17

stack.imgur.com was created to avoid link rotting of images.

Images not uploaded with an Imgur Pro account may be kept for only at least six months unless there is one view of that image per six months.

Inferring from the Stack Exchange blog and Imgur's upgrade page,

  • images at i.stack.imgur.com should be kept forever regardless of views while
  • images at i.imgur.com that were not uploaded with a pro account may be deleted due to inactivity.

This means that anyone can upload to stack.imgur.com through the image upload button (CtrlG) and keep images there forever unless they are reported or discovered to be unconnected to Stack Exchange and deleted.

My questions are:

  1. Is this behavior expected?
  2. Does it not matter to Stack Exchange and Imgur?
  3. Is there already an active process keeping irrelevant i.stack.imgur.com images out of Imgur?
Improve this question
7
  • 1
    This also leads to a very bad first user experience if someone wants to add an image to their first post. They'll be able to upload it, and only after they submit the post be notified that they actually aren't allowed to post images (I've requested that to be changed previously). There is no reason for 1-rep users to be able to upload images.
    – Mad Scientist
    Commented Jun 21, 2012 at 6:15
  • 1
    As an aside: given the data dump and all, it would not be too nice to require some HTTP REFERER to view the images. It might be used for discovering abuse though.
    – Arjan
    Commented Jun 21, 2012 at 6:16
  • 1
    Good point, since uploading to that account requires Stack Exchange account as well I already suggested to associate the uploaded images with that account and this way images can be tracked down to who uploaded them through the URL.
    – Shadow Wizard
    Commented Jun 21, 2012 at 6:45
  • That sounds like an awful lot of work. Anyhow, it's Stack Exchange's pro account to do as they like with.
    – nhinkle
    Commented Jun 21, 2012 at 6:50
  • Note that you can't use the imgur upload without knowing your StackExchange.options.user.fkey. Which changes from page to page and user to user. I have already written a (legitimate) script that hijacks the upload (it's basically an enhancement to the upload dialog), but it only works on SE sites--there's no way for me to get the fkey otherwise. So you can't hijack the upload to use for your site. You still can upload via the WMD dialog, though.
    – Manishearth
    Commented Jun 21, 2012 at 7:02
  • 1
    Since February 2015, all Imgur accounts are Pro. So I guess the question is moot now?
    – Arjan
    Commented Aug 5, 2015 at 23:25
  • 2
    @Arjan Pretty much. I updated the question with Wayback Machine links.
    – Deltik
    Commented Aug 6, 2015 at 1:43

1 Answer 1

Reset to default
30

1. Is this behavior expected?

Expected as in "You should do this" – obviously not. Expected as in "we know it's possible" – yes.

2. Does it not matter to Stack Exchange and Imgur?

It's pretty much impossible to prevent this 100%, at least up front.

However, hijacking our Imgur account poses a risk for the uploader: If they use their own regular Imgur account to upload images, they retain control over the image, and the one-hit-per-six-month threshold is trivially held for someone wanting to prevent deletion.

If, on the other hand, they use ours, that means they totally relinquish control of the image file, including the possibility to prevent deletion. If we decide to go delete an image that has never appeared in a post or chat message, they can hardly make an argument against us removing it. And they actually won't know until it's too late.

3. Is there already an active process keeping irrelevant i.stack.imgur.com images out of Imgur?

If you want to know whether we're regularly deleting images from there currently – no, not that I know of. We're monitoring our Imgur bandwidth though, so if you plan to hijack us to create a life-long image uploading service, we may notice, so think again :)

It's obviously easy for us to query for the information "Which images were ever legitimately used", and Imgur has an easy-to-use API. In other words, if we become aware of larger scale abuse, or one of us has a few free cycles and wants to do this as a side project, or a newly hired programmer needs a "prove themselves" kind of project, or whatnot – then we're talking about a fairly limited amount of dev work that would be necessary to do some house cleaning in our Imgur account, and suddenly your images are gone.

So the most important part in preventing abuse here is actually the common sense of the potential abuser.

Improve this answer
2
  • 2
    While there's probably not much to worry about this in terms of being exploited, why isn't uploading to imgur linked to the "new user restrictions" privilege. Users below 10 rep can upload images, but they can't post them. I think that might be somewhat confusing to new users.
    – Mad Scientist
    Commented Jun 21, 2012 at 7:09
  • What if people upload images to down-voted questions that get cleaned up, and no one even knows where those image links are?
    – ghosts_in_the_code
    Commented Mar 23, 2015 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .