Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: YouTransfer – Self-hosted file sharing

youtransfer.io

Post reply on HN
Print view View original

1–10 of 77 posts

Re: Show HN: YouTransfer – Self-hosted file sharing

#2

Post by rbolte »

YouTransfer is a simple but elegant self-hosted file transfer & sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files.

Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to combine ease-to-use file transfer tooling with security and control.

You can watch a live demo at http://demo.youtransfer.io

If you want to see it in action on your own environment, you can use the Docker image (https://hub.docker.com/r/remie/youtransfer/) or NPM package (https://www.npmjs.com/package/youtransfer)

Re: Show HN: YouTransfer – Self-hosted file sharing

#3

Post by dchest »

If I read it correctly, this is how a file token is generated, which is supposed to be secure:

     file.id = md5(file.name + (Math.random() * 1000));
First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandomValues in browsers.

PS And multiplication by 1000... is it just for fun?

Re: Show HN: YouTransfer – Self-hosted file sharing

#4

Post by rbolte »

dchest wrote: post #3

If I read it correctly, this is how a file token is generated, which is supposed to be secure: file.id = md5(file.name + (Math.random() * 1000)); First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandom…

Thanks for scrutinising the codebase! You are absolutely right that there is no need for creating a hash. This was just plain laziness on my part. I've created an issue (https://github.com/remie/YouTransfer/issues/101) to change the token generation.

Re: Show HN: YouTransfer – Self-hosted file sharing

#5

Post by asadhaider »

rbolte wrote: post #2

YouTransfer is a simple but elegant self-hosted file transfer & sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files. Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to comb…

There really needs to be a link to a demo on the project homepage or README file. The description says it's "simple but elegant", however I couldn't find a link to see it in action until I came to the HN comments to say so.

Edit: Sorry, just saw the Demo wiki page now. But a link on the homepage wouldn't hurt as it's what most people would want to see.

Re: Show HN: YouTransfer – Self-hosted file sharing

#6

Post by Animats »

The amount of of infrastructure you have to deploy to use this seems excessive.[1] You need NGrok (a commercial service) to get through NAT. You need Docker to install. You need Heroku, Microsoft Azure, Amazon AWS or Google Cloud to host. Then you need a reverse proxy, HAProxy, Nginx or Apache Httpd, for some reason.

How many sysadmins does it take to screw this in?

[1] https://github.com/remie/YouTransfer/wiki/hosting

Re: Show HN: YouTransfer – Self-hosted file sharing

#7

Post by rbolte »

asadhaider wrote: post #5
rbolte wrote: post #2

YouTransfer is a simple but elegant self-hosted file transfer & sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files. Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to comb…

There really needs to be a link to a demo on the project homepage or README file. The description says it's "simple but elegant", however I couldn't find a link to see it in action until I came to the HN comments to say so. Edit: Sorry, just saw the Demo wiki page now. But a link on the homepage wouldn't hurt as it's what most people would want to see.

You're right! I was actually still working on the demo and am a bit overwhelmed by the attention generated by the HN show case. I've update the README and website, thanks!

Re: Show HN: YouTransfer – Self-hosted file sharing

#8

Post by rbolte »

Animats wrote: post #6

The amount of of infrastructure you have to deploy to use this seems excessive.[1] You need NGrok (a commercial service) to get through NAT. You need Docker to install. You need Heroku, Microsoft Azure, Amazon AWS or Google Cloud to host. Then you need a reverse proxy, HAProxy, Nginx or Apache Httpd, for some reason. How many sysadmins does it take to screw this in? [1] https://github.com/remie/YouTransfer/wiki/hosti…

Actually... you don't need any of those. It's only a suggestion. You can also install NodeJS, download YouTransfer, set the port to 80 and run it.

However, it is highly recommended to either use Docker, a reverse proxy, any of the PaaS providers or a combination of the above.

EDIT: I've updated the wiki with additional information on running it locally.

Re: Show HN: YouTransfer – Self-hosted file sharing

#9

Post by detaro »

Animats wrote: post #6

The amount of of infrastructure you have to deploy to use this seems excessive.[1] You need NGrok (a commercial service) to get through NAT. You need Docker to install. You need Heroku, Microsoft Azure, Amazon AWS or Google Cloud to host. Then you need a reverse proxy, HAProxy, Nginx or Apache Httpd, for some reason. How many sysadmins does it take to screw this in? [1] https://github.com/remie/YouTransfer/wiki/hosti…

I think those are supposed to be alternate options, depending on where and how you want to run it.

Re: Show HN: YouTransfer – Self-hosted file sharing

#10

Post by tokenizerrr »

rbolte wrote: post #4
dchest wrote: post #3

If I read it correctly, this is how a file token is generated, which is supposed to be secure: file.id = md5(file.name + (Math.random() * 1000)); First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandom…

Thanks for scrutinising the codebase! You are absolutely right that there is no need for creating a hash. This was just plain laziness on my part. I've created an issue ( https://github.com/remie/YouTransfer/issues/101 ) to change the token generation.

Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.
Post reply on HN