Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

X0.at: upload files from cURL

x0.at

Post reply on HN
Print view View original

81–90 of 93 posts

Re: X0.at: upload files from cURL

#81

Post by mwambua »

uploaderwin wrote: post #40

Yeah this is asking for trouble. We only had a small demo on our homepage where users could upload media files and they were deleted after 24 hours and still some people managed to abuse it and nearly got our site killed, domain blacklisted in Google with a big red screen of death. I don't want to spam any links here but if you are interested please do look at my last post about the dangers of doing this and lessons…

Can you remedy this problem by making it so that anyone can delete the file? That way anyone can take it down if they have a problem with it? It's supposed to be ephemeral storage anyway... people might not mind having files disappear.

Re: X0.at: upload files from cURL

#82

Post by 40four »

s_dev wrote: post #42
40four wrote: post #36

I like the simplicity of it. One PHP file, throw it on a server with Apache and rock and roll. Other comments are right to point out that this site is setting itself up to be abused. My feeling is that this is intended to be a demo. I doubt the creator is trying to provide a real service here. And they might be in for a rude awakening if it gains traction. But, it looks like they intend this to be open source. Anyone…

>the repo does not have a license file, which makes me a little uneasy. Surely the author is bearing the liability of getting burned by not specifying a licence.

Yeah, I edited my comment as I think I miss-spoke actually. Technically, GitHub as a platform will allow us to fork or clone this code. But with no license file, from a legal point of view, we cannot use it, or whatever else an open source license would allow.

Re: X0.at: upload files from cURL

#83

Post by dspillett »

mwambua wrote: post #81
uploaderwin wrote: post #40

Yeah this is asking for trouble. We only had a small demo on our homepage where users could upload media files and they were deleted after 24 hours and still some people managed to abuse it and nearly got our site killed, domain blacklisted in Google with a big red screen of death. I don't want to spam any links here but if you are interested please do look at my last post about the dangers of doing this and lessons…

Can you remedy this problem by making it so that anyone can delete the file? That way anyone can take it down if they have a problem with it? It's supposed to be ephemeral storage anyway... people might not mind having files disappear.

Two problems there:

1. Many people are more likely to go to a lot of effort to complain loudly and widely rather than hit a simple "delete this" link.

2. Such feature is basically a self-DoS. If someone takes a disliking to the app or a user of it they can script up a "delete everything" and fire it off.

Re: X0.at: upload files from cURL

#85

Post by msc1 »

felipelemos wrote: post #73
DyslexicAtheist wrote: post #72

Earlier quoted context omitted.

I'm surprised to hear that because their response in dealing with actual child porn is absolute atrocious. A sick and sad story: Couple years ago got a DM from an ex-colleague and security researcher who discovered child porn that was publicly accessible. he contacted Dropbox several times over the course of 3 weeks. Weeks later the links were still up. I reached out to somebody I knew at Dropbox who said they were r…

Why didn't you contact the police first?

i'd be afraid of "how/why did you find in the first place" type of questions.

Re: X0.at: upload files from cURL

#86

Post by exikyut »

apayan wrote: post #43

If you like the convenience of transferring a file temporarily into the cloud to download it elsewhere (great for getting stuff out of a rancher environment), check out patchbay[0]. It uses what it calls 'HTTP channels' so if you start a POST request to a patchbay URL, it will block until a corresponding GET is made to the same endpoint which will receive the data from your POST. The operation can be done in reverse…

Huh, WebRTC for the Web 2.0 2010 era. Nice.

Re: X0.at: upload files from cURL

#89

Post by MandieD »

PeterisP wrote: post #66
planetafro wrote: post #58

Earlier quoted context omitted.

Source? ...moderated via automation or human?

Automation; the bare minimum would be to scan for known child sexual abuse material hashes - if you're not doing that, then opening up anonymous uploads is very risky, as for CSAM (unlike most other things) you may be personally liable even if it's distributed there without your knowledge. Cloudfare's CSAM scanning tool is one option that may help, there are other options. You can't rely on the good faith of users, i…

"You can't rely on the good faith of users; if your service is easily usable for crime, it will be used for it." - should be on every developer's login screen

Re: X0.at: upload files from cURL

#90

Post by DyslexicAtheist »

felipelemos wrote: post #73
DyslexicAtheist wrote: post #72

Earlier quoted context omitted.

I'm surprised to hear that because their response in dealing with actual child porn is absolute atrocious. A sick and sad story: Couple years ago got a DM from an ex-colleague and security researcher who discovered child porn that was publicly accessible. he contacted Dropbox several times over the course of 3 weeks. Weeks later the links were still up. I reached out to somebody I knew at Dropbox who said they were r…

Why didn't you contact the police first?

because when you live in a 1st world country as a foreigner it's safer to assume all cops are pigs. I did report it to the FBI though.
Post reply on HN