The author needs to rid himself of using any os.system post haste. Just say no.
Personal File Backup Server
11–20 of 28 posts
Re: Personal File Backup Server
#12It looks like this doesn't work with folders... or have some kind of hash to detect alteration. While I appreciate you sharing the project, this is probably premature at this point. Here are somethings that I would consider adding: * a README (update: done! :) ) * consider making this work with virtualenv by default. This way you can install Flask as a library without making me install it for the system. Adding a sho…
Yes, this is still very premature, and more of a learning project for me. I know about no support for folders, I didn't have time to fix that yet, but I will! Virtual enviornment is interesting, I will look into that. * It does check for alterations actually then uploads the altered file, look at the main loop in the client. The way I am sending files now is awful! I plan on fixing all thos, thank you for the respons…
As soon as I clicked the source and didn't notice a binary diff being done for files I realized it was a toy/learning project, but my reaction was "Hell yeah!" anyway. Keep it up.
Re: Personal File Backup Server
#13It's such a misleading title. It's nothing like Dropbox.
We're talking about 60 lines of python for the "server" and 90 lines of python for the "client".
That's a weekend hack, not a Dropbox clone.
It happened so many times in the past, that I'm patenting a method of getting on first page of HN:
1. Write something
2. Call it a dropbox clone
3. Congratulations, apparently no-one bothers to check if that "something" does anything even remotely similar to dropbox:
- does it have a GUI client with a highly polished interface?
- does it have an installer?
- does it have conflict resolution to reconcile changes made on different computers?
- does it try to not corrupt files if download/upload fails in the middle?
- is it self-contained or do you first have to install, say, python interpeter?
Re: Personal File Backup Server
#14Should have the client use fnotify or similar.
I was thinking an appropriate solution would be watchdog:
Re: Personal File Backup Server
#15It's such a misleading title. It's nothing like Dropbox. We're talking about 60 lines of python for the "server" and 90 lines of python for the "client". That's a weekend hack, not a Dropbox clone. It happened so many times in the past, that I'm patenting a method of getting on first page of HN: 1. Write something 2. Call it a dropbox clone 3. Congratulations, apparently no-one bothers to check if that "something" do…
It's not even rsync yet alone dropbox!
Re: Personal File Backup Server
#16Maybe an option to use HTTPS?
Re: Personal File Backup Server
#17This has some fairly serious security issues, which is fine for a something not designed to be seriously used (or at all). However, the readme implies you could use this and your files will be safer than with some third party. Which is dangerous, to say the least.
I'll outline a few obvious issues I see:
- No explicit protection against directory traversal attacks (../../etc/passwd type stuff) on upload and download.
- Shell command injection on the file name on upload.
- Naive authentication. - Unsalted, fast hash sent in the URL. - Password stored in clear text server side.
- No transport security (HTTPS).
This is cool as a interesting project to work on, but it should be made clear not to use this for anything just yet.
Re: Personal File Backup Server
#18os.system("touch files/"+file)
Oops. What if my file is called " && rm -rf ~"?
Re: Personal File Backup Server
#19This has some fairly serious security issues, which is fine for a something not designed to be seriously used (or at all). However, the readme implies you could use this and your files will be safer than with some third party. Which is dangerous, to say the least. I'll outline a few obvious issues I see: - No explicit protection against directory traversal attacks (../../etc/passwd type stuff) on upload and download.…
>- Naive authentication. - Unsalted, fast hash sent in the URL. - Password stored in clear text server side.
I don't understand the point of hashing the password in the client anyway... The hash is as good as the password to an attacker.
Re: Personal File Backup Server
#20This has some fairly serious security issues, which is fine for a something not designed to be seriously used (or at all). However, the readme implies you could use this and your files will be safer than with some third party. Which is dangerous, to say the least. I'll outline a few obvious issues I see: - No explicit protection against directory traversal attacks (../../etc/passwd type stuff) on upload and download.…
>- Naive authentication. - Unsalted, fast hash sent in the URL. - Password stored in clear text server side. I don't understand the point of hashing the password in the client anyway... The hash is as good as the password to an attacker.
Sure is!
It would be possible to use a challenge response authentication scheme (http://en.wikipedia.org/wiki/Challenge%E2%80%93response_auth...) but just doing things over HTTPS is generally fine.