News for hackers. Stuff that matters.
Re:Firefox Send: Private, Encrypted File Sharing by NikolaeVarius on Wednesday October 11, 2017 @08:42AM (#15449249)
It really is a shame that there still isn't a easy way (A person whose computer knowledge extends to using facebook), that I know of, of sending arbitrarily large files that isn't tethered to a specific cloud service and is also reliable (can tolerate connection dropping).

It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transactions.

Re:Firefox Send: Private, Encrypted File Sharing by danieldk on Wednesday October 11, 2017 @10:55AM (#15450259)
Resilio Sync (formerly Bittorrent Sync) pretty much offers that. They use relays in case both peers cannot pierce NAT, but the relays only see ciphertext. They also have apps for Android and iOS, making transfers to mobile devices also possible. Since it is closed-source software, it's up to you to decide whether you trust the software.

SyncThing is a free software alternative, but I wouldn't say that it is usable (yet) for the average user.

Re:Firefox Send: Private, Encrypted File Sharing by ReAzem on Wednesday October 11, 2017 @12:40PM (#15451059)
Instead of Resilio Sync, I would suggest that people take a look at Syncthing. They have similar features but Syncthing is open source.
Re:Firefox Send: Private, Encrypted File Sharing by mtgx on Wednesday October 11, 2017 @02:07PM (#15451806)
I haven't tried Synthing in about a year, but to me Resilio and Syncthing look like they are from completely different classes of apps/they target different markets.

Syncthing is simply not designed for the mainstream. Resilio is. If Syncthing devs can fix that, I'll gladly start using it over Resilio with my non-technical friends.

Re:Firefox Send: Private, Encrypted File Sharing by JetSpiegel on Wednesday October 11, 2017 @05:35PM (#15453699)
How do you fix "not being mainstream"? What exactly is your issue with Syncthing?
Re:Firefox Send: Private, Encrypted File Sharing by QasimK on Wednesday October 11, 2017 @12:56PM (#15451201)
There is no iOS app for Syncthing as far as I can tell
Re:Firefox Send: Private, Encrypted File Sharing by unhammer on Thursday October 12, 2017 @04:48AM (#15456569)
They're crowdfunding one: https://www.bountysource.com/issues/7699463-native-ios-port-...

(There's also a closed-source iOS app called fsync(), but I found it too slow/unstable to use.)

Re:Firefox Send: Private, Encrypted File Sharing by QasimK on Tuesday October 17, 2017 @05:21PM (#15495083)
That’s great to know, and I can see there has been quite a bit of discussion the topic. I’m glad I’m not the only one that was missing an open implementation for iOS.
Re:Firefox Send: Private, Encrypted File Sharing by okanesen on Wednesday October 11, 2017 @02:12PM (#15451877)
You can use fsync() [0] for that.

[0]: https://itunes.apple.com/us/app/fsync/id964427882?mt=8

Re:Firefox Send: Private, Encrypted File Sharing by QasimK on Tuesday October 17, 2017 @05:18PM (#15495058)
Thank you! So as it is available on iOS, I need to adjust my comment to reflect what I mean. There isn’t a free, open-source, community-driven implementation for iOS, keeping with the nature of the project.
Re:Firefox Send: Private, Encrypted File Sharing by mapgrep on Wednesday October 11, 2017 @11:52AM (#15450709)
I used BitTorrent Sync for a couple of years and loved it. Has it evolved much under the Resilio banner?
Re:Firefox Send: Private, Encrypted File Sharing by rodolphoarruda on Wednesday October 11, 2017 @12:01PM (#15450776)
Me too. I stopped using it after I read somewhere that it could be hacked to include new peers to your connection without your awareness, which is a serious concern. I don't know how legit the claim was... but I opted to avoid the risk.
Re:Firefox Send: Private, Encrypted File Sharing by ukyrgf on Wednesday October 11, 2017 @03:18PM (#15452549)
I keep mine updated to the latest version and still love it. The 'Ignore' file that is in the top-level of each share alone is worth the admission (similar to .gitignore). Dropbox/OneDrive/etc. all lose their damn minds if you try to sync a folder with 'node_modules' or 'vendor' to the share.
Re:Firefox Send: Private, Encrypted File Sharing by bubblethink on Wednesday October 11, 2017 @08:58AM (#15449359)
Both parties would have to be online for any p2p solution to work. And if they are online, there are plenty of ways to create a p2p link. It is complicated by things like NAT though. However, that is the less common case. In most cases, the receiver isn't going to be online. So you need an intermediate server, and that's how you end up with third party solutions.
Re:Firefox Send: Private, Encrypted File Sharing by juliendorra on Wednesday October 11, 2017 @01:57PM (#15451710)
Smartphones in Europe are close to being online 24/24. Energy management by OSes might limit apps in what they can do, of course. In any case, 4G networks rise might lead to interesting new solutions.
Re:Firefox Send: Private, Encrypted File Sharing by wybiral on Wednesday October 11, 2017 @10:58AM (#15450290)
Yeah, the "being online" detail seems like the problem. It would be best if the encrypted data were distributed (something like IPFS) but then why would peers host files that aren't for them.
Re:Firefox Send: Private, Encrypted File Sharing by thatcat on Wednesday October 11, 2017 @11:28AM (#15450527)
You would need a seedbox to function as a cloud. Then when you send a file, send to seedbox simultaniously. This approach might also increase dl speed for the reciever.
Re:Firefox Send: Private, Encrypted File Sharing by C0DEHERO on Wednesday October 11, 2017 @11:56AM (#15450742)
They don't currently, but Filecoin is supposed to create an incentive for people to host other people's files. Obviously, you'll have to pay some amount to have your files hosted.
Re:Firefox Send: Private, Encrypted File Sharing by m-p-3 on Wednesday October 11, 2017 @12:08PM (#15450820)
Storj is based on a similar concept.
Re:Firefox Send: Private, Encrypted File Sharing by akavel on Wednesday October 11, 2017 @04:22PM (#15453119)
AFAIR, there's already some service on IPFS which will pin files for you for money. I.e.: why would someone? Because you'd pay them for that - simple :)
Re:Firefox Send: Private, Encrypted File Sharing by z3t4 on Wednesday October 11, 2017 @02:11PM (#15451861)
If you can assemble IKEA furniture you can also run a Linux server.
Re:Firefox Send: Private, Encrypted File Sharing by mwest on Wednesday October 11, 2017 @11:10AM (#15450381)
I've found https://github.com/warner/magic-wormhole really useful, although it only meets 1/3 of your requirements. I'm hoping someone will add a nice GUI and re-transmission.

Previously on HN: https://news.ycombinator.com/item?id=14649727

Re:Firefox Send: Private, Encrypted File Sharing by staz on Wednesday October 11, 2017 @12:13PM (#15450855)
On the principle it look really nice, but with a quick glance at the code I'm not too sure I would trust it...

https://github.com/warner/magic-wormhole/blob/master/src/wor...

Re:Firefox Send: Private, Encrypted File Sharing by AndrewDucker on Wednesday October 11, 2017 @09:07AM (#15449407)
You're at a computer.

You need to connect to another computer.

First you need to know a route to that computer. If it has an externally reachable IP address and you know that, then great. If it has an externally reachable IP address and a DNS entry and you know _that_, then also great.

If you don't know the IP address or domain name of the other computer then you'll have to do some kind of lookup/exchange to find it. That means some kind of centralised service to provide the lookup functionality.

If the other computer doesn't even has an externally reachable IP address then a central service is going to have to act as a connection point which you can both connect to (or provide some other method of helping the two of you connect).

I'm not aware of any entirely decentralised system which would allow two computers which are behind NAT to find and then talk to each other. Or any obvious design which would work there.

Re:Firefox Send: Private, Encrypted File Sharing by padenot on Wednesday October 11, 2017 @09:26AM (#15449513)
WebRTC solves all the issues you're mentioning, and is available in Chrome and Firefox (in some for in Edge, and soon in Safari).

