Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fine Uploader is shutting down

github.com

Post reply on HN
Print view View original

11–20 of 63 posts

Re: Fine Uploader is shutting down

#11

Post by mr_puzzled »

Somewhat related : are there any guides/tutorials about how to do secure file uploads in webapps and how to avoid obvious security pitfalls?

Reading the Django docs https://docs.djangoproject.com/en/2.1/topics/security/#user-... , specifically,

>Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. Specifically, an HTML file can be uploaded as an image if that file contains a valid PNG header followed by malicious HTML. This file will pass verification of the library that Django uses for ImageField image processing (Pillow). When this file is subsequently displayed to a user, it may be displayed as HTML depending on the type and configuration of your web server.

is a little concerning. They recommend serving images from a different domain and whitelist file types. Is that enough? Anything else needs to be done to improve security? Does handling uploads alone give attackers an RCE oppurtunity or is it safe to handle files in the server and then upload to aws s3?

Re: Fine Uploader is shutting down

#12

Post by hyperpape »

mr_puzzled wrote: post #11

Somewhat related : are there any guides/tutorials about how to do secure file uploads in webapps and how to avoid obvious security pitfalls? Reading the Django docs https://docs.djangoproject.com/en/2.1/topics/security/#user-... , specifically, >Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. Specifically, an HTML file can be uplo…

Here’s a start: https://mobile.twitter.com/olemoudi/status/10239768976618700...

Re: Fine Uploader is shutting down

#13

Post by sct202 »

ravenstine wrote: post #5
NetOpWibby wrote: post #2

The sense of entitlement people have of open-source projects is ridiculous, ESPECIALLY if they haven’t contributed to it.

I couldn't agree more. However, couldn't this project have been handed off to new owners or simply left dormant rather than be archived? I guess it can be forked, but the upgrade path for existing users would be less clear.

Judging by the github contributors page there were really only 2 major contributors (including the author), so slim pickings to find a new leader.

Re: Fine Uploader is shutting down

#14

Post by mr_puzzled »

hyperpape wrote: post #12
mr_puzzled wrote: post #11

Somewhat related : are there any guides/tutorials about how to do secure file uploads in webapps and how to avoid obvious security pitfalls? Reading the Django docs https://docs.djangoproject.com/en/2.1/topics/security/#user-... , specifically, >Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. Specifically, an HTML file can be uplo…

Here’s a start: https://mobile.twitter.com/olemoudi/status/10239768976618700...

Thanks for that, great read.

I think for my use case going with s3 will be easier and better for security. So how do I actually do it? Let users directly upload to s3 and have a lambda function call my server to store the url? If the image file is maliciously crafted, how does using s3 help, especially when serving the content? How can I set the headers when serving images from s3? And is there a way to identify that a specific user uploaded this file, so that I can have rate limiting? Is it possible to generate a signature or something to identify a user that I can decode server side to say "ok, this user uploaded the file and he is who he says he is". Maybe sign using the cookie that django sets for each user?

Re: Fine Uploader is shutting down

#15

Post by PetahNZ »

mr_puzzled wrote: post #14
hyperpape wrote: post #12

Earlier quoted context omitted.

Here’s a start: https://mobile.twitter.com/olemoudi/status/10239768976618700...

Thanks for that, great read. I think for my use case going with s3 will be easier and better for security. So how do I actually do it? Let users directly upload to s3 and have a lambda function call my server to store the url? If the image file is maliciously crafted, how does using s3 help, especially when serving the content? How can I set the headers when serving images from s3? And is there a way to identify that…

There is a few options, such as using AWS Cognito, or signed requests. I personally use signed requests which allows you to specify where and what type of files are allowed to be uploaded. First the user asks my server for a policy and signature, then uploads directly to S3, then sends another request to my server when done. My server will then verify and process uploaded files.

Likewise requests can also be signed so you can implement rate limiting on you side, and just allow S3 to serve the payload. Or you can do thing like use Cloudfront to server the objects which can use various methods of authentication such as signed cookies, or Lambda functions.

Headers can be set in the S3 object metadata.

