly, well, existent. You can actually grab RSS feeds for anybody you want by checking out their ID in their Photostream feed and plugging that into the structure for the Recent Activity/Comments Made feed.

    I’ve actually appreciated that Flickr doesn’t put those into the feeds.

    Right on with the added tag thing, though. That’s something which would be nice to be able to keep a track of.

  3. This has bothered me, too, but authentication is indeed the problem, as Dave points out. A possible solution would be to allow friends & family to see a different RSS URL that contained an “unguessable” token, which is good enough security for posting photos via email (unless you’re Jeremy).

    But of course, that doesn’t address handling people who you revoke “friendship” for still being subscribed to your secret feed, so you’d need a different token for each person that could be revoked if you changed their contact status…

  4. Another solution might be separate feeds (or the same feed, for that matter) that provide a notice of private activity, letting you click through to authenticate and see whatever it is. Not quite as nice as the actual content, but better than nothing.

  5. LiveJournal already does this well. If you subscribe to an LJ feed, you get only the person”s public posts. But you can subscribe to a feed with ?auth=digest added to the URL, which requires you to supply an LJ account and password as HTTP credentials. When you poll such a feed it will contains all the items you could see if you visited the associated journal while logged into the account whose details you”ve provided.

    It”s a no-brainer, really.

  6. Pingback ::

    Meriblog: Meri Williams’ Weblog » links for 2006-06-29

    […] Eric’s Archived Thoughts: Forgetful Flickr Wouldn’t it be wonderful if just the simple desire to be able to see friend’s and families’ photos in Flickr RSS feeds stimulated the Flickr team (who we all know design shit-hot stuff) to solve the problem of secure syndication? (tags: rss flickr design webdevelopment webapplications) […]

  7. Pingback ::

    outbreak » The little bumps of the first time user (written on July 3rd, 2006 by Marko Mrdjenovic)

    […] On a side note, there seems to be a lot going on about Flickr. I haven’t really used it ever, but I’m doing it while writing this – I’ve been trying to get around to posting my pics from @media for some time now. […]

  8. One issue with using unguessable tokens in the URL is that multi-user aggregators often share feeds amongst their users in order to prevent multiple fetches of the same content. Therefore its possible that a ‘secret’ feed is presented as an option to users for whom it was never intended.

    Plus, ultimately any URL that you’re requesting once an hour and is being sent clear over the wire and logged in dozens of log files along the way is no secret at all.

  9. It would be misleading for Flickr to provide a half-baked privacy solution, so I disagree with just using randomly generated URLs as a “security through obscurity” solution.

    If you don’t really care about privacy, then wouldn’t it be sufficient to leave the photos as public, but to tag it with some kind of FamilyAndFriends tag? (Flickr could help automate the application of this tag.)

    Both your and Jeffrey’s suggestions about having private information available through an RSS feed falls into the trap of thinking of RSS as a push delivery method. With its current design, though, the RSS clients would have to support authentication (say, an HTTPS connection with your Flickr password stored in the RSS client). So it isn’t something solely under the control of Flickr to resolve.

  10. I never said that I don’t really care about privacy. I said that I understand that placing photos on a server is already a privacy risk, and using a random-token obscurity approach didn’t seem a huge additional risk. However, Drew pointed out something I hadn’t considered regarding multi-user aggregators, so I have a different point of view now.

    I’m totally happy with an https solution. Many RSS clients support username/password combinations over https connections, so it’s something Flickr could offer– in other words, the part of the problem that Flickr can resolve hasn’t been resolved, whereas the other half has been.

  11. Pingback ::

    Meriblog: Meri Williams’ Weblog » links for 2006-08-02

    […] Bloglines | News Cool — looks like Bloglines are taking on feed access control head-on, which I’m sure Eric might be pleased to here. Now we just need the Flickr guys to make the same change (tags: flickr rss privacy photos) […]

  12. Making photos private means keeping them out of public view. As a wise man recently posted: “Accept it and move on, or reject it and walk away, but don”t waste your time complaining about it.”

    I consider having my private photos kept out of RSS a feature, not a bug.

  13. Derek: Wait, so you’re telling me that this behavior a core feature of Flickr, and not just a limitation born of not having worked on authenticated RSS feeds? Because it seems very strange that photos I can see on a web page don’t show up in an RSS feed of what’s on that page. (And when the wise man posted that, he was talking about core features of a system.)

    Okay, so I get that there are extra security concerns with feeds than there are with viewing pages, but I still don’t see how that can be regarded as a “feature”. Unless it’s a feature to force users to the Flickr site every now and again, just to see if there’s something their RSS feed has failed to inform them they can see.

    Could the feed at least say that there’s a private photo available, without including said image the actual feed, so that we know when to go look?

Add Your Thoughts

Meyerweb dot com reserves the right to edit or remove any comment, especially when abusive or irrelevant to the topic at hand.

HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <em> <i> <q cite=""> <s> <strong> <pre class=""> <kbd>

if you’re satisfied with it.

Comment Preview