Download from Smugmug - Does exactly what it says on the tin

Dfects

Hey guys

I've created a small tool to download images from a smugmug account anonymously. If its password protected, you obviously need a password first. It was as a way of downloading images from a friends account who has images of a night out we've had etc.

Its not hugely robust. If it doesn't download any images, it probably means that the ID was wrong or the password, or you simply don't have access. The rest is explained on my site

Its multi-threaded now, and downloads 4 images at a time. I found this to be a good number, pretty much max's me with abusing smugmugs servers too much.

You can read more and download it from here.

I've also given a little snippet of code i used for the REST API calls, which you can use as you wish from here.

Let me know what you think of if you have any problems (if anyone actually uses it)

UPDATE: I added a poll to this thread, but please read the posts below before you make up your mind. Thanks

UPDATE: I've changed the name, as it has connotations of the negative side rather than the positive. I just thought it sounded cool

UPDATE:

Security Issues:

• For any albums, external links ("hotlinking") must be enabled. The app appears to smugmug as an external site (your pc) so it won't let you download if hotlinking is disabled.
  
  
• The albums must be public, whether they're password protected or not. If the albums private, i can't grab a list of images unless you're logged in as the owner.

The first one should cover most people who are worried about images being stolen, as surely if you wish for viewers to not steal the images, hotlinking will be disabled? I'm making a pretty big assumption here, so if not let me know

DJ-S1

no

So you created a script to make downloading lots of images from another person's account easy to do? I'm not sure how I feel about that actually.

Dfects

yes

DJ-S1 wrote:

So you created a script to make downloading lots of images from another person's account easy to do? I'm not sure how I feel about that actually.

I thought about this a lot, and i almost didn't post anything here. Yeah, there are some negatives, and there will always be people who misuse things. I made this out of a genuine need. Remember, you still control access, if its not public its not visible. If theres a password, its not accessible. You can stop people getting to original images still if it is public. Theres nothing to stop people taking the images they want via the website.

But yes i see your point, and its a concern that i share. If general concensus the same i'll take it off my server, or if you have any ideas of how to make this a little more... secure? please let me know. I'm not a bad person.

I don't want to upset anyone, I just wanted to help people who have a genuine need for something like this.

Ben

yes

sweet, I will have to give this a try. Since everyone in my family has their own accounts, our family gathering photos end up scattered all over the place. Its a pain to go get the Thanksgiving photos and make a gallery on my own site.

clap

I can see quite a few people using this to basically sync up their site with shared events.

Ben

yes

Dfects wrote:

I thought about this a lot, and i almost didn't post anything here. Yeah, there are some negatives, and there will always be people who misuse things. I made this out of a genuine need. Remember, you still control access, if its not public its not visible. If theres a password, its not accessible. You can stop people getting to original images still if it is public. Theres nothing to stop people taking the images they want via the website.

But yes i see your point, and its a concern that i share. If general concensus the same i'll take it off my server, or if you have any ideas of how to make this a little more... secure? please let me know. I'm not a bad person.

I don't want to upset anyone, I just wanted to help people who have a genuine need for something like this.

Yeah, there are a lot of beneficial uses for this. Though you might consider the branding of the app. Naming it Black Smuggler and saying it "leeches" images probably doesn't cast it in the most positive light.

Not that I can think of another good name offhand.

Dfects

yes

Ben wrote:

Yeah, there are a lot of beneficial uses for this. Though you might consider the branding of the app. Naming it Black Smuggler and saying it "leeches" images probably doesn't cast it in the most positive light.

Not that I can think of another good name offhand.

Yep I totally agree. My english is always bad, and i'm a self confessed nerd (programmer by day, and we all, or at least most, suck with wording) so a word like leech just means download to me. I've emailed smugmug, and they've helped me clean up my website a bit to play down words like that. unfortunately, although i changed the title of the thread, it doesn't show up differently in the forum

The black part was from my website, and the smuggler bit well, it sounded clever when i came up with it but not so much now. I want to allow for directory choosing, so i might rebrand the app then. any suggestions?

Dfects

yes

Maybe it would be a good idea do check for a certain string in the description of the album the user wants to download from like enablemassdownload. Then before i download anything, i can check if the string exists. If it doesn't, no downloading. It'd stop unwanted image downloading, but the only problem is it'd litter peoples descriptions with an extra word? Its a pity theres no tagging for albums.

just an idea.

ivar

Dfects wrote:

unfortunately, although i changed the title of the thread, it doesn't show up differently in the forum

fixed

denisegoldberg

no

Although I can see where this could make life easier for people attempting to share photos/files, I dislike the idea that it makes it easier for files to be stolen.

Yes, I do have originals disabled, and yes, I know that even with right click save disabled there are ways to grab the images (including from my own blog!), but I hate the idea of making it easier.

--- Denise

Allen

no

It looks like you just enter the album number to suck down photos. I can
imagine someone using a random number generator for that. At a minimum
you should have to use exactly "nickname.smugmug.com/gallery/xxxxxxx" and
not just the gallery number or "mydomain.com/gallery/xxxxxxx". This would
screen out anyone not knowing the Smug nickname.

