6 ms·

As per [1] from below - Apparently it's a nag-based paid software with an otherwise restricted feature set. This is not clearly explained on the page. In fact

As per [1] from below - Apparently it's a nag-based paid software with an otherwise restricted feature set. This is not clearly explained on the page. In fact, it looks like the site goes out of its way to try and pass for free software - the Demo is NOT of what you are actually downloading, no pricing info, no mention of Basic vs Full versions anywhere, including the Docs, except for an dull looking blurb at the very bottom on the home page - License Files is free to use with basic features. To remove the license-popup and unlock additional features, you may purchase a license [$39] from within the app. The page also pulls a lot of scripts off the Internet on every load, so that too is not explained anywhere clearly and it's absolutely not good for hosting private photo archives. Despite its good looks it kinda leaves bad aftertaste because of all these shady shenanigans. [1] https://news.ycombinator.com/item?id=30235138 https://news.ycombinator.com/item?id=30235138

jdrc 5y ago
Shareware
- oblio 5y ago
  Hidden shareware. Kind of bad.
  - jdrc 5y ago
    Most shareware was nagware
    - tentacleuno 5y ago
      WinRAR was a great example. Now we have 7zip and PeaZip. Things evolve.
      - simon04 5y ago
        Before that, we had WinZip, which is still around and trying to sell its program suite.
    - eps 5y ago
      Most shareware was upfront about being paid.
marban 5y ago
No pricing info? "Files is free to use with basic features. To remove the license-popup and unlock additional features, you may purchase a license [$39] from within the app."
- aembleton 5y ago
  I've not tried this but as it's php, couldn't you just edit the file?
  - unnouinceput 5y ago
    Not really. This index.php is just a wrapper as it will refer their .js/.php which you have no control of. To use it fully you'll have to write those as well, at which point you can just start from scratch on your own terms.
    - ReactiveJelly 5y ago
      So is it running arbitrary PHP on my server if I run this?
      - unnouinceput 5y ago
        Something like that.
      - mjau-mjau 5y ago
        Of course not. Index PHP contains ALL the PHP, while CSS and Javascript are loaded into the browser for the interface.
- tentacleuno 5y ago
  > No pricing info? Not clearly visible until you scroll down to the very bottom, no. Most paid projects like this (that I have seen, anyway) have clear pricing info on the front page, or at least a Pricing item in the navigation bar. This site has neither. I feel like this is a bit misleading as you're immediately told to download the file, then perhaps discover that it is paid software later (or once you've already installed it), but I am willing to assume incompetence on the developer's part here.
syoc 5y ago
There is also this gem. > Add username and password to protect your Files app by login. You can encrypt your password by using our md5() hash tool if you don't want the password to be exposed in the PHP file. Now I realize it's probably not using md5, but it does not bode well. [1] https://www.files.gallery/docs/config/#password https://www.files.gallery/docs/config/#password
- easrng 5y ago
  I checked, they use md5 extensively.
  - mjau-mjau 5y ago
    md5() is used to hash names for cache, not for anything security related. For login, it uses PHP password_verify()
- seanw444 5y ago
  It looks like it links down to the PHP `password_hash` function, and there's this gem in the documentation [0]: > If your pepper contains 128 bits of entropy, and so long as hmac-sha256 remains secure (even MD5 is technically secure for use in hmac: only its collision resistance is broken, but of course nobody would use MD5 because more and more flaws are found)... Which means whoever developed this file photo app may have read this clear shot at MD5, and still used it anyways. That's kinda funny. [0] https://www.php.net/manual/en/function.password-hash.php https://www.php.net/manual/en/function.password-hash.php
callalex 5y ago
For most of the 2000’s shareware was the default software revenue model. I vastly prefer it to today’s subscription soup.
- judge2020 5y ago
  Then maybe put a 'Purchase' button in the navbar. It's very easy to miss the 'license' portion at the bottom of the page.
tentacleuno 5y ago
> The page also pulls a lot of scripts off the Internet on every load, so that too is not explained anywhere clearly and it's absolutely not good for hosting private photo archives. Well to be fair, that can be explained by the whole 'drop this PHP file in and wham' model they are going for. Personally I would not advertise / make something like this as the single-file model becomes more and more of a constraint as the project evolves. It feels needlessly limited just to fit the single-file goal.
- ReactiveJelly 5y ago
  They could bundle all the JS into the PHP file, though. In my more noobie days, I had PHP _generate_ JS.
simon04 5y ago
> The page also pulls a lot of scripts off the Internet on every load It loads 14 resources from https://cdn.jsdelivr.net/npm/ https://cdn.jsdelivr.net/npm/
- klyrs 5y ago
  Does that make it a 15-file photo gallery and file manager?
  - eps 5y ago
    Absolutely. This also makes it completely broken if these dependencies are inaccessible or go missing.
    - klyrs 5y ago
      Or, god forbid, a supply chain attack on your file manager. Thankfully, it's using pinned versions, so it's not as bad as if could be.
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]