Three examples of this, implemented and working:

- https://www.sharedrop.io/ - https://www.justbeamit.com/ - https://file.pizza/

Re:Firefox Send: Private, Encrypted File Sharing by AndrewDucker on Wednesday October 11, 2017 @09:27AM (#15449519)
So, three systems which all require a central service?
Re:Firefox Send: Private, Encrypted File Sharing by padenot on Wednesday October 11, 2017 @09:50AM (#15449722)
Those services are for the initial peer discovery and SDP exchange, which can be done by other means (using any other side-channel).

Ongoing work is happening, for example by the webtorrent folks, to remove this constraint.

Re:Firefox Send: Private, Encrypted File Sharing by AndrewDucker on Wednesday October 11, 2017 @10:07AM (#15449853)
Yeah, it's initial peer discovery and connection setup (if behind NAT) I'm talking about. Once you've found the other PC and got a connection set up then all is well ;-)

Do these services also act as connectors in case of double NAT?

Re:Firefox Send: Private, Encrypted File Sharing by TD-Linux on Wednesday October 11, 2017 @08:52PM (#15454842)
STUN allows all sorts of hole-punching for cases where both peers are behind NATs. For cases where the hole-punching doesn't work (a user behind two NATs might be one case), you can use TURN which is a dumb UDP or TCP relay.
Re:Firefox Send: Private, Encrypted File Sharing by padenot on Wednesday October 11, 2017 @12:16PM (#15450875)
They certainly can, I don't know if they do in practice. It always work for me, so I haven't investigated too much.
Re:Firefox Send: Private, Encrypted File Sharing by the8472 on Wednesday October 11, 2017 @01:53PM (#15451670)
Which is a step backwards compared to bittorrent, since that can also provide decentralized hole punching, bootstrapping and peer discovery and not just the bulk data transfer. Plus being implemented at the TCP/UDP level allows more fine-grained control over the data flow, making it more friendly towards the network.
Re:Firefox Send: Private, Encrypted File Sharing by rakoo on Wednesday October 11, 2017 @11:22AM (#15450482)
They're also needed for the actual javascript code that runs everything.
Re:Firefox Send: Private, Encrypted File Sharing by wybiral on Wednesday October 11, 2017 @11:03AM (#15450326)
What about something like Tor. You can run a hidden service to get an onion address that any Tor client can access.

Would that meet the requirements without being a "central" service?

Re:Firefox Send: Private, Encrypted File Sharing by KGIII on Wednesday October 11, 2017 @11:44AM (#15450655)
If privacy isn't your primary concern, and this is absolutely not private, you can also just use a redirection service and access .onion domains without installing Tor.

Just take any .onion domain and append it with .to and it should work. examplelettersblah.onion becomes examplelettersblah.onion.to and that works without needing to muck about with Tor.

This would be a horrible idea if you're concerned with privacy/anonymity. But, it'd make it easy for people to download your shared files.

Re:Firefox Send: Private, Encrypted File Sharing by dublinben on Wednesday October 11, 2017 @11:24AM (#15450495)
That's exactly how Onionshare works. https://onionshare.org/
Re:Firefox Send: Private, Encrypted File Sharing by wybiral on Wednesday October 11, 2017 @11:51AM (#15450704)
Never seen that before. But running a hidden service on Tor is absurdly easy, then you just shove a file server through whatever port Tor is forwarding.
Re:Firefox Send: Private, Encrypted File Sharing by xj9 on Wednesday October 11, 2017 @09:25AM (#15449511)
I'm not aware of any entirely decentralised system which would allow two computers which are behind NAT to find and then talk to each other. Or any obvious design which would work there.

then you're clearly not the person we should be asking to build this kind of thing are you? :-)

my proposal actually solves two important problems with peer-to-peer systems, and I barely have to write any new code to make it work! the solution? i2p! it's an anonymous mix network, much like Tor, but completely decentralized. using an intermediary dex mix network fixes the nat issue and prevents you from leaking your IP address to other peers.

https://geti2p.net/en/comparison/tor

Re:Firefox Send: Private, Encrypted File Sharing by AndrewDucker on Wednesday October 11, 2017 @09:31AM (#15449546)
Assume I'm at my computer with i2p installed. How do I find your computer?

(Serious question - I've not used it myself, and I'm intrigued at the process.)

