It's done this way because running code to authenticate+authorize the user before serving up an image incurs a much higher performance hit than just shoveling the bits directly off a disk. Especially when those bits can come from a content delivery network.
Facebook handles a ridiculously large number of photos - probably an order of magnitude more than any other site - so this trade off, I would guess, is pretty crucial to keeping the site up.
Comments
This is for convince so people can easily share private photos. It is a usability trade-off.
hm, not quite.
It's done this way because running code to authenticate+authorize the user before serving up an image incurs a much higher performance hit than just shoveling the bits directly off a disk. Especially when those bits can come from a content delivery network.
Facebook handles a ridiculously large number of photos - probably an order of magnitude more than any other site - so this trade off, I would guess, is pretty crucial to keeping the site up.