5 ms·

I think Wormhole William is great, also has a mobile app. But when I discovered croc, I switched to that, it has been very reliable. From the developer: AFAIK,

by pepa65 3y ago

I think Wormhole William is great, also has a mobile app. But when I discovered croc, I switched to that, it has been very reliable. From the developer: AFAIK, croc is the only CLI file-transfer tool does all of the following: - allows any two computers to transfer data (using a relay) - provides end-to-end encryption (using PAKE) - enables easy cross-platform transfers (Windows, Linux, Mac) - allows multiple file transfers - allows resuming transfers that are interrupted - does not require a server or port forwarding

tptacek 3y ago
Magic Wormhole: * Allows any two computers, NAT'd or otherwise, to transfer data * Invented the PAKE model that croc uses * Is cross-platform and runs on Windows * Allows multiple file transfers (directories) * Does not require a server or port forwarding. The thing croc does on this list that Magic Wormhole doesn't is resumption.
- ggeorgovassilis 3y ago
  AFAIK it doesn't support authentication for private relays
  - tptacek 3y ago
    Why do I care? All of these designs --- croc is "a Magic Wormhole" --- are end-to-end secure.
    - ggeorgovassilis 3y ago
      I can't tell you what _you_ should care about, but I wouldn't want to run an open relay everybody can abuse and eat up my traffic allowance.
- eduction 3y ago
  > Does not require a server or port forwarding. I’m probably missing something, new to magic wormhole, but this seems to contradict the docs on magic wormholes linked by the tool you recommended, wormhole william: “ The wormhole library requires a “Mailbox Server” (also known as the “Rendezvous Server”): a simple WebSocket-based relay that delivers messages from one client to another. This allows the wormhole codes to omit IP addresses and port numbers.“ https://magic-wormhole.readthedocs.io/en/latest/welcome.html#relays https://magic-wormhole.readthedocs.io/en/latest/welcome.html... Is this a particular library choice vs protocol choice? Wormhole william perhaps allows codes with ip addresses etc? What makes me wary about these tools is the way many of them seem to bake in a default relay server but aren’t up front about it (i want that discussed in the readme.md, it’s a big deal, even if they can’t read the payload - presumably they can see which two IPs are communicating which should be absolutely disclosed). Like, to me it’s not “magic” to route stuff through a relay server. That’s the whole thing I want “magic” to avoid. (Also it doesn’t seem at all like a “wormhole” - the nomenclature strikes me as insanely grandiose)
  - tptacek 3y ago
    That's how croc works, too. You can run your own Magic Wormhole relay. These tools all have the same fundamental design. What's magic-seeming about them is that you can be deep in a prod network, with tightly controlled ACLs and no routable address, and just "wormhole server.log", and then on your dev laptop on your random home wireless type, like, "wormhole receive 32-hazardous-baboon" and poof! you have "server.log". It feels pretty magical, which is why it has the name. Croc doesn't change any of that. What croc does differently from Wormhole is that it handles resumption, and you can apparently send a globbed list of files rather than just a file or a directory. Resumption is a real feature (I'd like to know more about how the cryptography works, though). The multi-file thing is a UX tweak. Croc has a bunch of knobs to change cryptography primitives. Those are anti-features. You can password-authenticate a custom croc relay. I don't know why you'd ever care. Maybe this is an abuse concern? These are all E2EE designs. You don't trust the server in the first place. It's like a STUN/TURN server.
- d-z-m 3y ago
  > Invented the PAKE model that croc uses Nit: Magic Wormhole pioneered SPAKE2's application in a file transfer utility, but the actual invention of SPAKE2 predates Magic Wormhole.
  - tptacek 3y ago
    I don't mean that they invented PAKE's, I mean that they invented this application of PAKEs (I'd say: one of the very few genuinely useful PAKE use cases).
bobbylarrybobby 3y ago
One thing missing from this list: a GitHub readme with a how-to. Magic wormhole makes you visit ReadTheDocs
- tptacek 3y ago
  `wormhole send <filename>` The output of the command tells you what to do next. They really nailed the UX on this.

by pepa65 3y ago

tptacek 3y ago

Magic Wormhole: * Allows any two computers, NAT'd or otherwise, to transfer data * Invented the PAKE model that croc uses * Is cross-platform and runs on Windows * Allows multiple file transfers (directories) * Does not require a server or port forwarding. The thing croc does on this list that Magic Wormhole doesn't is resumption.

ggeorgovassilis 3y ago
AFAIK it doesn't support authentication for private relays
- tptacek 3y ago
  Why do I care? All of these designs --- croc is "a Magic Wormhole" --- are end-to-end secure.
  - ggeorgovassilis 3y ago
    I can't tell you what _you_ should care about, but I wouldn't want to run an open relay everybody can abuse and eat up my traffic allowance.
eduction 3y ago
> Does not require a server or port forwarding. I’m probably missing something, new to magic wormhole, but this seems to contradict the docs on magic wormholes linked by the tool you recommended, wormhole william: “ The wormhole library requires a “Mailbox Server” (also known as the “Rendezvous Server”): a simple WebSocket-based relay that delivers messages from one client to another. This allows the wormhole codes to omit IP addresses and port numbers.“ https://magic-wormhole.readthedocs.io/en/latest/welcome.html#relays https://magic-wormhole.readthedocs.io/en/latest/welcome.html... Is this a particular library choice vs protocol choice? Wormhole william perhaps allows codes with ip addresses etc? What makes me wary about these tools is the way many of them seem to bake in a default relay server but aren’t up front about it (i want that discussed in the readme.md, it’s a big deal, even if they can’t read the payload - presumably they can see which two IPs are communicating which should be absolutely disclosed). Like, to me it’s not “magic” to route stuff through a relay server. That’s the whole thing I want “magic” to avoid. (Also it doesn’t seem at all like a “wormhole” - the nomenclature strikes me as insanely grandiose)
- tptacek 3y ago
  That's how croc works, too. You can run your own Magic Wormhole relay. These tools all have the same fundamental design. What's magic-seeming about them is that you can be deep in a prod network, with tightly controlled ACLs and no routable address, and just "wormhole server.log", and then on your dev laptop on your random home wireless type, like, "wormhole receive 32-hazardous-baboon" and poof! you have "server.log". It feels pretty magical, which is why it has the name. Croc doesn't change any of that. What croc does differently from Wormhole is that it handles resumption, and you can apparently send a globbed list of files rather than just a file or a directory. Resumption is a real feature (I'd like to know more about how the cryptography works, though). The multi-file thing is a UX tweak. Croc has a bunch of knobs to change cryptography primitives. Those are anti-features. You can password-authenticate a custom croc relay. I don't know why you'd ever care. Maybe this is an abuse concern? These are all E2EE designs. You don't trust the server in the first place. It's like a STUN/TURN server.
d-z-m 3y ago
> Invented the PAKE model that croc uses Nit: Magic Wormhole pioneered SPAKE2's application in a file transfer utility, but the actual invention of SPAKE2 predates Magic Wormhole.
- tptacek 3y ago
  I don't mean that they invented PAKE's, I mean that they invented this application of PAKEs (I'd say: one of the very few genuinely useful PAKE use cases).

bobbylarrybobby 3y ago

One thing missing from this list: a GitHub readme with a how-to. Magic wormhole makes you visit ReadTheDocs

tptacek 3y ago
`wormhole send <filename>` The output of the command tells you what to do next. They really nailed the UX on this.