Re:Firefox Send: Private, Encrypted File Sharing by xj9 on Wednesday October 11, 2017 @09:56AM (#15449767)
https://geti2p.net/en/about/intro

endpoints are identified by their public key hash. each endpoint maintains a set of anonymized routes. this routing information is stored in a Distributed Hash Table (DHT). if you want to connect to another endpoint, you lookup the route for the public key hash, build an outbound route, and you're good.

more concretely, an ipfs transfer would work by using public key hashes in place of IP addresses to identify peers and a known set of endpoint keys for bootstrapping.

Re:Firefox Send: Private, Encrypted File Sharing by AndrewDucker on Wednesday October 11, 2017 @10:16AM (#15449931)
So all you need is the hash (sent to you by your friend over IM or email or postcard) and you're good to go?

I like it.

Now, is it available today in a form (as the OP put it) which "A person whose computer knowledge extends to using facebook" can use?

Re:Firefox Send: Private, Encrypted File Sharing by xj9 on Wednesday October 11, 2017 @10:25AM (#15449986)
if they have the ability to install software, they can use i2p

https://geti2p.net/en/download

Re:Firefox Send: Private, Encrypted File Sharing by AndrewDucker on Wednesday October 11, 2017 @10:40AM (#15450130)
Odd. I looked at the description on the main page, and it lists eDonkey, BitTorrent, and Gnutella, but not any kind of direct file transfer.

Am I missing something?

Re:Firefox Send: Private, Encrypted File Sharing by xj9 on Wednesday October 11, 2017 @11:39AM (#15450611)
yes.

1. click bit torrent 2. click create torrent 3. type the path to your file 4. share magnet link

magnet:?xt=urn:btih:d0da0a2cac2bb3fd7ba6548edef12a24122ef481&tr=http://diftracker.i2p/announce.php

Re:Firefox Send: Private, Encrypted File Sharing by icebraining on Wednesday October 11, 2017 @01:37PM (#15451525)
Does the magnet link work without DifTracker? Because that's still a centralized system.
Re:Firefox Send: Private, Encrypted File Sharing by xj9 on Wednesday October 11, 2017 @06:29PM (#15454093)
yes, the tracker is optional. the built in torrent client supports BEP 5.

http://www.bittorrent.org/beps/bep_0005.html

Re:Firefox Send: Private, Encrypted File Sharing by jchw on Wednesday October 11, 2017 @09:17AM (#15449454)
Two thoughts:

- IPv6 kind of helps here, at least if we hope that no NAT standard ever makes it into IPv6. Crossing my fingers.

- There does exist at least one NAT hole-punching technique that can traverse two NATs with no central server using ICMP-based holepunching and UDP. Obviously, like all hole punching techniques, it only works on certain kinds of NATs, and firewalls can kill it.

Re:Firefox Send: Private, Encrypted File Sharing by ac2u on Wednesday October 11, 2017 @09:39AM (#15449628)
> There does exist at least one NAT hole-punching technique that can traverse two NATs with no central server using ICMP-based holepunching and UDP. Obviously, like all hole punching techniques, it only works on certain kinds of NATs, and firewalls can kill it.

I think you're referring to this? Clever hack indeed. https://github.com/samyk/pwnat

Re:Firefox Send: Private, Encrypted File Sharing by dingaling on Wednesday October 11, 2017 @09:39AM (#15449627)
IPv6 doesn't help in corporate environments, where it's often firewalled harder than IPv4.

The fact that it doesn't support NAT is seen as a risk in such environments ( which rightly or wrongly consider it as a second level of firewalling ). Some deployments that I've seen use only site-scoped with no globally-routed prefixes. Everything Internetty has to go over IPv4, which makes the Security team's job easier; drop all IPv6 at the DMZ and drop all non-NAT IPv4.

Re:Firefox Send: Private, Encrypted File Sharing by zeveb on Wednesday October 11, 2017 @11:11AM (#15450383)
> I'm not aware of any entirely decentralised system which would allow two computers which are behind NAT to find and then talk to each other. Or any obvious design which would work there.

I think the GNUnet has some stuff in it which can even work across different protocols, e.g. hopping across TCP/IP over Ethernet to Bluetooth to packet radio. It has some neat stuff where, as I recall, it probes out a random path, then tries to get at its intended destination, remembering successful attempts. It definitely sounds cool, but it's not currently in an end-user-usable state.

Re:Firefox Send: Private, Encrypted File Sharing by wpietri on Wednesday October 11, 2017 @12:28PM (#15450979)
Regarding this bit:

> I'm not aware of any entirely decentralised system [...]

What's the user value of having something entirely decentralized? I see the value in making sure the actual file transfer doesn't go through the central rendezvous. But I don't understand what's gained by eliminating the use of a little help setting up the connection.

Re:Firefox Send: Private, Encrypted File Sharing by seedie on Wednesday October 11, 2017 @12:44PM (#15451111)
The lack of a centralized entity collecting metadata. Who is sending files, when and how often.
Re:Firefox Send: Private, Encrypted File Sharing by icebraining on Wednesday October 11, 2017 @01:35PM (#15451511)
The ISPs can do that, and they're pretty centralized.
Re:Firefox Send: Private, Encrypted File Sharing by kyrra on Wednesday October 11, 2017 @11:43AM (#15450649)
https://upspin.io/ is in super early concept stage, but trying to solve file sharing issues. It allows for hosting on multiple platforms and trying to keep control in the hands of the users.

https://upspin.io/doc/overview.md

Re:Firefox Send: Private, Encrypted File Sharing by thatcat on Wednesday October 11, 2017 @11:23AM (#15450485)
file.pizza is pretty solid, but uses webrtc so ive had failures when sending to some iOS users. Apparently webrtc is included in safari 11 though.
Re:Firefox Send: Private, Encrypted File Sharing by sunsetMurk on Wednesday October 11, 2017 @11:32AM (#15450551)
thanks for sharing this - very cool.
Re:Firefox Send: Private, Encrypted File Sharing by pingiun on Wednesday October 11, 2017 @10:31AM (#15450039)
> It seems that bitorrent protocols are pretty close, but I don't think there is a seamless client that allows for "magical" point to point transactions.

instant.io works pretty well for me, it works on the bittorrent protocol, but over webrtc

Re:Firefox Send: Private, Encrypted File Sharing by peterwwillis on Wednesday October 11, 2017 @10:23AM (#15449973)
Well, you can with FTP and UPnP. You the client gets the external IP of the machine, then use UPnP to open ports on the router/firewall, then uses PASV and connects to the destination. The destination runs an FTP server, that uses UPnP to open up the incoming port, and gets its external IP and uses it for PORT mode. The end result is two individuals behind NAT sharing arbitrary files in bulk. You can even tie this into FXP to do syncing with the cloud.

Or run a local SFTP server with UPnP and avoid the extra complexity.

In terms of finding each other, the client could get its external IP, open up a UPnP port, and provide the user with a QR code or brief snippet to paste into a chat conversation, which the other user would feed to their client to initiate the file transfer.

You could do this commercially by providing an external website with which the clients could communicate out of band to set up their transfers (for free), and (for pay) optionally provide a cloud sync service (which would help person A "pre-send" a big file transfer until person B was available to receive it).

While some of this is available today, you're right, I don't think there are accessible clients. ICQ, AIM and IRC used to be the solution, as they all did P2P file transfer. But now everything is on the web, so everything sucks.

Re:Firefox Send: Private, Encrypted File Sharing by hiq on Wednesday October 11, 2017 @10:32AM (#15450048)
magic-wormhole ( https://github.com/warner/magic-wormhole ) is not so far from that, just add a simple GUI on top of it (or just use the terminal and convince the user that a terminal does not have to be complicated), and you're good to go. I don't know how reliable it is w.r.t. connection drops though.
Re:Firefox Send: Private, Encrypted File Sharing by stephenboyd on Wednesday October 11, 2017 @12:24PM (#15450940)
This was once a common use of AOL Instant Messenger.
Re:Firefox Send: Private, Encrypted File Sharing by drzaiusapelord on Wednesday October 11, 2017 @11:11AM (#15450387)
I just want to be able to right-click somewhere and have the system bring up a a simple FTPS or SFTP daemon and have it try UPnP to open a firewall/NAT transversal. This daemon would spin up just for the transfer then shut itself down once done.

