11 ms·

ffsend: A fully featured Firefox Send command line client

281 points by archb 4y ago

robonerd 4y ago
Did Mozilla bring this back? Last I heard, Firefox Send was shut down due to malware/etc moderation issues. https://support.mozilla.org/en-US/kb/what-happened-firefox-send https://support.mozilla.org/en-US/kb/what-happened-firefox-s... > Firefox Send has been discontinued as of September 17th, 2020. You will no longer be able to upload or receive files. We’d like to thank all of you who tried Firefox Send. > We started Firefox Send as a way for you to share files safely and easily from any browser. Unfortunately, some abusive users were beginning to use Firefox Send to ship malware and conduct phishing attacks. When this problem was reported, we stopped the service. Please see the Mozilla Blog for more details on why this service was discontinued.
- saghul 4y ago
  Looks like there is a maintained fork here: https://github.com/timvisee/send https://github.com/timvisee/send
- cbkeller 4y ago
  They ended the service, but you can host your own server -- which is what the developer of this package has done
  - Dylan16807 4y ago
    That's valid enough, but if I'm hosting my own server and I'm happy with the command line then the use case for a tool like this gets very niche. If I'm using the dev's server than that's pretty nice I guess.
    - cbkeller 4y ago
      I actually donate a nominal amount via github sponsors just to help support hosting costs since I find the utility useful -- specifically in my case for allowing people using my Binder notebooks to get their data out of the container without having to have a server of their own.
- ask_b123 4y ago
  This is not the actual Firefox Send but rather just Send: https://send.vis.ee/ https://send.vis.ee/ > This application is not affiliated with Firefox or Mozilla in any way. So the title is somewhat wrong.
  - yccs27 4y ago
    It seems like ffsend came before send.vis.ee, but the fork explicitly kept compatibility (see the readme at https://github.com/timvisee/send https://github.com/timvisee/send)
    - VWWHFSfQ 4y ago
      That's my understanding as well. ffsend was created as a client to the Mozilla-hosted filesharing service at send.firefox.com (now defunct). The server component was then forked and made self-hostable.
    - ask_b123 4y ago
      So that's how it is! Thanks for the clarification. :)
Barrin92 4y ago
send is nice but my favorite tool by far in this category is magic wormhole https://magic-wormhole.readthedocs.io/en/latest/welcome.html https://magic-wormhole.readthedocs.io/en/latest/welcome.html it only relies on a third party for a handshake rather than storing files online, so there's no limit to what you can send and it's probably less likely to go away.
- smw 4y ago
  Or croc! https://github.com/schollz/croc https://github.com/schollz/croc
  - alexeldeib 4y ago
    Yeah, I switched from magic wormhole to croc for simplicity/snappiness over magic wormhole. Static binaries!
  - unicornporn 4y ago
    croc it is!
  - throwamon 4y ago
    Do you know how secure it is compared to Magic Wormhole? I remember a few years ago reading a comparison between two file sharing apps, and if my memory serves me they were croc and Magic Wormhole. One of them had a litany of security holes but I don't remember which of them. I googled but couldn't find info on this.
    - 0des 4y ago
      I am very interested in hearing this. I always wondered what's what with MW.
    - stavros 4y ago
      AFAIK security experts swear by MW and don't like Croc as much, because of the wonky protocol, but don't quote me on this.
    - 4y ago
aaviator42 4y ago
For the same purposes, I use a script I wrote that can be thought of as a simple self hosted FF Send alternative. Allows you to easily upload files to your server from a web interface and share them. It's a single PHP script you chuck on a server (shared hosting or virtual private or homelab): https://github.com/aaviator42/izi https://github.com/aaviator42/izi
ebfe1 4y ago
If anyone is interested, after firefox send shutdown, i wrote https://www.relaysecret.com https://www.relaysecret.com, its footprint is extremely small (1 lambda function that does all signing for s3 upload/download, simple frontend code that does encryption in browser using web crypto api with no 3rd party Js, no 3rd party css, no tracking. Anchor tag is used for additional random key material (so it wont leave ya browser and files will always be encrypted regardless). You can roll your own too with the terraform code in it. It costs me barely anything (never go over free tier limit) to run it because files never live more than 10 days (there is a catchall lifecycle rule on the bucket) and when users select durations, i also put them in bucket prefix that has lifecycle rule place on objects under them for that duration. Note that we can't rely on lifecycle rule all the time so i also make sure when lambda is called to access the object, it checks the time-stamp, the duration and if it is meant to expire and not yet cleaned up by s3 - lambda function deletes it. I learnt a ton of cool things about s3 after this neat little project and really dig the API, the lifecycle rule, signing url etc... Ps: for these type of tool, you should definitely mitm it to see if plaintext file or password ever leave the browser... Relaysecret does leave one item unencrypted and that is the file name. You can change it upon upload but i like to leave it there so people know what they are downloading. I have simple idea of encrypting that with just the anchor key but haven't gotten around to put that in yet.
- laurent123456 4y ago
  Very interesting, but why is the password optional? Doesn't it mean that someone with access to the S3 bucket can decrypt the data?
  - rahimnathwani 4y ago
    The file is encrypted before upload. The decryption key is supplied in an anchor tag. This is the case even if there's no password.
    - ebfe1 4y ago
      100% this but note that the user entered password is not included in the anchor tag so if you add a password, recipient still needs to enter the password to be able to decrypy and download ;)
MrYellowP 4y ago
I'm sorry, but isn't this just ftp re-invented?
- ddtaylor 4y ago
  Maybe this will be a dropbox killer!
isjamesalive 4y ago
This looks cool, and thank you for using rust and not js/npm.
- deleted 4y ago
  [deleted]
ghostly_s 4y ago
This is a client for connecting to alternate implementations of the original 'Firefox Send' filesharing service; not the current Firefox 'Send' service which just sends tabs between synced Firefox clients (unfortunate as I would find that useful).
hericium 4y ago
It's somewhat funny how Mozilla uses "fx" for Firefox abbreviation while the rest of the world uses "ff".
- Maursault 4y ago
  Perhaps it's due to ffmpeg, or being oblivious to ffmpeg.
sexy_panda 4y ago
There is another file hosting application called plik. https://github.com/root-gg/plik https://github.com/root-gg/plik It also supports login providers like Google and has cli clients.
timvisee 4y ago
Dev here. I'd be happy to answer any questions!

281 points by archb 4y ago

Did Mozilla bring this back? Last I heard, Firefox Send was shut down due to malware/etc moderation issues. https://support.mozilla.org/en-US/kb/what-happened-firefox-send https://support.mozilla.org/en-US/kb/what-happened-firefox-s... > Firefox Send has been discontinued as of September 17th, 2020. You will no longer be able to upload or receive files. We’d like to thank all of you who tried Firefox Send. > We started Firefox Send as a way for you to share files safely and easily from any browser. Unfortunately, some abusive users were beginning to use Firefox Send to ship malware and conduct phishing attacks. When this problem was reported, we stopped the service. Please see the Mozilla Blog for more details on why this service was discontinued.

saghul 4y ago
Looks like there is a maintained fork here: https://github.com/timvisee/send https://github.com/timvisee/send
cbkeller 4y ago
They ended the service, but you can host your own server -- which is what the developer of this package has done
- Dylan16807 4y ago
  That's valid enough, but if I'm hosting my own server and I'm happy with the command line then the use case for a tool like this gets very niche. If I'm using the dev's server than that's pretty nice I guess.
  - cbkeller 4y ago
    I actually donate a nominal amount via github sponsors just to help support hosting costs since I find the utility useful -- specifically in my case for allowing people using my Binder notebooks to get their data out of the container without having to have a server of their own.
ask_b123 4y ago
This is not the actual Firefox Send but rather just Send: https://send.vis.ee/ https://send.vis.ee/ > This application is not affiliated with Firefox or Mozilla in any way. So the title is somewhat wrong.
- yccs27 4y ago
  It seems like ffsend came before send.vis.ee, but the fork explicitly kept compatibility (see the readme at https://github.com/timvisee/send https://github.com/timvisee/send)
  - VWWHFSfQ 4y ago
    That's my understanding as well. ffsend was created as a client to the Mozilla-hosted filesharing service at send.firefox.com (now defunct). The server component was then forked and made self-hostable.
  - ask_b123 4y ago
    So that's how it is! Thanks for the clarification. :)

