Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

8gb+ files? I found a way but you have to use a JAVA FTP Applet. I tested these two here: http://jupload.sourceforge.net/ and http://www.jfileupload.com/

Dragged and dropped an 8gb+ file and left it on for 5 hours. Worked perfectly. No time outs, no errors, and I'm on a shared hosting account at 1and1.

My problem with them is that it wasn't possible to hide the FTP username and password, they were always in javascript files. I whined, I complained, I bitched, and there was nothing they could do about it. :( So you basically had to password protect the whole directory with .htaccess and be very careful with whom you shared the credentials.

If you don't want people to download and install software just stick with JAVA FTP Applets.



What exactly did you expect them to do about it? For a client-side tool to establish a plain FTP connection, it needs to possess authentication credentials.


You could always just hard-code the username/password into the applet and recompile. That shouldn't be too hard...

Or, if you control the FTP server, you could dynamically add and remove random virtual users/passwords to the FTP server (hopefully virtual users). Then when the client javascript gets the username/password, it could only be used once.


One could scan the .class file for string literals with relative ease. Obfuscation would be an improvement, but still not completely secure.


It would hardly be an improvement. Wireshark would be a first step for most reverse engineers when there's network authentication involved.


Well, we are talking about FTP, so the string is going to travel over the line in plaintext anyway.


It's been a long time since I've been on shared hosting, but I thought they usually offered some kind of anonymous upload-only FTP directory. Couldn't your users upload to that and then your application can read from that directory?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: