Skip to Main Content
Talk Intermediate CC-BY-SA 4.0 First Talk

Building the FOSS replacement for "just WeTransfer it"

Proposal status is Rejected
Session Description
  1. wanted to build my own FOSS version of "WeTransfer it" because using WeTransfer means handing your file to a company that can read it.


  1. So before i wrote a line of code i went through the already existing 11 projects source code: Send and its 2 surviving forks, PrivateBin, Ente, Nextcloud, age, magic-wormhole, wormhole-crypto, filebrowser, ffsend and epherra.


  1. I expected to find some cryptographic bugs, but to my surprise they were elsewhere, repeated across projects. For example:
  2. Deletion: Send's filesystem backend doesn't delete expired files at all, in either fork.
  3. Counting: 5 out of 11 had this bug : "2 people click at the same moment and both get a link that was supposed to work once."
  4. Passwords: Send's password is a door on the server, not a lock on the file.
  5. and etc.


  1. I will walk through these in the actual code and highlight the spots where obvious way turns out to be the wrong one. The password belongs in the key, not in a server-side check one of those.


  1. I will show how i shipped one of these myself, the test for race download shouldn't have passed but it did.


  1. And then i ended up with Sunbird : Rust backend with vanilla js on the front. Ships as a single binary under AGPL, light enough that a small student club can host it themselves.
Key Takeaways
  1. Deletion and expiry break silently, making them far riskier than broken cryptography.


  1. Tests must be able to fail to be useful. For concurrency issues, forcing actual collisions is better than assuming they happen.


  1. Study existing code throughout design.


References

https://github.com/chahat-101/sunbird
https://elephant101.substack.com/p/the-encryption-is-the-easy-part

Session Categories

Introducing a FOSS project or a new version of a popular project
Talk License: CC-BY-SA 4.0

Speakers

Chahat Patel
Chahat Patel Student | Symbiosis Institute of Technology, Pune

Most of my time goes to systems code and computer vision research. I'm a core member of the FOSS United chapter at SIT Pune. I self-host more than is sensible, prefer copyleft, and recently started writing at elephant101.substack.com.

https://github.com/chahat-101

Reviews

Moved it to a project showcase table. Its a product demo, not sure if a talk would be that useful for such

Reviewer #1 Rejected