File Uploading without a Server

kvz.io

14 points·kvz··7 comments

> However with services like Disqus, and (my own startup) Transloadit, it gets more and more feasible to just run a flat site and have external services cover for not running serverside code and a database yourself.

It's funny how the more things change, the more they stay the same. I remember in the beginning of the web, when we all used externally hosted "guestbook" scripts and visitor counters. It seems we're back there again...

People were all supposed to have their own personal home pages by now. Instead, we're too busy screwing around on Facebook...

No, there is no use case where this is feasible on the public web. Even a small site with a strange URL and few visitors will be attacked in exactly the way described in the blog post if they try to use this. I'm sure some bot maintainers are already pushing for a detection of this enormous security hole.

Do not do this.

It's still interesting to explore the concept and think about how its always easier to build stuff exclusively client-side.

I think that's a flawed assertion. It's easy to make an insecure file upload in most server-side web languages. An example in the PHP manual is only a couple of lines of code: http://www.php.net/manual/en/features.file-upload.post-metho...

How easy is it to make a safe client-side solution?

There's lot of possibilities there; the demo page returns a tmp url that will work for a while with the data transfered, so you could use the service to distribute files in parts of 30MB max...

Yes, anyone can use your site to host any file on your server.

Reply on news.ycombinator.com