Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: YouTransfer – Self-hosted file sharing

youtransfer.io

Post reply on HN
Print view View original

41–50 of 77 posts

Re: Show HN: YouTransfer – Self-hosted file sharing

#42

Post by rbolte »

amelius wrote: post #41

I've just seen the demo. What about security? Can anybody just "dump" files on your server? Also, when people run this at home on their home computers there is limited upload speed (typically 1/10th of the download speed).

Basically... yeah, if you do not take any additional security measures, anybody can just "dump" files on your server.

You could opt for the S3 storage provider, which will dump the files to Amazon AWS instead.

The YouTransfer project does not implement access control or SSL, so it is highly recommended that you look at the hosting options on the Wiki (https://github.com/remie/YouTransfer/wiki/hosting).

I'm afraid there is not much the project can do concerning upload speeds of individual connections at home :)

Re: Show HN: YouTransfer – Self-hosted file sharing

#43

Post by rbolte »

Tepix wrote: post #40

The software looks interesting, however the web page is hard to read due to low contrast and very thin fonts. Join http://contrastrebellion.com/

Are you referring to the generated GitHub pages on http://youtransfer.io or to the demo instance (http://demo.youtransfer.io) which is the actual application?

Re: Show HN: YouTransfer – Self-hosted file sharing

#44

Post by fnordfnordfnord »

rbolte wrote: post #43
Tepix wrote: post #40

The software looks interesting, however the web page is hard to read due to low contrast and very thin fonts. Join http://contrastrebellion.com/

Are you referring to the generated GitHub pages on http://youtransfer.io or to the demo instance ( http://demo.youtransfer.io ) which is the actual application?

Probably http://www.youtransfer.io/

I'm having a little trouble, too. Even making the type a little bit darker would help.

Re: Show HN: YouTransfer – Self-hosted file sharing

#45

Post by teekert »

rbolte wrote: post #42
amelius wrote: post #41

I've just seen the demo. What about security? Can anybody just "dump" files on your server? Also, when people run this at home on their home computers there is limited upload speed (typically 1/10th of the download speed).

Basically... yeah, if you do not take any additional security measures, anybody can just "dump" files on your server. You could opt for the S3 storage provider, which will dump the files to Amazon AWS instead. The YouTransfer project does not implement access control or SSL, so it is highly recommended that you look at the hosting options on the Wiki ( https://github.com/remie/YouTransfer/wiki/hosting ). I'm afraid t…

This is very nice! Personally I'd really like some kind of login for the uploader so I can offer this service to friends and family (and myself ;)) without the risk of someone discovering the url and using it as a way to distribute illegal things... Perhaps it is easy to do with Apache/Nginx (when the upload site is on another subdomain for example), I don't know actually.

The speeds issue can be solved by running on a cheap DO droplet or scaleway arm server btw (my city luckily has fiber everywhere :)).

Re: Show HN: YouTransfer – Self-hosted file sharing

#46

Post by creshal »

dutchbrit wrote: post #28
dchest wrote: post #3

If I read it correctly, this is how a file token is generated, which is supposed to be secure: file.id = md5(file.name + (Math.random() * 1000)); First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandom…

I'd use a uuid

UUIDs still need a sound source of randomness.

Re: Show HN: YouTransfer – Self-hosted file sharing

#47

Post by rbolte »

teekert wrote: post #45
rbolte wrote: post #42

Earlier quoted context omitted.

Basically... yeah, if you do not take any additional security measures, anybody can just "dump" files on your server. You could opt for the S3 storage provider, which will dump the files to Amazon AWS instead. The YouTransfer project does not implement access control or SSL, so it is highly recommended that you look at the hosting options on the Wiki ( https://github.com/remie/YouTransfer/wiki/hosting ). I'm afraid t…

This is very nice! Personally I'd really like some kind of login for the uploader so I can offer this service to friends and family (and myself ;)) without the risk of someone discovering the url and using it as a way to distribute illegal things... Perhaps it is easy to do with Apache/Nginx (when the upload site is on another subdomain for example), I don't know actually. The speeds issue can be solved by running on…

The problem with ACL is that I'm worried it will make the project more complex. I've added an issue on GitHub for future reference (https://github.com/remie/YouTransfer/issues/105)

Re: Show HN: YouTransfer – Self-hosted file sharing

#48

Post by rbolte »

fnordfnordfnord wrote: post #44
rbolte wrote: post #43

Earlier quoted context omitted.

Are you referring to the generated GitHub pages on http://youtransfer.io or to the demo instance ( http://demo.youtransfer.io ) which is the actual application?

Probably http://www.youtransfer.io/ I'm having a little trouble, too. Even making the type a little bit darker would help.

I'm a bit hesitant to change this as I'm using the GitHub site generator for convenience. There is a limited set of templates available, most of which are either ugly or have readability issues. As the website basically only consists of the README file, you can also look at the GitHub project for more information (https://github.com/remie/YouTransfer)

Re: Show HN: YouTransfer – Self-hosted file sharing

#50

Post by rbolte »

noonespecial wrote: post #49

Might I suggest that you split the folders up in your uploads. 0b692a00635682fabc78b6a50655242c.binary gets stored, for example in "./uploads/0b/69/2a/0b692a00635682fabc78b6a50655242c.binary" etc. Too many files in one dir can have problems or be slow.

Good suggestion! I've added an issue on GitHub (https://github.com/remie/YouTransfer/issues/106).

BTW: normally the files will expire within a specific timeframe and will be removed by a scheduled cleanup process. This should limit the impact, but if the system is heavily used it might become a problem.

Post reply on HN