Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I built a website to share files and messages without any server

neighbor-share.vercel.app

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Show HN: I built a website to share files and messages without any server

#91

Post by jimbobthrowawy »

INTPenis wrote: post #27
jimbobthrowawy wrote: post #22

Earlier quoted context omitted.

What is the Gnome equivalent? If you mean GSconnect, that's an implementation of kde connect. I think kde connect has some CLI tools, but they're not super ergonomic. For CLI stuff, I usually just run the python http server or woof and make a QR code with the URL.

What about sharing from your phone to your laptop?

Personally, I use pairdrop for that. Though, if I'm limited to CLI, woof has an upload option (-U) allowing me to select a file from the phone. Don't know of an easy way to do that from the builtin http.server.

Re: Show HN: I built a website to share files and messages without any server

#92

Post by ramchip »

realusername wrote: post #69
ramchip wrote: post #37

Earlier quoted context omitted.

You have to trust the original developers either way, but the distribution mechanism is much weaker for a web app. The server / hosting platform can be compromised, the code can change at any time and even depend on the client that's connecting, and there's no software signing providing non-repudiation. Not saying native apps are universally better, but I do think their treat model tends to be a better match for encr…

The signature doesn't mean much on the mobile store though, Apple and Google could modify anything they want, resign it and push a new app. With the web you have to trust the app developer and with mobile you have to trust the app developer plus Google or Apple on top of that. Fdroid is maybe the only exception to that.

> With the web you have to trust the app developer

The linked comment goes into it, but you have to trust the web hosting platform, the CA ecosystem, etc. We're talking not just Apple/Google being able to attack you, but also China, and even some script kiddie with a Node.js exploit.

> with mobile you have to trust the app developer plus Google or Apple on top of that.

The OS/browser vendor can record what you're doing with a web app just as easily as a native app. Thankfully they have very strong incentives not to do so, and can usually be held accountable with code signatures (the non-repudiation part).

Re: Show HN: I built a website to share files and messages without any server

#93

Post by ranger_danger »

Toorkit wrote: post #43
INTPenis wrote: post #14

Earlier quoted context omitted.

No, I did try the Gnome equivalent a long time ago but these days I use a more minimal setup. So I'd prefer a CLI tool.

KDEConnect can be used from the CLI :) kdeconnect-cli --share [url|path/to/file] --device [device_id]

I really want to like kdeconnect because when it does work, it works well, but in my experience it just has way too many bugs and seems to randomly stop working for unknown reasons.

Re: Show HN: I built a website to share files and messages without any server

#94

Post by ranger_danger »

huhtenberg wrote: post #10
NayamAmarshe wrote: post #6

Looks good but any plans to make it open source? Similar open source solutions exist like: - https://pairdrop.net/ - https://wormhole.app/ - https://www.snapdrop.net/ How does this compare?

Non-open source - https://file.pizza/

It is though? https://github.com/kern/filepizza

Re: Show HN: I built a website to share files and messages without any server

#95

Post by eviks »

realusername wrote: post #86
eviks wrote: post #78

Earlier quoted context omitted.

With web you have to trust the developer on every visit of the website. With mobile you can pin the trust (with some effort) to a single point in time, big positive difference

I'm not aware of any major mobile platform which works like that though, maybe in theory it could be done but in practice it's all powers to the manufacturer which can modify or remove your apps at any time silently. Unless maybe you are on some things like GrapheneOS and only install apps though fdroid, that's not really a mainstream configuration though.

How can they modify the app on your device silently?

Re: Show HN: I built a website to share files and messages without any server

#96

Post by NayamAmarshe »

ffpip wrote: post #87
NayamAmarshe wrote: post #50

Earlier quoted context omitted.

Telegram has cloud encryption via MTProto 2.0. The servers use a distributed key generation mechanism.

Cloud encryption is just HTTPs + encryption at rest (only claimed, not verified). They hold the keys, irrespective of how many proprietary protocols they wrap over the message. A great product tho! I used saved messages extensively!

> Cloud encryption is just HTTPs + encryption at rest

Not just plain-old HTTPs. MTProto 2.0 is a whole encryption algorithm for Cloud chats: https://core.telegram.org/mtproto/AJiEAwIYFoAsBGJBjZwYoQIwFM...

Re: Show HN: I built a website to share files and messages without any server

#97

Post by realusername »

eviks wrote: post #95
realusername wrote: post #86

Earlier quoted context omitted.

I'm not aware of any major mobile platform which works like that though, maybe in theory it could be done but in practice it's all powers to the manufacturer which can modify or remove your apps at any time silently. Unless maybe you are on some things like GrapheneOS and only install apps though fdroid, that's not really a mainstream configuration though.

How can they modify the app on your device silently?

They have system access and can push anything on your device. In the past you could have an actual developer signature on the play store but Google got rid of it, on iOS there's never been any support at all of this kind of security.

Fdroid supports that but you need a modified rom so that the play store cannot interfere with it in any way. To my knowledge, only GrapheneOS does that.

Re: Show HN: I built a website to share files and messages without any server

#98

Post by realusername »

ramchip wrote: post #92
realusername wrote: post #69

Earlier quoted context omitted.

The signature doesn't mean much on the mobile store though, Apple and Google could modify anything they want, resign it and push a new app. With the web you have to trust the app developer and with mobile you have to trust the app developer plus Google or Apple on top of that. Fdroid is maybe the only exception to that.

> With the web you have to trust the app developer The linked comment goes into it, but you have to trust the web hosting platform, the CA ecosystem, etc. We're talking not just Apple/Google being able to attack you, but also China, and even some script kiddie with a Node.js exploit. > with mobile you have to trust the app developer plus Google or Apple on top of that. The OS/browser vendor can record what you're doi…

There's much much better transparency mechanisms on the CA system than Apple or Google though. While a CA attack is possible and does happen sometimes, the attacker pretty much burns the CA in the process.

For starters, there's not even automated reports of app signatures on mobile and no transparency authority at all.

Re: Show HN: I built a website to share files and messages without any server

#99

Post by eviks »

realusername wrote: post #97
eviks wrote: post #95

Earlier quoted context omitted.

How can they modify the app on your device silently?

They have system access and can push anything on your device. In the past you could have an actual developer signature on the play store but Google got rid of it, on iOS there's never been any support at all of this kind of security. Fdroid supports that but you need a modified rom so that the play store cannot interfere with it in any way. To my knowledge, only GrapheneOS does that.

Your explanation confuses the store with the device .Yes, at the time of download from the store you trust two parties, but that's still only "a single point in time"

Re: Show HN: I built a website to share files and messages without any server

#100

Post by realusername »

eviks wrote: post #99
realusername wrote: post #97

Earlier quoted context omitted.

They have system access and can push anything on your device. In the past you could have an actual developer signature on the play store but Google got rid of it, on iOS there's never been any support at all of this kind of security. Fdroid supports that but you need a modified rom so that the play store cannot interfere with it in any way. To my knowledge, only GrapheneOS does that.

Your explanation confuses the store with the device .Yes, at the time of download from the store you trust two parties, but that's still only "a single point in time"

No it's anytime you use your device. The stores can push silent updates and change your apps or access anything at any point.

The only exception I'm aware of is GrapheneOS where that's not possible. Otherwise if you are using iOS or any other Android rom than GrapheneOS, you are vulnerable to that.

Post reply on HN