Drop.lol – copy files over the network with WebRTC or TURN relays

by goranmoomin • 6 years ago

129 28 6 years ago

This works beautifully. I wonder how secure it is.

SahAssar3• 6 years ago

WebRTC is end-to-end encrypted, but the handshake goes over the server in cleartext. So you need to trust the server, but not the TURN relays.

vincentchu• 6 years ago

I made a similar version awhile back: https://qqsend.me

It uses AES encryption to encrypt the contents of the data so that any TURN relays couldn't see the contents of what was being transferred.

The key material between sender/recipient are transferred via the hash-param of the URL, which AFAIK isn't sent to the server and is hidden.

dbrgn• 6 years ago

The handshake could be encrypted with something like https://saltyrtc.org.

ignoramous3• 6 years ago

See https://instant.io [0] for a similar file sharing service, but over BitTorrent over WebRTC (not sure if it requires a relay TURN server when peers are behind symmetric NAT) [1][2].

Other such services shared on news.yc previously: https://sharedrop.net, https://file.pizza, wormhole et al [3][4].

Just a reminder that, WebRTC doesn't leak your public-IP if you're behind a VPN [5].

---

[0] https://news.ycombinator.com/item?id=9568939

[1] https://news.ycombinator.com/item?id=19603947

[2] https://tools.ietf.org/html/rfc8445

[3] https://news.ycombinator.com/item?id=17356023

[4] https://news.ycombinator.com/item?id=14649727

[5] https://news.ycombinator.com/item?id=12527956

amelius3• 6 years ago

Cool, but none of these services seem to be operational at the moment.

(Which is somewhat strange given that they are supposed to be run mostly in the browser.)

untog• 6 years ago

I’ve had great success with Sharedrop, but it’s at https://sharedrop.io, not .net as the OP linked.

One reasons services might have shut down is running the TURN server. An added annoyance over what would otherwise just be static files.

Klathmon• 6 years ago

file.pizza is working fine for me, I use it monthly or so and have never seen any downtime.

e12e• 6 years ago

Thank you. TIL: twilio runs a turn service:

https://www.twilio.com/stun-turn

Via https://github.com/webtorrent/instant.io/blob/master/README....

"Copy secret/index-sample.js to secret/index.js and set the Twilio API key if you want a NAT traversal service (to help peers connect when behind a firewall)."

Are there any open source variants that combines browser p2p and a "permanent" seed server?

I'd like to self-host a solution that let you upload (preferably via webtorrent) and share a file from a browser, but then let the server cache/host the file (preferably with http seeding support) - as well as give you a shareable magic link for classic torrent clients and a http url for browser download.

As far as I can tell, most solution ion are either browser p2p only, or server to browser (download only)?

ignoramous3• 6 years ago

I'd like to self-host a solution that let you upload... from a browser, but then let the server cache/host the file... as well as give you a shareable magic link for torrent clients... and a http url for browser download.

Not self-hosting or open-source, but: One could upload objects to S3 and generate a .torrent file to download it from a BitTorrent client or download it via HTTP. Both these features are available at no extra cost (except for the bandwidth, of course).

Unfortunately, S3 has stopped supporting .torrent downloads from newer regions (post 2016). Also, the per-torrent object size is limited to 5GiB, plus enabling public and anonymous access to the torrent-able object is required, which is understandable but might be not feasible for most use-cases.

https://docs.aws.amazon.com/AmazonS3/latest/dev/S3TorrentRet...

lebaux• 6 years ago

As much as I'm a fan of these FOSS WebRTC solutions, nothing quite worked for me reliably in a room of people with a variety of devices and technical knowledge.

I use https://fileroom.io/about but it is not FOSS, it does use their own servers for storage (you have to believe they delete the files) and the project looks dead overall.

But this drop.lol thing does not allow "click to browse" and that is rather cumbersome on mobile. Also, users should be able to asign a name?

XaspR8d• 6 years ago

But this drop.lol thing does not allow "click to browse" and that is rather cumbersome on mobile.

Which is funny, isn't using a standard <input type="file"> much more straightforward than actually accepting a drag and drop?

FWIW I've been seeing this pattern all over the place lately, where drag-and-drop is so emphasized that the click-to-browse option is hidden (or entirely missing).

eterps• 6 years ago

As a Dutch person this domain name made me laugh. Nice tool though.

theraido• 6 years ago

Was looking for this comment ;)

osrec• 6 years ago

Why is this funny to a Dutch person in particular?!

jtr1• 6 years ago

It means drool

himlion• 6 years ago

Drop is our national licorice candy, and lol means fun (not just as the acronym).

supakeen• 6 years ago

It's a few things, drop is the word for licorice and lol is the word for fun. It's also one letter off 'droplul' which would be a swear word for asshole, literally: licorice dick.

Fnoord• 6 years ago

See also: magic-wormhole [1] (written in Python)

[1] https://github.com/warner/magic-wormhole

mathfailure• 6 years ago

Doesn't work for me. Tried Chromium (Linux) -> Chromium (Android) - fails. Tried Firefox (windows) -> Chromium (Linux) - fails.

kirstenbirgit• 6 years ago

Love these sorts of tools that don't require login or registration, and are usable immediately! Great job.

anderspitman• 6 years ago

If you're on the CLI and need to quickly get a file from one machine to another, check out my https://patchbay.pub service. There are now a couple open source implementations that can handle the file sharing case.

Drop.lol – copy files over the network with WebRTC or TURN relays

Related Stories