jdrc 5y ago

Shareware

oblio 5y ago
Hidden shareware. Kind of bad.
- jdrc 5y ago
  Most shareware was nagware
  - tentacleuno 5y ago
    WinRAR was a great example. Now we have 7zip and PeaZip. Things evolve.
    - simon04 5y ago
      Before that, we had WinZip, which is still around and trying to sell its program suite.
  - eps 5y ago
    Most shareware was upfront about being paid.

marban 5y ago

No pricing info? "Files is free to use with basic features. To remove the license-popup and unlock additional features, you may purchase a license [$39] from within the app."

aembleton 5y ago
I've not tried this but as it's php, couldn't you just edit the file?
- unnouinceput 5y ago
  Not really. This index.php is just a wrapper as it will refer their .js/.php which you have no control of. To use it fully you'll have to write those as well, at which point you can just start from scratch on your own terms.
  - ReactiveJelly 5y ago
    So is it running arbitrary PHP on my server if I run this?
    - unnouinceput 5y ago
      Something like that.
    - mjau-mjau 5y ago
      Of course not. Index PHP contains ALL the PHP, while CSS and Javascript are loaded into the browser for the interface.
tentacleuno 5y ago
> No pricing info? Not clearly visible until you scroll down to the very bottom, no. Most paid projects like this (that I have seen, anyway) have clear pricing info on the front page, or at least a Pricing item in the navigation bar. This site has neither. I feel like this is a bit misleading as you're immediately told to download the file, then perhaps discover that it is paid software later (or once you've already installed it), but I am willing to assume incompetence on the developer's part here.

syoc 5y ago

There is also this gem. > Add username and password to protect your Files app by login. You can encrypt your password by using our md5() hash tool if you don't want the password to be exposed in the PHP file. Now I realize it's probably not using md5, but it does not bode well. [1] https://www.files.gallery/docs/config/#password https://www.files.gallery/docs/config/#password

easrng 5y ago
I checked, they use md5 extensively.
- mjau-mjau 5y ago
  md5() is used to hash names for cache, not for anything security related. For login, it uses PHP password_verify()
seanw444 5y ago
It looks like it links down to the PHP `password_hash` function, and there's this gem in the documentation [0]: > If your pepper contains 128 bits of entropy, and so long as hmac-sha256 remains secure (even MD5 is technically secure for use in hmac: only its collision resistance is broken, but of course nobody would use MD5 because more and more flaws are found)... Which means whoever developed this file photo app may have read this clear shot at MD5, and still used it anyways. That's kinda funny. [0] https://www.php.net/manual/en/function.password-hash.php https://www.php.net/manual/en/function.password-hash.php

callalex 5y ago

For most of the 2000’s shareware was the default software revenue model. I vastly prefer it to today’s subscription soup.

judge2020 5y ago
Then maybe put a 'Purchase' button in the navbar. It's very easy to miss the 'license' portion at the bottom of the page.

tentacleuno 5y ago

> The page also pulls a lot of scripts off the Internet on every load, so that too is not explained anywhere clearly and it's absolutely not good for hosting private photo archives. Well to be fair, that can be explained by the whole 'drop this PHP file in and wham' model they are going for. Personally I would not advertise / make something like this as the single-file model becomes more and more of a constraint as the project evolves. It feels needlessly limited just to fit the single-file goal.

ReactiveJelly 5y ago
They could bundle all the JS into the PHP file, though. In my more noobie days, I had PHP _generate_ JS.

simon04 5y ago

> The page also pulls a lot of scripts off the Internet on every load It loads 14 resources from https://cdn.jsdelivr.net/npm/ https://cdn.jsdelivr.net/npm/

klyrs 5y ago
Does that make it a 15-file photo gallery and file manager?
- eps 5y ago
  Absolutely. This also makes it completely broken if these dependencies are inaccessible or go missing.
  - klyrs 5y ago
    Or, god forbid, a supply chain attack on your file manager. Thankfully, it's using pinned versions, so it's not as bad as if could be.

deleted 5y ago

[deleted]

deleted 5y ago
[deleted]