ffsend: A fully featured Firefox Send command line client | Hacker News Reader

ffsend: A fully featured Firefox Send command line client

github.com

281 pointsarchb47 comments

If anyone is interested, after firefox send shutdown, i wrote https://www.relaysecret.com, its footprint is extremely small (1 lambda function that does all signing for s3 upload/download, simple frontend code that does encryption in browser using web crypto api with no 3rd party Js, no 3rd party css, no tracking. Anchor tag is used for additional random key material (so it wont leave ya browser and files will always be encrypted regardless).

You can roll your own too with the terraform code in it. It costs me barely anything (never go over free tier limit) to run it because files never live more than 10 days (there is a catchall lifecycle rule on the bucket) and when users select durations, i also put them in bucket prefix that has lifecycle rule place on objects under them for that duration. Note that we can't rely on lifecycle rule all the time so i also make sure when lambda is called to access the object, it checks the time-stamp, the duration and if it is meant to expire and not yet cleaned up by s3 - lambda function deletes it.

I learnt a ton of cool things about s3 after this neat little project and really dig the API, the lifecycle rule, signing url etc...

Ps: for these type of tool, you should definitely mitm it to see if plaintext file or password ever leave the browser... Relaysecret does leave one item unencrypted and that is the file name. You can change it upon upload but i like to leave it there so people know what they are downloading. I have simple idea of encrypting that with just the anchor key but haven't gotten around to put that in yet.

Very interesting, but why is the password optional? Doesn't it mean that someone with access to the S3 bucket can decrypt the data?

The file is encrypted before upload. The decryption key is supplied in an anchor tag. This is the case even if there's no password.

100% this but note that the user entered password is not included in the anchor tag so if you add a password, recipient still needs to enter the password to be able to decrypy and download ;)

Aha that is a great question! There are 2 parts of the key, one is the anchor tag key (the part behind # that you see in download url) and your password. The anchor tag key part is ALWAYS generated randomly in the browser so that your file will be encrypted no matter what even if you forget to enter password and hit upload.

Note that the anchor tag part does not leave the browser so it is one of the clever thing firefox send used to share some id/key. You can double check it in the network tab ;) If you are worry about that key being leaked somehow, adding a password ontop is a good measure.

That makes sense, thanks for clarifying!

Thank you for this. I just bookmarked it. When Send shut down I've constantly been searching for a better transfer program that doesn't require any client-side setup besides a link.

I've been using https://sendight.ml/ recently, but occasionally get corrupted files for reasons unbeknownst to me, but beyond that it's the best one I've found so far, no connection to them, just found it on a reddit thread.

Oh wow! I didn't know this reply got so much like, thank you! Sendlight.ml looks awesome and on that note, to make things easy to share between devices, i made a simple "tunnel" mode as well, you can try it here: https://www.relaysecret.com/tunnel

The way it works is super simple: the anchortag is base on the tunnel name (first round of sha256 if my memory serves me well) and the actual "tunnel id" is a few first characters of the second round of sha256. This way by enter the same "tunnel" both devices can share file without the need to share long complicated urls. The files in tunnel only lives up to a day.

Unlike sendlight though, it is not peer2peer webrtc and it is using the same lambda backend to create signed urls for s3 and encryption done in browser like before, just a neat little trick to have a simple way to setup "room" between devices ;)

I'm have been hosting Send for a long while at send.vis.ee. You might find it useful!

FYI the LinkedIn URL on your website is broken

cool web app, commenting to save for later

If you click on the timestamp of a comment there is an additional option to favourite a comment. These are then visible from your profile until you remove this toggle

thx!

send is nice but my favorite tool by far in this category is magic wormhole

https://magic-wormhole.readthedocs.io/en/latest/welcome.html

it only relies on a third party for a handshake rather than storing files online, so there's no limit to what you can send and it's probably less likely to go away.

Or croc!

https://github.com/schollz/croc

Yeah, I switched from magic wormhole to croc for simplicity/snappiness over magic wormhole. Static binaries!

croc it is!

Do you know how secure it is compared to Magic Wormhole?

I remember a few years ago reading a comparison between two file sharing apps, and if my memory serves me they were croc and Magic Wormhole. One of them had a litany of security holes but I don't remember which of them. I googled but couldn't find info on this.

I am very interested in hearing this. I always wondered what's what with MW.

AFAIK security experts swear by MW and don't like Croc as much, because of the wonky protocol, but don't quote me on this.

