61–70 of 77 posts
I made this once pomf.se went down: https://github.com/SirCmpwn/sr.ht pomf.se was my replacement after my own hosting service, MediaCrush, went down.
I've been searching for a pomf.se replacement for some time now, so this is great! Can I request an account?
YouTransfer is a simple but elegant self-hosted file transfer & sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files. Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to comb…
If you're familiar with that project, could you comment on the main differences in YouTransfer?
YouTransfer is a simple but elegant self-hosted file transfer & sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files. Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to comb…
Sounds fairly similar to bradfitz's Camlistore ( https://camlistore.org/ ). If you're familiar with that project, could you comment on the main differences in YouTransfer?
YouTransfer is basically a very simple hit & run file sharing application. The goal is to make uploading & sharing files a matter of 2-3 clicks. The files will be stored with a configurable retention time and will be deleted from the server after they expire.
YouTransfer it's not meant to help you organise your digital life, or have access to all your files remotely. It will only help you share files in a more convenient way compared to SFTP or email.
[1] XSS Example: http://demo.youtransfer.io/download/%3Cscript%3Ealert(%27xss...
You might want to fix the XSS [1] on the page and prevent the path traversal (try typing ../config in download input) [1] XSS Example: http://demo.youtransfer.io/download/%3Cscript%3Ealert(%27xss...
I've created two issues on GitHub (https://github.com/remie/YouTransfer/issues/107, https://github.com/remie/YouTransfer/issues/108) which will be fixed in a new hotfix release asap.
Earlier quoted context omitted.
Thanks for scrutinising the codebase! You are absolutely right that there is no need for creating a hash. This was just plain laziness on my part. I've created an issue ( https://github.com/remie/YouTransfer/issues/101 ) to change the token generation.
Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.
Actually, HMAC-MD5 is secure.
Earlier quoted context omitted.
Do you ask for that with the awareness that gravatar then gets to track your presence around the internet for the cost of a tiny picture? I would rather have less ad tracking pixels on someone elses websites if possible, but I am genuinely interested in the value that gravatar provides to people who like the service.
There's a lot of things that can track presence around the web and gravatar's not one of them. Iff you decide to implement gravatar without mirroring their images, avatars are indeed loaded on their first query (and not subsequent ones) and, god knows what they're doing with that information ohgod . They certainly can't "track my presence around the web", though - no js means no fingerprinting, no tracking cookie, no…
I would rather external actors (say gravatar does nothing wrong) not be able to identify which email address I use on a site they do not own, and not be able to track my user signups by something that might be public information, which generally a site does not advertise.
It just feels wrong.
If I read it correctly, this is how a file token is generated, which is supposed to be secure: file.id = md5(file.name + (Math.random() * 1000)); First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandom…
I'd use a uuid
6. Security Considerations
Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example. A predictable random number source will exacerbate the situation.
Do not assume that it is easy to determine if a UUID has been slightly transposed in order to redirect a reference to another object. Humans do not have the ability to easily check the integrity of a UUID by simply glancing at it.
Distributed applications generating UUIDs at a variety of hosts must be willing to rely on the random number source at all hosts. If this is not feasible, the namespace variant should be used.
Earlier quoted context omitted.
Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.
MD5 is is broken and should not be used for anything anymore. Actually, HMAC-MD5 is secure.
Yes, there aren't any known attacks right now, but since MD5 itself already has practical collision attacks against it, there isn't any good reason to use HMAC-MD5 in a new cryptosystem when there are better alternatives.
---
Supporting evidence: new versions of OpenSSHD do not use HMAC-MD5 by default anymore: it has to be enabled manually.
The default is:
umac-64-etm@openssh.com,umac-128-etm@openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,
hmac-sha2-256,hmac-sha2-512
Earlier quoted context omitted.
Good on you for taking the criticism well. This doesn't seem like a "create an issue on github" problem though. Surely it is a push a patch today problem?
Working on it as we speak! I'm currently running the tests and hope to have a 1.0.2 hotfix ready by lunch. EDIT: The 1.0.2 hotfix is now available with the token generation fix as well as 2 other enhancements.