Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

X0.at: upload files from cURL

x0.at

Post reply on HN
Print view View original

21–30 of 93 posts

Re: X0.at: upload files from cURL

#21

Post by southerntofu »

the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

> Uploading files without auth layer - is asking for trouble IMHO.

If you make it super user-friendly and advertise it as the next Megaupload, sure. But if you keep a small audience of good-faith users it's not asking for problems.

If you can teach me to make my file upload as hacker-friendly as this service while implementing auth, i'd be glad. Here the entire point is you don't need further configuration/credentials for example to upload log/config from a server.

Re: X0.at: upload files from cURL

#22

Post by ericbarrett »

southerntofu wrote: post #21
the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

> Uploading files without auth layer - is asking for trouble IMHO. If you make it super user-friendly and advertise it as the next Megaupload, sure. But if you keep a small audience of good-faith users it's not asking for problems. If you can teach me to make my file upload as hacker-friendly as this service while implementing auth, i'd be glad. Here the entire point is you don't need further configuration/credential…

This is a one-way road, though. The minute a bad actor finds out about your ungated image-hosting service, it's over, and you'll have a hell of a mess to clean up. If you're lucky it'll just be somebody trying to sell penis pills. If you're not, you'll have federal investigators knocking.

Re: X0.at: upload files from cURL

#23

Post by opan »

southerntofu wrote: post #21
the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

> Uploading files without auth layer - is asking for trouble IMHO. If you make it super user-friendly and advertise it as the next Megaupload, sure. But if you keep a small audience of good-faith users it's not asking for problems. If you can teach me to make my file upload as hacker-friendly as this service while implementing auth, i'd be glad. Here the entire point is you don't need further configuration/credential…

chunk.io is a similar thing, but with auth.

https://chunk.io/

Re: X0.at: upload files from cURL

#24

Post by banana_giraffe »

the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

Agreed.

I use a little python script that creates a curl command to upload to S3 for cases where I don't have the AWS toolchain on a remote box.

Not as easy as a single command, but at least I'm less likely to be sending files off to some random site for everyone to see.

Re: X0.at: upload files from cURL

#25

Post by raverbashing »

ju-st wrote: post #16
the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

The website is already blocked because of "Malicious Sources/Malnets" in the firewall of the company I work at.

"This is why we can't have nice things..." sigh

Re: X0.at: upload files from cURL

#26

Post by the_arun »

southerntofu wrote: post #21
the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

> Uploading files without auth layer - is asking for trouble IMHO. If you make it super user-friendly and advertise it as the next Megaupload, sure. But if you keep a small audience of good-faith users it's not asking for problems. If you can teach me to make my file upload as hacker-friendly as this service while implementing auth, i'd be glad. Here the entire point is you don't need further configuration/credential…

1. How are you blocking someone from uploading millions of files programmatically?

2. How do you know someone is from small audience of good-faith?

3. What if a file has virus and corrupt all the files on your end?

If you don't need auth, there are few measures you can take on your end:

1. TTL - Make these files temporary - They will be erased after x hours. Eg. x=1

2. Throttle - Limit number of uploads from a given IP/machine or control by uploads per sec

3. May be adding a malware scanner?

Re: X0.at: upload files from cURL

#27

Post by codegeek »

southerntofu wrote: post #21
the_arun wrote: post #14

Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.

> Uploading files without auth layer - is asking for trouble IMHO. If you make it super user-friendly and advertise it as the next Megaupload, sure. But if you keep a small audience of good-faith users it's not asking for problems. If you can teach me to make my file upload as hacker-friendly as this service while implementing auth, i'd be glad. Here the entire point is you don't need further configuration/credential…

But it is not a matter of "if". It is a matter of "when". Bad actor(s) will find out at some point if it is even remotely popular and then it's game over.
Post reply on HN