Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I built a website to share files and messages without any server

neighbor-share.vercel.app

Post reply on HN
Print view View original

71–80 of 112 posts

Re: Show HN: I built a website to share files and messages without any server

#71

Post by supportengineer »

jfoster wrote: post #15
ramchip wrote: post #11

> without involvement of any server > bypassing the need for centralized servers I don't follow this part... it's using a centralized server to serve the web app, which could easily serve JS code that steals confidential data right?

That is true, but unless you develop an application yourself, it is always coming from somewhere else. Web apps are better than native apps from a security perspective. Browsers have fairly decent built-in debugging tools that you could use to verify that data isn't being uploaded to a 3rd party. On the other hand, to do the same with a native application you would need to use a separate network protocol analyzer app…

Who is going to tell them. Your browser is a native app.

Re: Show HN: I built a website to share files and messages without any server

#72

Post by supportengineer »

dkraj wrote: post #39
ramchip wrote: post #38

Earlier quoted context omitted.

I mean the data people send through the app. You say: > It is a p2p files and messages sharing platform without involvement of any server. It has end-to-end encryption, ensuring your messages and files remain confidential. However the clients get the JS code from the web server. Since you control that server, you can change the code to disable the encryption, or send a copy of the messages somewhere else. You can eve…

Got you so you want to say that the place where I have hosted is a centralised place and yes you are right. But I won't do that ~~~

Sure “you” won’t do that. But who are you? What if “you” changes? “You” could be the CIA or a Nigerian scammer. Nobody knows. And it can change at any moment.

Re: Show HN: I built a website to share files and messages without any server

#73

Post by roeles »

cynicalsecurity wrote: post #57
James_K wrote: post #5

How can this work without a a server? You surely need a third party to traverse NAT.

If at least one party is behind NAT, it's a dead end. I wouldn't trust anyone who makes a false claim it's possible.

Please Google udp hole punching

Re: Show HN: I built a website to share files and messages without any server

#74

Post by wickedsickeune »

roeles wrote: post #73
cynicalsecurity wrote: post #57

Earlier quoted context omitted.

If at least one party is behind NAT, it's a dead end. I wouldn't trust anyone who makes a false claim it's possible.

Please Google udp hole punching

In order to do hole punching you need a centralised STUN server.

Re: Show HN: I built a website to share files and messages without any server

#75

Post by wickedsickeune »

matheusmoreira wrote: post #68
aster0id wrote: post #54

Obligatory callout to the excellent server-free CLI file transfer tool magic wormhole which is open source and battle tested

> This program uses two servers > the mailbox server, and the transit relay. The dream of the P2P internet died with NAT.

I hoped that it would relive with IPv6 but apparently this will not happen while I'm alive.

Re: Show HN: I built a website to share files and messages without any server

#76

Post by NayamAmarshe »

Renaud wrote: post #52
I_o_IllI__o_I wrote: post #19

Earlier quoted context omitted.

I use Telegram for that. Also good for taking notes or reminders for yourself without having to use a separate app.

Are messages to self even safe on Telegram? Secret chats don’t work between the desktop client and the app, so I would suspect that, like the rest of the messages, everything is saved on telegram’s servers in the clear. Or am I missing something?

Telegram has cloud encryption via MTProto 2.0. The servers use a distributed key generation mechanism.

Re: Show HN: I built a website to share files and messages without any server

#78

Post by eviks »

realusername wrote: post #69
ramchip wrote: post #37

Earlier quoted context omitted.

You have to trust the original developers either way, but the distribution mechanism is much weaker for a web app. The server / hosting platform can be compromised, the code can change at any time and even depend on the client that's connecting, and there's no software signing providing non-repudiation. Not saying native apps are universally better, but I do think their treat model tends to be a better match for encr…

The signature doesn't mean much on the mobile store though, Apple and Google could modify anything they want, resign it and push a new app. With the web you have to trust the app developer and with mobile you have to trust the app developer plus Google or Apple on top of that. Fdroid is maybe the only exception to that.

With web you have to trust the developer on every visit of the website. With mobile you can pin the trust (with some effort) to a single point in time, big positive difference

Re: Show HN: I built a website to share files and messages without any server

#79

Post by llmblockchain »

vmfunction wrote: post #3
Vinnl wrote: post #2

A bit off-topic, but since I was looking at doing a side project with a P2P feature, would appreciate if I could pick your brain for a bit: don't you still need to run the STUN and TURN servers? Can you run those using Vercel's serverless functions?

look at https://peerjs.com that this the project is using.

I used peerjs years ago (2013~). It was a whole lot of pain back then... I assume things have gotten better, but damn was it painful! I ended up forking and fixing/maintaining my own fork because it was too slow to get things fixed in master.
Post reply on HN