Everyone feel free to run a tcpdump dump of the traffic if you want confirmation thats not from the guy who made the service.
I wouldn't have thought to ask that. My original concern was: how do you assure someone like me that an attacker can't redirect files to other locations?
* It's Diffie Hellman for key agreement, which is trivially MITM'd (odds are, you can even zero out the DH key and it won't notice).
* It uses AES in CBC mode with all-zeroes IV's (so it's less secure than CBC mode).
* It's using a 16 bit CRC for message integrity checks instead of a cryptographic MAC.
I say all this with the caveat that I could be misreading Cumulus or Cumulus could have it wrong, but if this is where RTMFP is today, then Sendoid is substantially less secure than an HTTPS file transfer site.