Hacker News Reader

Comment by tptacek | Hacker News Reader

A more popular and, I think, carefully analyzed alternative, from which croc was inspired, is Magic Wormhole; a good Golang implementation that compiles down to a single binary is wormhole-william:

https://github.com/psanford/wormhole-william/releases

I believe croc has some features wormhole doesn't (and some anti-features, like being able to pick curves and hashes). But also just that it's worth knowing that Magic Wormhole is kind of the "default" tool that does this.

View on HN

I think the main advantage that I like croc over many utilities is that it can resume file transfers from where it left off. I'm not sure if wormhole has this yet. Of course torrents do this, but I find sharing via torrenting still not super easy for the layperson.

Torrents also don't provide encryption between peers, unless you use SSL torrents, but it's clearly designed towards sharing between a group, not one-on-one transfers.

How does the group design hurt 1-1

(BitTorrent/Resilio sync uses SSL and seems fine for 1-1 design-wise)

It's just a bit more involved to use for this use case, especially if the data is confidential (having to set the private flag so clients don't publish the infohash to DHT, using a built-in tracker in your client, transport layer encryption not provided by default). Things like Resilio are fine, they build on top of the protocol and provide a different UX.

It's weird croc doesn't mention magic wormhole in their readme, if only to explain the differences with this well known tool, and why one would use croc rather than wormhole, which people are probably more used to using and that they can apt install, etc

Here is the answer from the project website

"magic-wormhole has most everything (currently its missing capabilities for multiple file transfers and file resuming), but it requires installing lots of the Python ecosystem which is tricky for non-developers (and Windows users)."

For the python part, I guess wormhole-williams works too then.

A wormhole user would just transfer a directory, rather than a globbed list of files, but croc's multiple file transfer thing is a difference between the two tools.

I think Wormhole William is great, also has a mobile app. But when I discovered croc, I switched to that, it has been very reliable. From the developer:

AFAIK, croc is the only CLI file-transfer tool does all of the following:

- allows any two computers to transfer data (using a relay)

- provides end-to-end encryption (using PAKE)

- enables easy cross-platform transfers (Windows, Linux, Mac)

- allows multiple file transfers

- allows resuming transfers that are interrupted

- does not require a server or port forwarding

Magic Wormhole:

* Allows any two computers, NAT'd or otherwise, to transfer data

* Invented the PAKE model that croc uses

* Is cross-platform and runs on Windows

* Allows multiple file transfers (directories)

* Does not require a server or port forwarding.

The thing croc does on this list that Magic Wormhole doesn't is resumption.

AFAIK it doesn't support authentication for private relays

Why do I care? All of these designs --- croc is "a Magic Wormhole" --- are end-to-end secure.

I can't tell you what _you_ should care about, but I wouldn't want to run an open relay everybody can abuse and eat up my traffic allowance.

> Does not require a server or port forwarding.

I’m probably missing something, new to magic wormhole, but this seems to contradict the docs on magic wormholes linked by the tool you recommended, wormhole william:

“ The wormhole library requires a “Mailbox Server” (also known as the “Rendezvous Server”): a simple WebSocket-based relay that delivers messages from one client to another. This allows the wormhole codes to omit IP addresses and port numbers.“

https://magic-wormhole.readthedocs.io/en/latest/welcome.html...

Is this a particular library choice vs protocol choice? Wormhole william perhaps allows codes with ip addresses etc?

What makes me wary about these tools is the way many of them seem to bake in a default relay server but aren’t up front about it (i want that discussed in the readme.md, it’s a big deal, even if they can’t read the payload - presumably they can see which two IPs are communicating which should be absolutely disclosed). Like, to me it’s not “magic” to route stuff through a relay server. That’s the whole thing I want “magic” to avoid. (Also it doesn’t seem at all like a “wormhole” - the nomenclature strikes me as insanely grandiose)

That's how croc works, too. You can run your own Magic Wormhole relay. These tools all have the same fundamental design.

What's magic-seeming about them is that you can be deep in a prod network, with tightly controlled ACLs and no routable address, and just "wormhole server.log", and then on your dev laptop on your random home wireless type, like, "wormhole receive 32-hazardous-baboon" and poof! you have "server.log". It feels pretty magical, which is why it has the name.

Croc doesn't change any of that. What croc does differently from Wormhole is that it handles resumption, and you can apparently send a globbed list of files rather than just a file or a directory. Resumption is a real feature (I'd like to know more about how the cryptography works, though). The multi-file thing is a UX tweak.

Croc has a bunch of knobs to change cryptography primitives. Those are anti-features.

You can password-authenticate a custom croc relay. I don't know why you'd ever care. Maybe this is an abuse concern? These are all E2EE designs. You don't trust the server in the first place. It's like a STUN/TURN server.

> Invented the PAKE model that croc uses

Nit: Magic Wormhole pioneered SPAKE2's application in a file transfer utility, but the actual invention of SPAKE2 predates Magic Wormhole.

I don't mean that they invented PAKE's, I mean that they invented this application of PAKEs (I'd say: one of the very few genuinely useful PAKE use cases).

One thing missing from this list: a GitHub readme with a how-to. Magic wormhole makes you visit ReadTheDocs

`wormhole send <filename>`

The output of the command tells you what to do next.

They really nailed the UX on this.

An even more popular alternative is Resilio Sync. I still use it because somehow sharing with the tech savvy isn't a big problem, but with the unsavvy is. A GUI and a single string is on the edge of the possible, and I share much more (large, noncode, files) with this group.

It makes sense to compare croc to wormhole because they're the same thing: PAKE-backed file transfer, where nobody has accounts, no central server holds the files, everything works from behind a NAT, all you have to is install the tool and give your counterparty an autogenerated secret password for the file.

Apart from Pake, all that applies to Resilio, which I'm pretty sure has a bigger uptake than the rest combined.

I mean, Google Drive has more uptake than any of these things. We're comparing PAKE-driven file transfer schemes.

I thought we were comparing p2p file sharing applications. Drive et all are of course entirely different.

And it has a mobile client that has autosynced folders, so you only need to set it up once

winden.app is a Magic Wormhole web app for files up to 200MB https://github.com/LeastAuthority/winden

There is also https://wormhole.app

Which looking at your link I guess is unrelated

This looks very different; it requires having a server to temporarily store the file, while croc and magic-wormhole directly connect two peers (via a relayer) to send the file.

It's based on webtorrent, so it will p2p but it is dog slow for serious files.

This is totally unrelated to Magic Wormhole, and the name is problematic; it has a different security model.

What does "carefully analyzed" mean in this context? Who analyzed it?

Also if GitHub stars are anything to go off of, croc is several orders of magnitude more popular. Also croc is written in Go and compiles to a single binary, but there are some helper scripts in the repo for a few things. I really don't know why they said all that in their comment.

Emailing files is even more popular; does that make it more secure?

Did you mean to reply to me? I didn't say anything about being more popular -> being more secure. If you did want my input, my answer is: no. I was just commenting on the fact that the commenter said croc was less popular, when I cannot find any metric for that.

Wormhole-william is a Go port of Magic Wormhole. Github stars are not anything to go off of. If you're unaware of Magic Wormhole but have strong opinions about croc, we're not speaking the same language and there's little point in us irritating ourselves by trying fruitlessly to hash things out.

Reply on news.ycombinator.com