3 ms·

Nothing. You can get the same secure sharing service with zero hassle with a simple shell script: sum=$(sha1sum "$1" | cut -f 1 -d ' ') ssh your-vps mk

by megous 7y ago

Nothing. You can get the same secure sharing service with zero hassle with a simple shell script: sum=$(sha1sum "$1" | cut -f 1 -d ' ') ssh your-vps mkdir /srv/http/files/$sum scp "$1" your-vps:/srv/http/files/$sum/ echo https://your-vps/files/$sum/$1 + nginx or whatever

ubercow13 7y ago
That isn't really comparable in that it's not E2EE
- megous 7y ago
  It is, as all ends belong either to you (source computer, vps) or the destination device, and it uses ssh and https.
  - ubercow13 7y ago
    The VPS doesn't really belong to you. Google has exactly the same ability to view your secret file shared unencrypted over Drive as they do to view your file stored on your f1-micro instance.
    - megous 7y ago
      That's just your assumption. VPS != Google. It's just a virtual machine running on some HW. I agree that if that HW is not owned by you, it can be a problem. If that's a problem you can just add another layer of encryption to the mix, like a GPG command. I can and do own that HW. At least as much as one can own anything - it's located in my appartment. You can just as well run the web server from your own workstation/laptop. The only reason to put shared files on other computer is that the other computer is more available.
rvz 7y ago
Well I can't use this on Windows nor can I guarantee that this cryptic shell script will run on my friends computer who still uses Windows. Even so, he wouldn't know how to run it. Also it can't be a "secure sharing service" if you're still using 'sha1sum' and it not being end-to-end encrypted...
- megous 7y ago
  So use sha256sum, if you don't trust SHA1. Also it's quite secure since file content is clearly mapped to the URL you're sharing with the other party via independent channel and the receiving party can verify the content of the file. It may not be completely private if VPS does not run on your own HW, but nothing prevents you from running it on your own HW in your secured location. You can use this on windows the same way you'd use it on Linux. You just install a bunch of programs and run commands from command line. (basically just like you'd need to do with fsend) It's less hassle on Linux, since the commands are pre-installed. Fsend is more hassle on Linux since it's not preinstalled and requires rust, compilation, etc. The other people just open a https links and download files in any browser or via curl, no tools required at all, not even JS.
_jal 7y ago
Great Dropbox replacement.

by megous 7y ago

ubercow13 7y ago

That isn't really comparable in that it's not E2EE

megous 7y ago
It is, as all ends belong either to you (source computer, vps) or the destination device, and it uses ssh and https.
- ubercow13 7y ago
  The VPS doesn't really belong to you. Google has exactly the same ability to view your secret file shared unencrypted over Drive as they do to view your file stored on your f1-micro instance.
  - megous 7y ago
    That's just your assumption. VPS != Google. It's just a virtual machine running on some HW. I agree that if that HW is not owned by you, it can be a problem. If that's a problem you can just add another layer of encryption to the mix, like a GPG command. I can and do own that HW. At least as much as one can own anything - it's located in my appartment. You can just as well run the web server from your own workstation/laptop. The only reason to put shared files on other computer is that the other computer is more available.

rvz 7y ago

Well I can't use this on Windows nor can I guarantee that this cryptic shell script will run on my friends computer who still uses Windows. Even so, he wouldn't know how to run it. Also it can't be a "secure sharing service" if you're still using 'sha1sum' and it not being end-to-end encrypted...

megous 7y ago
So use sha256sum, if you don't trust SHA1. Also it's quite secure since file content is clearly mapped to the URL you're sharing with the other party via independent channel and the receiving party can verify the content of the file. It may not be completely private if VPS does not run on your own HW, but nothing prevents you from running it on your own HW in your secured location. You can use this on windows the same way you'd use it on Linux. You just install a bunch of programs and run commands from command line. (basically just like you'd need to do with fsend) It's less hassle on Linux, since the commands are pre-installed. Fsend is more hassle on Linux since it's not preinstalled and requires rust, compilation, etc. The other people just open a https links and download files in any browser or via curl, no tools required at all, not even JS.

_jal 7y ago

Great Dropbox replacement.