2 ms·

Hi HN! I've been working with jhiesey for the past 2 months on Wormhole. Wormhole lets you share files with end-to-end encryption and a link that automatically

by feross 6y ago

Hi HN! I've been working with jhiesey for the past 2 months on Wormhole. Wormhole lets you share files with end-to-end encryption and a link that automatically expires. Our twin goals were speed and security – you should be able to get a link to send in less than 2 seconds. Everything is end-to-end encrypted and the server never knows anything about your files. Wormhole supports instant streaming – there's no need to wait for your files to upload before you can send the share link to your recipient. We also use super fast P2P transfer when possible, which comes in handy when both devices are on the same network. Finally, we host your end-to-end encrypted files for 24 hours so the share link keeps working even after you close the site. Please give it a try and please tell us what you think. Read our manifesto: https://wormhole.app/about https://wormhole.app/about Read about our security design: https://wormhole.app/security https://wormhole.app/security

nfsiddiqui 6y ago
what was the trickiest part to build?
- feross 6y ago
  We went to absurd lengths to make Wormhole fast and performant, without sacrificing security. All of the technical challenges we faced came from trying to accomplish these two goals simultaneously: - Build the absolute fastest way to send files - Deliver end-to-end encryption without any compromises Here's a bit more of the technical details: We use streaming encryption (specifically, the Encrypted Content-Encoding standard also used by the now defunct Firefox Send) so that we can keep memory utilization flat, no matter how large the file. Then, we take the end-to-end encrypted file data and simultaneously stream it to browser storage and our servers. When a downloader shows up before the file is fully uploaded, we use the browser copy of the data to stream your files to the downloader directly. This means that they can start downloading even before the files have been uploaded. For the direct peer-to-peer transfer, we use the WebTorrent protocol (which I created). All file data is end-to-end encrypted before leaving the device. It's encrypted yet again in transit by TLS or WebRTC, and also while at rest on our servers. We use a combination of browser storage options, depending on which is fastest and the amount of available disk space. We choose from the following storage strategies: - Storage Foundation API (fastest performance, experimental API, Chrome only for now, https://github.com/fivedots/storage-foundation-api-explainer https://github.com/fivedots/storage-foundation-api-explainer) - Filesystem Access API (extremely fast, Chrome only, other browser vendors have expressed interest, https://wicg.github.io/file-system-access/ https://wicg.github.io/file-system-access/) - Cache API (pretty fast, wide browser support, comes from the Service Worker spec, https://w3c.github.io/ServiceWorker/#cache https://w3c.github.io/ServiceWorker/#cache) - Indexed DB (slowest option, wide browser support, https://www.w3.org/TR/IndexedDB/ https://www.w3.org/TR/IndexedDB/) - In-memory storage (fastest performance, high memory usage (obviously), used as a fallback when disk is full or in private-browsing windows where storage is limited) The browser has become so powerful – with WebAssembly and powerful new browser APIs – that we think it's time to use some of that power to make web services more private and secure. It's a lot more work to build a service this way than the normal way, but we think it's worth it.
tosh 6y ago
kudos to the launch! do you have a pointer for Xylem?
- feross 6y ago
  Thanks. Yep, you can watch jhiesey give a talk about Xylem, his "semi-pure, functional reactive language" here: https://www.youtube.com/watch?v=XiEZ9_Cn5xU https://www.youtube.com/watch?v=XiEZ9_Cn5xU It comes after the talk from Dominic Tarr about Acid, his new "fun-oriented programming language".
  - tosh 6y ago
    ty!
neolog 6y ago
Pretty ridiculous to take the same name as another (more famous) product that does the same thing. Have you talked to a lawyer about changing the name?
Ni9ht_5ury 6y ago
how about adding something like an instant expire button which lets you expire the link before the 24 hr period. Great Tool!
- feross 6y ago
  This is a great idea!
jsilence 6y ago
Please consider rebranding.
ignoramous 6y ago
Wormhole.app looks great! I use P2P instant file sharing websites like webwormhole.io and file.pizza extensively and so this is a welcome upgrade. I used Pirate Bay's now-defunct uplovd.com and webtorrent-based instant.io for a while too! Wormhole.app is way better. Kudos. A request, if I may: Comms apps like WhatsApp / Email / Slack / Telegram are (ab)used for file-transfers because they instantly help send files to the intended recipient. With wormhole.app, if you could develop a UX similar to a chat-room where I could upload files and authorized participants could instantly download it, that'd be something. Couple questions: As with webtorrent.io and most of your other projects, is this going to be open-source or source-available? Does wormhole use WebRTC or rely on a mix of things like libp2p or webtorrent or something similar?

by feross 6y ago

nfsiddiqui 6y ago

what was the trickiest part to build?

feross 6y ago
We went to absurd lengths to make Wormhole fast and performant, without sacrificing security. All of the technical challenges we faced came from trying to accomplish these two goals simultaneously: - Build the absolute fastest way to send files - Deliver end-to-end encryption without any compromises Here's a bit more of the technical details: We use streaming encryption (specifically, the Encrypted Content-Encoding standard also used by the now defunct Firefox Send) so that we can keep memory utilization flat, no matter how large the file. Then, we take the end-to-end encrypted file data and simultaneously stream it to browser storage and our servers. When a downloader shows up before the file is fully uploaded, we use the browser copy of the data to stream your files to the downloader directly. This means that they can start downloading even before the files have been uploaded. For the direct peer-to-peer transfer, we use the WebTorrent protocol (which I created). All file data is end-to-end encrypted before leaving the device. It's encrypted yet again in transit by TLS or WebRTC, and also while at rest on our servers. We use a combination of browser storage options, depending on which is fastest and the amount of available disk space. We choose from the following storage strategies: - Storage Foundation API (fastest performance, experimental API, Chrome only for now, https://github.com/fivedots/storage-foundation-api-explainer https://github.com/fivedots/storage-foundation-api-explainer) - Filesystem Access API (extremely fast, Chrome only, other browser vendors have expressed interest, https://wicg.github.io/file-system-access/ https://wicg.github.io/file-system-access/) - Cache API (pretty fast, wide browser support, comes from the Service Worker spec, https://w3c.github.io/ServiceWorker/#cache https://w3c.github.io/ServiceWorker/#cache) - Indexed DB (slowest option, wide browser support, https://www.w3.org/TR/IndexedDB/ https://www.w3.org/TR/IndexedDB/) - In-memory storage (fastest performance, high memory usage (obviously), used as a fallback when disk is full or in private-browsing windows where storage is limited) The browser has become so powerful – with WebAssembly and powerful new browser APIs – that we think it's time to use some of that power to make web services more private and secure. It's a lot more work to build a service this way than the normal way, but we think it's worth it.

tosh 6y ago

kudos to the launch! do you have a pointer for Xylem?

feross 6y ago
Thanks. Yep, you can watch jhiesey give a talk about Xylem, his "semi-pure, functional reactive language" here: https://www.youtube.com/watch?v=XiEZ9_Cn5xU https://www.youtube.com/watch?v=XiEZ9_Cn5xU It comes after the talk from Dominic Tarr about Acid, his new "fun-oriented programming language".
- tosh 6y ago
  ty!

neolog 6y ago

Pretty ridiculous to take the same name as another (more famous) product that does the same thing. Have you talked to a lawyer about changing the name?

Ni9ht_5ury 6y ago

how about adding something like an instant expire button which lets you expire the link before the 24 hr period. Great Tool!

feross 6y ago
This is a great idea!

jsilence 6y ago

Please consider rebranding.

ignoramous 6y ago

Wormhole.app looks great! I use P2P instant file sharing websites like webwormhole.io and file.pizza extensively and so this is a welcome upgrade. I used Pirate Bay's now-defunct uplovd.com and webtorrent-based instant.io for a while too! Wormhole.app is way better. Kudos. A request, if I may: Comms apps like WhatsApp / Email / Slack / Telegram are (ab)used for file-transfers because they instantly help send files to the intended recipient. With wormhole.app, if you could develop a UX similar to a chat-room where I could upload files and authorized participants could instantly download it, that'd be something. Couple questions: As with webtorrent.io and most of your other projects, is this going to be open-source or source-available? Does wormhole use WebRTC or rely on a mix of things like libp2p or webtorrent or something similar?