Drupal's Private Organic Groups and file attacments

Anybody used og module for Drupal knows what powerfully features this modules give users - ability to organize themselves in public groups, private groups... Private groups gives your Drupal users opportunity to share content only accessible to other group members. BUT user will be maybe tempted to think that file attachments to private group nodes are also private, and that is off course very wrong. Drupal stores files in to publicly available 'files' folder. Every node file attachment is available with next url http://drupalsite/files/somefile.txt. So although content of og private node is really private, attachments for that node are not.

Setting Drupal to use private file system would solve this issue, but also would create many problems. And use or galleries with lots of pictures on private file system have big impact on performance - because every request for picture goes through complete Drupal bootstrap process.

The right solution would be to use modules like private_upload or og_files and setting protected folders for that kind of files with .htaccess files.

For more info about this problem read here.