Hacker News Reader

Hacker News

Comment by aspyct | Hacker News Reader

Full thread

aspyct

I regularly have to send files to customers, from a few megabytes to a few gigs. It's incredibly hard.

Mail? Goes to spam.

WeTransfer? Mail clients break URL.

Download from my website? Some stupid browser will display the zip data onscreen.

Send the link through messenger? Messenger breaks the link.

SaaS gallery? Some file managers can't open the zip file.

I've been doing that for two years now. Still don't have a 100% working solution. It drives me mad. Just yesterday I spent 30 minutes sending 3 jpeg files to a customer.

View on HN

Most webservers have a way of adding a header# Content-disposition "attachment; filename=$1"; that forces downloads. Nginx at least guesses based on file extension / mime type.

# https://stackoverflow.com/questions/9054354/how-to-force-fil...

# https://stackoverflow.com/questions/37131398/how-to-configur...

FYI - I've also recently run across end users who are likely victims of overzealous IT departments that disable Basic Auth, even on HTTPS connections. Even though they don't do anything to form fields which might contain the exact same data. I don't mind if they break their own domains but the whole Internet?

I have that header. Yet some personal iOS device decided to ignore it on safari. Don't know how, don't know why. Computers being computers.

Firefox used to have a settings screen where you could go file type by file type overriding the browser behavior and setting it to ignore Content-Disposition.

Maybe Safari has something similar.

>Download from my website? Some stupid browser will display the zip data onscreen.

Are your customers using IE6 or something? Customers like that should be fired.

Oh no, I've seen Chrome and Firefox (with a well-conforming web server) loading zip files as if they're pages. The culprit? Intercepting HTTPS-breaking inspection. This is not just in enterprise environments, antivirus companies somehow even justified "HTTPS scanning" as a feature.

Oh, that's a thing.

When my workplace tried that, I just asked the CISO how they handle the bank credentials of the people that access their bank account at work. I never got an answer, but the system was gone a week later.

> Are your customers using IE6 or something? Customers like that should be fired.

Looks like your company don't want millions of profit?

in the mid 90s i worked in a machine shop that had a side business where they had catalogs. They were trying to send .TIFF files over 14.4 or 28.8 modems. TIFF files over 10MB, so no floppy (easily.) No CD-R, Jazz/zip.

These days in the same circumstance as you (and they) had, i'd fedex them a USB stick, or optical disc, depending. Because the first time someone said "the web page you linked is just displaying garbage" i'd turn in my tech credentials, because that's probably my server's fault, not the browser. MIME has been a thing for three decades, at least. it sounds like someone tried to use a static html daemon to share a zip file, and it assumes everything is ascii. like it's 19xx and zmodem hasn't been invented yet.

As was pointed out in a cousin comment, it's not necessarily the browser or the webserver configuration.

SSL proxies -- corporate middleware -- have a habit of breaking this way, by stripping the content-disposition field or similar.

Let the user talk to their IT department and have them reconfigure their snake oil so it's not broken?

It would have to be mangling both the Content-Disposition and Content-Type headers.

If that's really happening (I have my doubts) and that's a client you want to continue supporting, then the next step would be limiting yourself to SingleFileZ-style ZIP payloads that can be as text/html.

> WeTransfer? Mail clients break URL.

You can "Get a link" for a transfer you have uploaded and it will be very short and near-unbreakable.

Just yesterday that link was broken by a (microsoft) mail client.

Nextcloud works well for this, and as the files are already on your server you don't have to upload anywhere, you just share the folder, put an expiry date on and send them the url

Note: your customers do not require an account in your Nextcloud. You can share by link, and optionally add a password too.

And as a bonus it can also be set as a drop box, where customers can send files to a folder of your choice. All the benefits of wetransfer but self hosted.

To add to this, it's reasonably easy to run, and has many different plugins, from a calendar and contacts list, to an online document editor (like Google Docs, except it can be pretty slow and/or resource intensive: https://nextcloud.com/office/), to a simple clone of Slack (https://nextcloud.com/talk/), a mail client (https://apps.nextcloud.com/apps/mail) and other things.

