Hacker News Reader

Comment by huhtenberg | Hacker News Reader

As per [1] from below -

Apparently it's a nag-based paid software with an otherwise restricted feature set. This is not clearly explained on the page.

In fact, it looks like the site goes out of its way to try and pass for free software - the Demo is NOT of what you are actually downloading, no pricing info, no mention of Basic vs Full versions anywhere, including the Docs, except for an dull looking blurb at the very bottom on the home page -

    License

    Files is free to use with basic features. To remove the 
    license-popup and unlock additional features, you may 
    purchase a license [$39] from within the app.

The page also pulls a lot of scripts off the Internet on every load, so that too is not explained anywhere clearly and it's absolutely not good for hosting private photo archives.

Despite its good looks it kinda leaves bad aftertaste because of all these shady shenanigans.

[1] https://news.ycombinator.com/item?id=30235138

View on HN

There is also this gem.

> Add username and password to protect your Files app by login. You can encrypt your password by using our md5() hash tool if you don't want the password to be exposed in the PHP file.

Now I realize it's probably not using md5, but it does not bode well.

[1] https://www.files.gallery/docs/config/#password

It looks like it links down to the PHP `password_hash` function, and there's this gem in the documentation [0]:

> If your pepper contains 128 bits of entropy, and so long as hmac-sha256 remains secure (even MD5 is technically secure for use in hmac: only its collision resistance is broken, but of course nobody would use MD5 because more and more flaws are found)...

Which means whoever developed this file photo app may have read this clear shot at MD5, and still used it anyways. That's kinda funny.

[0] https://www.php.net/manual/en/function.password-hash.php

I checked, they use md5 extensively.

md5() is used to hash names for cache, not for anything security related. For login, it uses PHP password_verify()

For most of the 2000’s shareware was the default software revenue model. I vastly prefer it to today’s subscription soup.

Then maybe put a 'Purchase' button in the navbar. It's very easy to miss the 'license' portion at the bottom of the page.

> The page also pulls a lot of scripts off the Internet on every load

It loads 14 resources from https://cdn.jsdelivr.net/npm/

Does that make it a 15-file photo gallery and file manager?

Absolutely.

This also makes it completely broken if these dependencies are inaccessible or go missing.

Or, god forbid, a supply chain attack on your file manager. Thankfully, it's using pinned versions, so it's not as bad as if could be.

> The page also pulls a lot of scripts off the Internet on every load, so that too is not explained anywhere clearly and it's absolutely not good for hosting private photo archives.

Well to be fair, that can be explained by the whole 'drop this PHP file in and wham' model they are going for. Personally I would not advertise / make something like this as the single-file model becomes more and more of a constraint as the project evolves. It feels needlessly limited just to fit the single-file goal.

They could bundle all the JS into the PHP file, though.

In my more noobie days, I had PHP _generate_ JS.

No pricing info?

"Files is free to use with basic features. To remove the license-popup and unlock additional features, you may purchase a license [$39] from within the app."

I've not tried this but as it's php, couldn't you just edit the file?

Not really. This index.php is just a wrapper as it will refer their .js/.php which you have no control of. To use it fully you'll have to write those as well, at which point you can just start from scratch on your own terms.

So is it running arbitrary PHP on my server if I run this?

Something like that.

Of course not. Index PHP contains ALL the PHP, while CSS and Javascript are loaded into the browser for the interface.

> No pricing info?

Not clearly visible until you scroll down to the very bottom, no. Most paid projects like this (that I have seen, anyway) have clear pricing info on the front page, or at least a Pricing item in the navigation bar. This site has neither. I feel like this is a bit misleading as you're immediately told to download the file, then perhaps discover that it is paid software later (or once you've already installed it), but I am willing to assume incompetence on the developer's part here.

Shareware

Hidden shareware. Kind of bad.

Most shareware was nagware

WinRAR was a great example. Now we have 7zip and PeaZip. Things evolve.

Before that, we had WinZip, which is still around and trying to sell its program suite.

Most shareware was upfront about being paid.

Reply on news.ycombinator.com