Re: Fine Uploader is shutting down

#16

Post by bluetwo »

ravenstine wrote: post #9
BoorishBears wrote: post #4

At the risk of sounding uncaring or such... Ok? I mean I don't get why the owner didn't try to find someone else to graciously take the reins without a fork (maybe they tried and couldn't find anyone?), but I don't get the dramatic post and very "taking my ball and going home" tone I'm getting. Again, maybe it's just me looking to wrongly but when 4 out of 6 reasons are referring to yourself and not the project... Th…

Why even bother being on Twitter? I keep hearing developers encouraging each other to be active on Twitter, but who gives an actual fuck what goes on with Twitter? All it seems to do is generate drama on every front. Do developers(or anyone) really need to be on there? If I were the owner, I would have just closed my Twitter account in the face of demanding freeloaders.

Who, indeed.

Re: Fine Uploader is shutting down

#17

Post by Hello71 »

ravenstine wrote: post #5
NetOpWibby wrote: post #2

The sense of entitlement people have of open-source projects is ridiculous, ESPECIALLY if they haven’t contributed to it.

I couldn't agree more. However, couldn't this project have been handed off to new owners or simply left dormant rather than be archived? I guess it can be forked, but the upgrade path for existing users would be less clear.

https://github.com/FineUploader/fine-uploader/issues/1881 was open for more than a year. There were some proposals, but I assume that all of them imposed conditions that the author considered unacceptable.

For such a large project, there is no such thing as dormant, only rotting. Archiving makes this status clear to potential users.

Re: Fine Uploader is shutting down

#18

Post by mjevans »

mr_puzzled wrote: post #11

Somewhat related : are there any guides/tutorials about how to do secure file uploads in webapps and how to avoid obvious security pitfalls? Reading the Django docs https://docs.djangoproject.com/en/2.1/topics/security/#user-... , specifically, >Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. Specifically, an HTML file can be uplo…

Some (but probably not an exhaustive list) of pitfalls:

    * Filename: Either force random data or only allow a whitelist through.  Do not trust unknown character ranges.
    * File-existence: Never over-write files, resumed uploads should be handled VERY carefully (it's easier to just not).
    * File-extension: (I) do not care; security design should never trust this data anyway.
    * File-size: You don't have control of this on the host?
    * Disk space: It might be a good idea to reserve at least some of this, or set a maximum ingress pool size.

Re: Fine Uploader is shutting down

#19

Post by rolleiflex »

> I've grown tired of continuously defending my inactivity and decisions against trolls on Twitter, the issue tracker, and elsewhere. It's draining and I don't have the patience or energy to deal with it any longer. These same people expect to impose their short-sighted and non-generalized values and goals on a project for which they have contributed nothing and are not willing to maintain. The sense of entitlement from a small but vocal minority that do not understand FOSS and refuse to understand it is very much a concern, and I'm simply not interested in shrugging that off anymore.

In the last three days, I've been accused of my code not being open source and that I should remove all mentions of open source from everything I owned, because I simply haven't pushed to Github in a month or two.

This was joined by another user who claimed that open source license legally forces me to make the 'secret' code I've been holding off public, which, again, does not exist, because the code on the repo was effectively current.

I've been working full time for the last 8 months, on my own savings, to provide a peer-to-peer mass communication tool, and I'm releasing it for free.

To say that this made me feel horrible for the past few days would be an understatement.

Re: Fine Uploader is shutting down

#20

Post by latchkey »

rolleiflex wrote: post #19

> I've grown tired of continuously defending my inactivity and decisions against trolls on Twitter, the issue tracker, and elsewhere. It's draining and I don't have the patience or energy to deal with it any longer. These same people expect to impose their short-sighted and non-generalized values and goals on a project for which they have contributed nothing and are not willing to maintain. The sense of entitlement f…

Sorry you feel bad. That really sucks to get messages like that. Personally, I'd just ignore the noise and focus on the good. Remember, it is far easier to be a keyboard warrior than it is to create something awesome.

People in the service industry see this all the time. A 1 star review on a restaurant really hurts. Everyone should know how much effort it is to run a restaurant and how much can easily go wrong... a bad review is really disheartening.

Post reply on HN