One for croc https://news.ycombinator.com/item?id=27052840#27056746

I use the go version[1] implementation, for a bit easier installation.

[1]: https://github.com/psanford/wormhole-william

I feel like I'm slowly becoming a Nix shill, but... Nix is a good alternative as well.

Install Nix in one command:

    sh <(curl -L https://nixos.org/nix/install) --no-daemon

Then run Magic Wormhole in one command, without even having to install it:

    nix-shell -p magic-wormhole --run 'wormhole send myfile'

I've been trying out Nix lately and did something similar to get a croc binary. My system package manager didn't have croc and also didn't have the Go version required to compile croc, but Nix did have the latest Go.

Ran this:

  nix-shell -p go --run "go install github.com/schollz/croc/v9@latest"

and got it compiled. In retrospect, I should have just used the croc package in Nix, but the simplicity of this approach is a vast improvement over the alternative of getting Go myself and cluttering up my system with random build tools for one-off compilations.

The go version has a really cool feature: wormhole-william send --qr <path/to/file>

This prints the password as a QR code. There's also an android version of wormhole-william which can process the QR codes.

send was pretty much inspired by magic wormhole.

The similar (but different) tool I use is Web Wormhole (https://webwormhole.io/#). It does the same thing but through a Web UI and uses WebRTC under the hood. Its great benefit over magic Wormhole is that the target doesn't need to install anything at all. If I'm having a Teams/Zoom/Jitsi call and I want to send a large file I can just send them a link and then drag and drop.

Portal does much of the same but is usually quicker in sending files than both croc and magic wormhole, since files are effectively compressed before sending among other things [note: I'm one of the creators of Portal].

https://github.com/SpatiumPortae/portal

That logo...

(cool software anyhow)

For the same purposes, I use a script I wrote that can be thought of as a simple self hosted FF Send alternative.

Allows you to easily upload files to your server from a web interface and share them.

It's a single PHP script you chuck on a server (shared hosting or virtual private or homelab): https://github.com/aaviator42/izi

It's somewhat funny how Mozilla uses "fx" for Firefox abbreviation while the rest of the world uses "ff".

Perhaps it's due to ffmpeg, or being oblivious to ffmpeg.

This is a client for connecting to alternate implementations of the original 'Firefox Send' filesharing service; not the current Firefox 'Send' service which just sends tabs between synced Firefox clients (unfortunate as I would find that useful).

Dev here. I'd be happy to answer any questions!

There is another file hosting application called plik.

https://github.com/root-gg/plik

It also supports login providers like Google and has cli clients.

This looks cool, and thank you for using rust and not js/npm.

I'm sorry, but isn't this just ftp re-invented?

Maybe this will be a dropbox killer!

Did Mozilla bring this back? Last I heard, Firefox Send was shut down due to malware/etc moderation issues.

https://support.mozilla.org/en-US/kb/what-happened-firefox-s...

> Firefox Send has been discontinued as of September 17th, 2020. You will no longer be able to upload or receive files. We’d like to thank all of you who tried Firefox Send.

> We started Firefox Send as a way for you to share files safely and easily from any browser. Unfortunately, some abusive users were beginning to use Firefox Send to ship malware and conduct phishing attacks. When this problem was reported, we stopped the service. Please see the Mozilla Blog for more details on why this service was discontinued.

Looks like there is a maintained fork here: https://github.com/timvisee/send

They ended the service, but you can host your own server -- which is what the developer of this package has done

That's valid enough, but if I'm hosting my own server and I'm happy with the command line then the use case for a tool like this gets very niche.

If I'm using the dev's server than that's pretty nice I guess.

I actually donate a nominal amount via github sponsors just to help support hosting costs since I find the utility useful -- specifically in my case for allowing people using my Binder notebooks to get their data out of the container without having to have a server of their own.

This is not the actual Firefox Send but rather just Send: https://send.vis.ee/

> This application is not affiliated with Firefox or Mozilla in any way.

So the title is somewhat wrong.

It seems like ffsend came before send.vis.ee, but the fork explicitly kept compatibility (see the readme at https://github.com/timvisee/send)

That's my understanding as well. ffsend was created as a client to the Mozilla-hosted filesharing service at send.firefox.com (now defunct). The server component was then forked and made self-hostable.

So that's how it is! Thanks for the clarification. :)

Reply on news.ycombinator.com