Barrin92 4y ago

send is nice but my favorite tool by far in this category is magic wormhole https://magic-wormhole.readthedocs.io/en/latest/welcome.html https://magic-wormhole.readthedocs.io/en/latest/welcome.html it only relies on a third party for a handshake rather than storing files online, so there's no limit to what you can send and it's probably less likely to go away.

smw 4y ago
Or croc! https://github.com/schollz/croc https://github.com/schollz/croc
- alexeldeib 4y ago
  Yeah, I switched from magic wormhole to croc for simplicity/snappiness over magic wormhole. Static binaries!
- unicornporn 4y ago
  croc it is!
- throwamon 4y ago
  Do you know how secure it is compared to Magic Wormhole? I remember a few years ago reading a comparison between two file sharing apps, and if my memory serves me they were croc and Magic Wormhole. One of them had a litany of security holes but I don't remember which of them. I googled but couldn't find info on this.
  - 0des 4y ago
    I am very interested in hearing this. I always wondered what's what with MW.
  - stavros 4y ago
    AFAIK security experts swear by MW and don't like Croc as much, because of the wonky protocol, but don't quote me on this.
  - 4y ago

aaviator42 4y ago

For the same purposes, I use a script I wrote that can be thought of as a simple self hosted FF Send alternative. Allows you to easily upload files to your server from a web interface and share them. It's a single PHP script you chuck on a server (shared hosting or virtual private or homelab): https://github.com/aaviator42/izi https://github.com/aaviator42/izi

ebfe1 4y ago

If anyone is interested, after firefox send shutdown, i wrote https://www.relaysecret.com https://www.relaysecret.com, its footprint is extremely small (1 lambda function that does all signing for s3 upload/download, simple frontend code that does encryption in browser using web crypto api with no 3rd party Js, no 3rd party css, no tracking. Anchor tag is used for additional random key material (so it wont leave ya browser and files will always be encrypted regardless). You can roll your own too with the terraform code in it. It costs me barely anything (never go over free tier limit) to run it because files never live more than 10 days (there is a catchall lifecycle rule on the bucket) and when users select durations, i also put them in bucket prefix that has lifecycle rule place on objects under them for that duration. Note that we can't rely on lifecycle rule all the time so i also make sure when lambda is called to access the object, it checks the time-stamp, the duration and if it is meant to expire and not yet cleaned up by s3 - lambda function deletes it. I learnt a ton of cool things about s3 after this neat little project and really dig the API, the lifecycle rule, signing url etc... Ps: for these type of tool, you should definitely mitm it to see if plaintext file or password ever leave the browser... Relaysecret does leave one item unencrypted and that is the file name. You can change it upon upload but i like to leave it there so people know what they are downloading. I have simple idea of encrypting that with just the anchor key but haven't gotten around to put that in yet.

laurent123456 4y ago
Very interesting, but why is the password optional? Doesn't it mean that someone with access to the S3 bucket can decrypt the data?
- rahimnathwani 4y ago
  The file is encrypted before upload. The decryption key is supplied in an anchor tag. This is the case even if there's no password.
  - ebfe1 4y ago
    100% this but note that the user entered password is not included in the anchor tag so if you add a password, recipient still needs to enter the password to be able to decrypy and download ;)

MrYellowP 4y ago

I'm sorry, but isn't this just ftp re-invented?

ddtaylor 4y ago
Maybe this will be a dropbox killer!

isjamesalive 4y ago

This looks cool, and thank you for using rust and not js/npm.

deleted 4y ago
[deleted]

ghostly_s 4y ago

This is a client for connecting to alternate implementations of the original 'Firefox Send' filesharing service; not the current Firefox 'Send' service which just sends tabs between synced Firefox clients (unfortunate as I would find that useful).

hericium 4y ago

It's somewhat funny how Mozilla uses "fx" for Firefox abbreviation while the rest of the world uses "ff".

Maursault 4y ago
Perhaps it's due to ffmpeg, or being oblivious to ffmpeg.

sexy_panda 4y ago

There is another file hosting application called plik. https://github.com/root-gg/plik https://github.com/root-gg/plik It also supports login providers like Google and has cli clients.

timvisee 4y ago

Dev here. I'd be happy to answer any questions!