As for the security firm, I couldn’t agree more. You have to worry about those types of firms “leaking” your name and results. Working for a company that also has independent audits performed, I would like to give some words of wisdom.

Have very strict NDA’s in place.
Have your attorneys review everything to make sure they can not leak your report.
Ask them questions about how they keep their networks secure (remember your dirty laundry is now on their systems). You would be suprised…
If they can’t manage their own network, don’t think they know how to tell you to manage yours.
Get a nice exec summary that you can release to potential clients who ask for it. Think twice before publishing the executive summary online.
Confine the space they can work within. No trojans, back doors, DOS, etc.
Give them time frames when your site is not busy in case they do cause harm or impact your site.
Get references and check them.
Change your vendor every two audit cycles. This keeps it independent and nobody gets time to “relax”.

Full disclosure: I do not work for any consulting firm, nor do I have ANY financial incentive with any consulting firms.

If you want to know more about my “pains”, contact me offline and I would be happy to talk with you.

It may or may not be, but I think a lot of the reason you see it more is that Don “Fuels the fire” by responding, and actively participating in the “security hunt”. I personally view this as smugmug being MORE secure. Any company whom is willing to talk about their security measures in the open, and whom does not rely soley on security by obscurity scores security points in my book.

I just took a look at the blog section on flickr and there are no technical posts, only marketing blog posts. a quick search for ‘flickr security’ on google results in a few security risks on flickr. I can’t claim to follow flickr as closely as I follow smugmug, but my impression is that they probably have a similar number of potential flaws, but handle them differently.

Keep up the good work folks.

On a side note… If you think that anything you put on the internet is secure, think again. Somewhere, some admin has access to everything you put on the internet.. Yes, that means your bank account number, your social security number, everything. I have seen first hand the atrocious way that a number of reputable companies store your data, and its a joke. Have you ever been in the kitchen of your favorite “home style” mexican restaurant down the street?

Gordon Ramsey could do a show called “Hell’s Information Security policies”, and you’d be amazed. 95% of security measures in place on the internet are merely to keep honest people honest, and do not provide significant protection from a bad guy with enough motiviation. Don’t fool yourselves

Will this make potential customers gradually shy away from Smugmug?

I have been very pleased with SmugMug’s response to these issues. I feel that these privacy issues were important but not critical as Doug points out. If I were selling photos online, and this was business for me, then it would probably rate more on the critical level. I have had a pro account since 2005 and I don’t see any reason why I would even CONSIDER discontinuing my account for several years (4+) to come.

I’m sure there are lemmings out there who leap at the opportunity to pile upon the latest “internet wrath” bandwagon, but I just wanted to assure you that not EVERYONE is as easily swayed by these attention seekers.

I have been a loyal smugmug user for a number of years now. While I appreciate the effort towards security. Please remember, these are photo’s, not my bank account. Personally, I use smugmug for the following reasons, please don’t lose sight of this:

1) Unlimited photo’s. No questions asked. Unlimited size. unlimited photo’s.. no nickel and diming

2) fair price for above referenced benefit

3) Able to easily hot link from other sites (forums, my homepage, etc).

I’m an IT consultant, with banking industry clients… But come monday when I log on to smugmug, I just want to show my friends what I did over the weekend