Edit:
This would probably make a lot of pros happy. Having to know the Smug
nickname. Most use a custom domain and visiters can't see the nickname.

DJ-S1

no

Dfects wrote:

I thought about this a lot, and i almost didn't post anything here. Yeah, there are some negatives, and there will always be people who misuse things. I made this out of a genuine need. Remember, you still control access, if its not public its not visible. If theres a password, its not accessible. You can stop people getting to original images still if it is public. Theres nothing to stop people taking the images they want via the website.

But yes i see your point, and its a concern that i share. If general concensus the same i'll take it off my server, or if you have any ideas of how to make this a little more... secure? please let me know. I'm not a bad person.

I don't want to upset anyone, I just wanted to help people who have a genuine need for something like this.

I never meant to say you are a bad person! I just wanted to think about it a bit. I think that my problem is that while right now anyone can download a photo I haven't locked down, that's very different from having someone push a button and grab 600 images off my site. Currently they would have to do it image by image, which is a deterrent in itself.

Maybe all that's needed is to make a password required in some way. Like the guest login function or something. That way even if a gallery is not locked, you have to be logged in to download.

Just thinking out loud. I'm all for the cool apps guys like yourself are writing to extend the functionality of SmugMug.

Anyway, I voted "no" but if some tweak was made so it's not quite so open I'd change it to 'yes"...

Allen

no

Could the app be made to work only if you are logged in to your
own site? This would screen anyone not from the Smug community.

Dfects

yes

Thanks for your views guys. The point about just popping in a random albumid is a very good point, i'll investigate this in a minute.

I don't like the idea of making it for smugmug users only. Some of my friends don't have a smugmug account, but they'd love a copy of the photos with them in to print or show family etc. I'd be reluctant to stop that.

If anyone else has any suggestions, let me know.

Does stealing of images from smugmug happen often? I can't really see the point of stealing hundreds of images from someones account. I've heard of people stealing individual images but never mass leeching. 99% of my albums are private, just for friends and family so i'm not overly sure what goes on with other accounts.

Dfects

yes

Ok i've made a version which just takes the URL, and it needs a username and an album id in the url. Only problem is, there are no API calls that i can use to verify that an album belongs to a user, so it almost suffers from the same problem + it makes it easier for people to find someones album, and just copy and paste the url it download it, so its almost worse?

Dna

yes

Does it grab the original images if the customisation says not to ?
Or does it just grab the large etc. ?

Personally I would dislike it if it grabbed the originals from a protected gallery, although I would assume that you couldn't do that.

Andrew

devbobo

yes

Dna wrote:

Does it grab the original images if the customisation says not to ?
Or does it just grab the large etc. ?

Personally I would dislike it if it grabbed the originals from a protected gallery, although I would assume that you couldn't do that.

Andrew

Andrew,

it only gets what the album customisation allows, eg. if larges and originals are disabled only the medium size image is available.

Cheers,

David

Dna

yes

devbobo wrote:

Andrew,
it only gets what the album customisation allows, eg. if larges and originals are disabled only the medium size image is available.
Cheers,
David

Cool. Then I have no problems with the program. Feel free to download hundreds of my images with the watermark on them.

Andrew

Dfects

yes

Its kind of suprised me how people are really concentrating on the negative side of this. Surely i'm not the only one whos had photo albums with multiple people in who'd like a copy of them? Theres a lot more genuine users than people looking to steal images surely.

If anyone else has any ideas of making it more secure than let me know please

DJ-S1

no

All I can say is "guest login". It's just like I have some passworded galleries - I make the hint easy for people who know me. I don't even have to explicitly email people; if they know me, they know the password. Simple and relatively secure.

Dfects

yes

DJ-S1 wrote:

All I can say is "guest login". It's just like I have some passworded galleries - I make the hint easy for people who know me. I don't even have to explicitly email people; if they know me, they know the password. Simple and relatively secure.

Well, I've only just noticed you can't get a list of images from a private gallery unless you're logged in as the owner.

Maybe it would be best if i made it download from only public password protected albums only? most "private" photos should be password protected anyway i guess.

Dfects

yes

A further note, i've done a little more testing and it seems the following is true:

• For any albums, external links ("hotlinking") must be enabled. The app appears to smugmug as an external site (your pc) so it won't let you download if hotlinking is disabled.
  
  
• The albums must either be public, whether they're password protected or not. If the albums private, i can't grab a list of images unless you're logged in as the owner.

I think the first would cover most people who are worried about people stealing there images. If you're scared they'll steal them, surely hotlinking would be one of the first things you'd disable? Let me know what you guys think

GarethLewin

yes

Dfects wrote:

A further note, i've done a little more testing and it seems the following is true:

• For any albums, external links ("hotlinking") must be enabled. The app appears to smugmug as an external site (your pc) so it won't let you download if hotlinking is disabled.
• The albums must either be public, whether they're password protected or not. If the albums private, i can't grab a list of images unless you're logged in as the owner.

I think the first would cover most people who are worried about people stealing there images. If you're scared they'll steal them, surely hotlinking would be one of the first things you'd disable? Let me know what you guys think

I think you don't follow what worries people, to me it seems like two things worry them.

1. Even if an album is hotlink enabled, this app makes leaching the entire album easy, thus removing a potential problem for people. (Making it easier)

2. Can't someone just run your app for every possible album number and thus leach every single public image on smugmug?

Dfects

yes

GarethLewin wrote:

I think you don't follow what worries people, to me it seems like two things worry them.

1. Even if an album is hotlink enabled, this app makes leaching the entire album easy, thus removing a potential problem for people. (Making it easier)

2. Can't someone just run your app for every possible album number and thus leach every single public image on smugmug?

Yes, but can't someone go through your public galleries and steal the images they want anyway? I know it makes it slightly more conveniant, i get that. I'm trying to find some middle ground here. To be honest right now i just feel like pulling it. I'm sick of defending it. People just seem to see the negative sides, only one person has said anything good, although i know it has a useful purpose for genuine reasons.

I don't see why anyone would want to steal every image from smugmug. It makes no sense to me. Also, you'd have to sit there and manually put each URL in as well, unless someones clever enough to use something like autoit, in which case they could do what my app does anyway without it. It'd take months/years anyway. I don't exactly see that being in any way feasible. After just a few minutes of starting something like that, a new album would appear, so nobody could ever have every image either which i know is pretty imaterial.

It can't grab large/original images if they're disabled smugmug side. If watermarks are enabled, then each image will have the watermark. It can only get images you can see, when not logged in on smugmug. How useful are these images to people who steal them?

I'm at a loss. i only shared this to try and help people with a need. If the votes are still negative later, i'll take it down.

GarethLewin

yes

Dfects wrote:

Yes, but can't someone go through your public galleries and steal the images they want anyway? I know it makes it slightly more conveniant, i get that. I'm trying to find some middle ground here. To be honest right now i just feel like pulling it. I'm sick of defending it. People just seem to see the negative sides, only one person has said anything good, although i know it has a useful purpose for genuine reasons.

I don't see why anyone would want to steal every image from smugmug. It makes no sense to me. Also, you'd have to sit there and manually put each URL in as well, unless someones clever enough to use something like autoit, in which case they could do what my app does anyway without it. It'd take months/years anyway. I don't exactly see that being in any way feasible. After just a few minutes of starting something like that, a new album would appear, so nobody could ever have every image either which i know is pretty imaterial.

It can't grab large/original images if they're disabled smugmug side. If watermarks are enabled, then each image will have the watermark. It can only get images you can see, when not logged in on smugmug. How useful are these images to people who steal them?

I'm at a loss. i only shared this to try and help people with a need. If the votes are still negative later, i'll take it down.

Sorry, I didn't mean to sound negative. For the record I voted for your app in the poll.

I was just trying to explain what was bothering people.

rich56k

no

Dfects wrote:

A further note, i've done a little more testing and it seems the following is true:

• For any albums, external links ("hotlinking") must be enabled. The app appears to smugmug as an external site (your pc) so it won't let you download if hotlinking is disabled.
  
  
• The albums must either be public, whether they're password protected or not. If the albums private, i can't grab a list of images unless you're logged in as the owner.

I think the first would cover most people who are worried about people stealing there images. If you're scared they'll steal them, surely hotlinking would be one of the first things you'd disable? Let me know what you guys think

Will this work on PowerPC / G5 iMacs??

And as long as it's unable to touch my images that are not 'external linking
allowed' whats the harm ?....(I wouldn't even consider allowing 'ext links' - but thats me / .02)

rich56k
will vote after your response...

Dfects

yes

rich56k wrote:

Will this work on PowerPC / G5 iMacs??

And as long as it's unable to touch my images that are not 'external linking
allowed' whats the harm ?....(I wouldn't even consider allowing 'ext links' - but thats me / .02)

rich56k
will vote after your response...

At the moment, its written using the .Net framework, so unfortunately theres no mac support, only windows. I built it for speed, and creating GUI's in visual studio is the quickest method i've found.

If theres interest, i'd be happy to look into switching to mono so i can build it cross platform. I'd also love to build some good tools for unix systems too. The only problem is the time it'll take for me to figure out how to build gui apps cross platform, i do after all work a full time job

The only other option is for me to build it in java, but i can't stand java apps

rich56k

no

Dfects wrote:

At the moment, its written using the .Net framework, so unfortunately theres no mac support, only windows. I built it for speed, and creating GUI's in visual studio is the quickest method i've found.

If theres interest, i'd be happy to look into switching to mono so i can build it cross platform. I'd also love to build some good tools for unix systems too. The only problem is the time it'll take for me to figure out how to build gui apps cross platform, i do after all work a full time job

The only other option is for me to build it in java, but i can't stand java apps

Thanks for the reply...
I've have cast my vote....