Firefox Send - Simple, private file sharing from the makers of Firefox

[girish]

@3246 I remember looking into this project before. Issue is that it has no concept of authentication. Essentially, you have to set up something where anyone can upload anything. This is dangerous especially for Cloudron because some DMCA notice or equivalent will ban your entire server and not just the send instance.

See also https://github.com/timvisee/send/issues/32 and https://github.com/timvisee/send/issues/108 . IMO, best to just host this outside Cloudron in a separate server.

[jdaviescoates]

@3246 said in Firefox Send - Simple, private file sharing from the makers of Firefox:

Jirafeau (also, I can never remember how to spell it)

Why do you need to know how to spell it? e.g. I have my instance installed at https://fileshare.domain.tld

[jdaviescoates]

@girish said in Firefox Send - Simple, private file sharing from the makers of Firefox:

@3246 I remember looking into this project before. Issue is that it has no concept of authentication.

Surely on Cloudron that wouldn't be a problem as it could use Cloudron's built in proxy auth or whatever it's called? (like you already do with lots of other apps without auth)

@girish said in Firefox Send - Simple, private file sharing from the makers of Firefox:

See also https://github.com/timvisee/send/issues/32

Via that I found this similar tool which does have simple authentication options:

https://github.com/psi-4ward/psitransfer/
https://psi.cx/2017/psitransfer-installation/

It's a dockerized node app so should be simple to package for Cloudron, I'd guess.

[3246]

@jdaviescoates said in Firefox Send - Simple, private file sharing from the makers of Firefox:

Why do you need to know how to spell it? e.g. I have my instance installed at https://fileshare.domain.tld

It was meant as a bit of a joke, yes I have called it wetransfer.domain.tld because most folks here know what that means

[jdaviescoates]

@3246 said in Firefox Send - Simple, private file sharing from the makers of Firefox:

@jdaviescoates said in Firefox Send - Simple, private file sharing from the makers of Firefox:

Why do you need to know how to spell it? e.g. I have my instance installed at https://fileshare.domain.tld

It was meant as a bit of a joke, yes I have called it wetransfer.domain.tld because most folks here know what that means

[3246]

@girish Interesting point I never considered as I'd be using the Send app for known users and not publicising it. Although I am not stopping anyone who finds it from using it... something I should really curtail, but the risk of that is low.

I think the DMCA issue can be tackled with a disclaimer before users install the app?

[jdaviescoates]

@3246 said in Firefox Send - Simple, private file sharing from the makers of Firefox:

I think the DMCA issue can be tackled with a disclaimer before users install the app?

Yeah, and we already have Jirafeau and Surfer and Calibre Web and Emby and Jellyfin and SickChill and loads of other apps that could easily be used to share files you're technically not supposed to be sharing! (and frankly, almost certainly are being used to do exactly that)

[girish]

@jdaviescoates Apparently, none of the client side works if you put an auth wall in the front (from my reading of the github issues I linked previously). It's meant to be a public site as it stands it seems.

To be clear, I have nothing against this on Cloudron, but it's low priority atm since I suspect it's quite dangerous to run this on a Cloudron instance (maybe I am not understanding how it's deployed). You might think your instance is private, but your file link will get passed around and anyone can upload anything.

[jdaviescoates]

@girish said in Firefox Send - Simple, private file sharing from the makers of Firefox:

it's low priority atm

Yeah that doesn't bother me since Jirafeau does the job (at least for me)

since I suspect it's quite dangerous to run this on a Cloudron instance (maybe I am not understanding how it's deployed). You might think your instance is private, but your file link will get passed around and anyone can upload anything.

I think lots of us are already running public instances of Jirafeau tbh. I don't get what is so different/ more dangerous about Firefox Send?

[girish]

@jdaviescoates said in Firefox Send - Simple, private file sharing from the makers of Firefox:

I think lots of us are already running public instances of Jirafeau tbh. I don't get what is so different/ more dangerous about Firefox Send?

You can restrict uploads in Jirafeau - https://docs.cloudron.io/apps/jirafeau/#restricting-uploads . These things are usually only a problem only when it hits you and then it's very hard to "fix" since the service provider won't listen. For example, there have been many posts here in the past about insecure website warning from Google Chrome because of bad content hosted (by mistake) or A records pointing to some other server.

[chetbaker]

hello folks, I'm sorry to revive this old thread but today I found this fork that seems interesting:

https://github.com/timvisee/send

[guyds]

@chetbaker thanks for the input but I'm afraid this isn't anything new, cfr the posts by girish and necrevistonnezr

[girish]

Is that fork active? last commit was 8 months ago

[jdaviescoates]

Just out of interest I went to see if there were any other actively maintained forks...

But what I found at https://github.com/mozilla/send/forks?include=active&page=1&period=2y&sort_by=last_updated was very confusing.

This shows as the most recently updated one, updated 8 hours ago:

But when you actually go there the most recent commit was 3 years ago

Ah! It was just an automated PR: