Hacker News Reader

Never expect things you upload to the internet to be private. There are so many vectors where this can go wrong. The host might list directory indexes, s3 buckets can be open, sites can be hacked, etc etc.

You did see the part where I said "semi-" private? I'm just suggesting OP might want to harden the URLs, otherwise the URLs might as well be /1 /2 /3.

well there is the filename in there, so you could give your files really long names

Op here. The urls are randomly generated combined with the chosen filename, I assume this should be safe enough. Links will expire in 2 weeks. Working on functionality where you can configure the lifetime. Eg, just 1 download or 2 days.

OP, I'm not an expert but I think you need to introduce more entropy to prevent opportunistic crawling of every possible URL.