Even if both parties are behind a firewall that won't respect UPnP, there's UDP hole punching which should usually work. Mozilla would just need to host a server to handle the port number handoffs.

I imagine this would handle 90% of the use cases. The rest would use traditional 3rd party hosting, IM transfers, email, etc.

Re:Firefox Send: Private, Encrypted File Sharing by vel0city on Saturday October 14, 2017 @03:51PM (#15473858)
With the recent shuttering of AIM, I'm reminded of the old client's Direct IM feature which would allow you to transfer arbitrarily large files through the chat session. That tool could not have been simpler to the user, as they just had to click "Direct IM" and could then drag and drop files into the chat. However, that system still relied on the cloud service (AIM) being a broker of connecting a handle to an IP address, and that there was little guarantee of the identity of the person on the other end of the IM.
Re:Firefox Send: Private, Encrypted File Sharing by csdreamer7 on Wednesday October 11, 2017 @10:53AM (#15450240)
Local-wise you can use Nitroshare. I use it all the time to quickly send files between my computers.

https://nitroshare.net/

Re:Firefox Send: Private, Encrypted File Sharing by tjoff on Wednesday October 11, 2017 @12:18PM (#15450890)
And this isn't? (Honest question, hasn't looked at it hard enough yet)

I don't disagree with you but I kind of expected a note as to why this wasn't a solution in this context.

Re:Firefox Send: Private, Encrypted File Sharing by hardwaresofton on Wednesday October 11, 2017 @12:24PM (#15450942)
I think he considers this as "tethered to a cloud service".

I think a solution to this problem that wasn't tethered would be something like in an IPV6 world where everyone has an IP address, if I could just put in your address, send you a file, and as long as our computers were on/connected to the world wide web, it'd get to you.

Re:Firefox Send: Private, Encrypted File Sharing by throw2016 on Wednesday October 11, 2017 @09:59AM (#15449790)
Technically a one to one connection to send files should be simple, just open a socket on both sides or use nc. Of course there is NAT but its not insurmountable. The sending or receiving party has to share their IP. And this can only be real time, there is no scope to store files anywhere.

Aside I have recently noticed visits to ecommerce sites sit near permanently on top of my Firefox history than other sites, is Firefox doing deals with Amazon and others, and has this been been disclosed?

Re:Firefox Send: Private, Encrypted File Sharing by wodenokoto on Wednesday October 11, 2017 @12:25PM (#15450949)
File.pizza is very seamless point to point transfer of arbitrary file sizes.

Doesn't work in safari though (haven't tested ie) so maybe it is not general enough for your use case.

Re:Firefox Send: Private, Encrypted File Sharing by api on Wednesday October 11, 2017 @12:27PM (#15450969)
Does it work in Safari in High Sierra? I thought they had WebRTC now.
Re:Firefox Send: Private, Encrypted File Sharing by wodenokoto on Thursday October 12, 2017 @05:37AM (#15456756)
That's a good question. My box is too old for High Sierra, so I can't check and didn't think that my browser is now outdated feature-wise, before writing the comment.
Re:Firefox Send: Private, Encrypted File Sharing by api on Wednesday October 11, 2017 @12:26PM (#15450955)
There are lots of them with varying trade-offs between ease of use and power.

The problem is that there are none with enough of a user base to have a network effect, and users hate installing new apps.

It's 2017 and it's still hard and somewhat dangerous to install apps.

Re:Firefox Send: Private, Encrypted File Sharing by w4yai on Wednesday October 11, 2017 @09:21AM (#15449484)
I'm not sure it tolerates connection dropping, but I've been using justbeamit for years and it never deceived me : https://www.justbeamit.com
Re:Firefox Send: Private, Encrypted File Sharing by alexnewman on Wednesday October 11, 2017 @11:55AM (#15450737)
Magic wormhole
Re:Firefox Send: Private, Encrypted File Sharing by unlmtd1 on Wednesday October 11, 2017 @10:00AM (#15449797)
IPFS