Be Excellent To Each Other

Ok smart people, here's the deal. A clever person a few days ago made this post on the running forum about a loophole on MarathonFoto.com's website. MF are profiteering bastards that would like to charge you £35 per image taken of you during a running event, such as the London Marathon. This clever chap made everyone aware of a loophole where basically if you modified a parameter in a standard image thumbnail, you'd get the full high-res version ready to download.

Sadly, they appear to have closed this loophole, although I think it still exists. As they sell 'downloads' of images, they email buyers a link to access the image at full size online. I don't think they're clever enough to have secured this against simply modifying the URL with different picture parameters, which is why this loophole existed in the first place. In all likelihood they've just changed what the parameter is.

Short of spending £35 to buy an image download myself and inspect the latest download link to see what variables it contains, can anyone crack a way of getting at the full size versions of these crazily expensive pictures? Big prizes for the victor.

I just tried cycling the image_type variable incrementally from 'A' to 'ZZ' via a script to see if they'd just changed it to a different 1 or 2 letter combination, but no luck with that. I don't particularly want to be seen hammering their server with a recursive script that batters it with random permutations, but I'm assuming several of you are smarter than me and might have other ideas.

Not a massive deal, as I'm not personally too arsed about getting my own pictures for myself, but if it's crackable you will at the very least make a load of people on the running forum happy.

Mm. Thing is, unless these people on this forum had originally signed up for something, and are now pissed off that there was an unexpected cost - in other words, have been ripped off - then that's kind of... bad. And I don't see the problem.

You are basically asking if someone can do some light cracking, so that some bunch of freeloaders over at said running forum can steal some photos, just because they happen to be in them. At £35 or £5.

If I did some busking, and some bloke happened to film it on his camcorder whilst making a documentary, could I ask you to nick the DVD of it from Woolworths for me?

The only way without some seriously silly typing is

Though, if somebody on internet was selling pictures of me in a commercially supported race, I'd first hit the small print of the race organisers, followed by my solicitor.

Piracy != Theft FIFY, although I do tend to agree with "Live with it, they didn't suddenly jack up the price of an agreed service or anything".

I'm not personally bothered, don't get me wrong, and the vast majority of people would actually buy pictures if it wasn't such a gigantic rip-off. £35 to download ONE digital image? Had they offered me all of my pictures for £35, I might have thought about it. This is pretty much the sentiment of everyone else - it's an unfeisable rip-off.

I have a data protection issue with this company in any case, in that at no point did I ever agree to have my personal details passed on to them, and yet the Marathon organisers did so, and I'm now being spammed by email and post. There was a giant 'photograph registration' thing at the exhibition, and you were pointedly told at the time that if you didn't register 'photographs would not be taken of you and you wouldn't be able to buy them'. I didn't register, and yet magically they have all of my personal details and are trying to sell them to me anyway.


If only the pics were 6p a day

But none of you are under any obligation to buy them though. In fact, if the people on that running forum just didn't know the site existed, they'd all be happier. So, they should um, pretend and stuff.

Oh absolutely, it's hilariously ripoffage but they've got every right to run their business into the ground.

Hmm, I managed to get that thumbnail in 1000X1500px.

only because you horribly enlarged it

Well, yeah

The business plan baffles me. Sure, you'll always get people who will stump up a ridiculous amount of money, but this must be a seriously tiny proportion of the total possible sales. Seriously, if they make the prices 10% of what they were now, they'd easily sell to 10 times as many people without making any kind of loss, and they wouldn't appear like a load of cockmongers to boot.

Find someone who is linking to the image, as you describe, and examine its URL. Short of paying £35 you're likely out of luck -- you can't guess arbitrary HTTP GET params. Crappy design, then should have locked each photo up behind a GUID and maintained a database that maps from thumbnail GUID to full size GUID.