That said, I've had updates (across major versions) break things on multiple occasions, one out of two servers running the exact same version has random crashes and in addition to that the file locking by default (if enabled, but not using Redis: https://docs.nextcloud.com/server/latest/admin_manual/config...) has broken and prevents me from deleting a file that just sits there and takes up a few GB of space. Oh and their Android app fails to upload files if I use the share option, instead of the file picker from within the app.

On the other hand, sure beats storing data on third party clouds and is free, so I'll still keep using it.

I know, but even sending a link is not that straightforward in my experience.

O.o how is that not straightforward? Sending a link is the easiest thing in the world.

Yes, sending it is easy. But on the other side, whatever software my customers are using tends to break the links.

I've had that with both mail clients and messenger. Call it antivirus protections, "you're leaving our website" thing, facebook tracking data... Whatever, they will break your links eventually.

I know, it's unbelievable, I don't blame you for doubting me. But still...

> you just share the folder

And this is how some company can accidentally see way more than it had should.

Never do this for anything remotely important, just add a separate 'Share' folder and allow sharing to external users only from it.

Don't forget, if the user can't see something on the server that doesn't mean there is nothing else there. Eg: ABE enabled SMB share.

I had explored the opportunity [1] to help send files securely based on the Firefox Send fork available at [2]. It proved very difficult to sell with actually no interest in such a product (and I probably sold it the wrong way). I still use it myself and never had links not usable by the recipient (shared by mail).

[1] https://www.sendutil.com/ [2] https://github.com/timvisee/send

I've been meaning to setup something like this for awhile. https://github.com/eikek/sharry

Ooh that could come in handy, it also has links to other useful projects! Thanks a lot!

I don't have a good asynchronous solution, but if you can do it while on the phone/Teams with them, then Web Wormhole (https://webwormhole.io/) is absolutely fantastic. You both open a web page, you drag a file onto yours and it starts appearing in their download folder.

It's WebRTC based so peer-to-peer, E2E encrypted, with servers only used for serving the client, and for NAT punching.

What you really want is the native iOS or Android version of this (or of any Magic Wormhole derivative), which the wormhole-william people are working on (I think the Android version already works).

How is an iOS version of this going to be any better than web? It seems iOS imposes a lot of storage restrictions on apps.

Every time you hit the web page you have to re-trust that it's not stealing secrets from you. It's not end-to-end secure; in fact, you literally might as well just upload your whole file to that site and just let it handle the wormholing for you.

Yeah the Android version has been out for a few years[1][2]. There's an iOS target that works as well, I've just never published it to the app store. Every time I start that process I get annoyed at how hostile Apple is to open source developers and give up. Hopefully I can at least distribute a side loadable binary when that becomes a thing for EU users.

[1]: https://play.google.com/store/apps/details?id=io.sanford.wor...

[2]: https://github.com/psanford/wormhole-william-mobile

Apple's walled garden is supposed to be protected from trespassing, so software can't be required to trespass it as breaking protection is computer fraud.

I tried wormhole.app many times and have about a 60% failure rate because there's an error or the download never completes. Don't know the difference with your link but i suppose i should try it next time

Google drive is quite good. Like normal gmail but click the triangle icon at the bottom of the email compose window.

I do the directory listing file(s) with a header telling them to right click and download.

It usually works...

Have you tried Dropbox links? The best solution I have found.

But I agree it’s a mess.

Yes, but then you have to send the link, and it's also a huge mess.

What’s the reason sending a link is a mess for you?

Please refer to my other comments on this thread.

Have you tried sending the links through other channels like WhatsApp?

If I try to access a Dropbox link from my company PC I get blocked by a security software.

Tried putting it on to a USB, and sending it by snailmail?

Yes, it has come to that in some cases. I've delivered a bunch of HDD's with my car.

Never underestimate the bandwidth of a FedEx truck filled with multi-TB hard drives hurtling down the highway at 70 mph.

Google Drive? Starts at $2/mo for 100GB.

That would be blocked in a lot of large companies. IT blocks common cloud storage urls to prevent employees from storing company data on third party servers.

I just tried sending an email with it and it only seemed to use the mail.google.com url.

I guess if your company blocks that you might have problems.

Or free if <15GB.

This is frankly bizarre. How are they unable to access Dropbox? How are you unable to share via GOOGLE?

Are you simply unaware these solutions exist?

If I'm using WeTransfer, you can bet I tried Google drive and dropbox...

Reply on news.ycombinator.com