How do I allow safely and inexpensively allow images on my site?

Question

I have developed a social networking site for gardeners website, and am interested in giving users the ability to add images to their "tweets".

If I allow them to upload images to the actual site, it seems like this will quickly become expensive (this is a side project, not funded by anyone than myself and my own obsessions). Let's say the site becomes moderately popular, with 100K users posting one image a week, of only 250K in size. That's (100000 * .1 * 52 / 1024) = 508 MB/year in storage (and that doesn't take into account increased bandwidth). Plus I'd have to increase the server load to scale the images. I'm not sure if I should just go ahead with this, or if there are better possibilities.

Linking to other sites seems better in some ways. You do have broken links, but a larger concern for me is security: XSS.

The application is on Rails 3, using MongoDB / Mongoid as the backend, if that matters.

I'm looking for solutions such as:

• APIs that store images on external sites. What would be ideal is the ability to upload it to my site, and make an API call to store it on an external site.
• APIs (perhaps Javascript APIs) that make it easy to link to one or more external image hosting sites securely.
• Markdown or similar markup that allow linking to external images securely. I am interested in giving users the ability to format their posts in limited ways, so this might solve two problems at the same time. I notice that this is what Stack Overflow does.
• Security libraries that whitelist image URL patterns
• Advice on why I am thinking about this problem wrong. For example, maybe I should just store the images. 500MB a year is really not all that expensive, and it does allow me to create a very clean user experience.

My objectives are (in order): - Secure, both for my own site, and to not allow XSS attacks against other sites - Best possible user experience - Easy to maintain and implement

What have you done to allow user-supplied images on your site?

Answer 1

You're thinking about the problem wrong ;) or rather not at the right time.

Don't worry about the bandwidth now, when you don't have that many users yet. Concentrate on making the site user friendly and popular first. Performance, bandwidth, disk space - these are the things you'll work on when they become problems. By the time you've 100k users the cost of buying that space and bandwidth on, say, Amazon S3 may not be an issue anymore.

Answer 2

Why not using a service like Amazon s3? Is cheap, very cheap (With the Reduced Redundancy Storage), and the most important plugins like Paperclip support it out of the box...

Answer 3

You will need to look at the T&C of picture hosts (flickr etc...) and see if your usage is applicable. Flickr has an API, not sure about the others just search for HOST api.

Flickrs api is at: http://www.flickr.com/services/api/