<story><title>Show HN: YouTransfer – Self-hosted file sharing</title><url>http://www.youtransfer.io</url></story><parent_chain></parent_chain><comment><author>rbolte</author><text>YouTransfer is a simple but elegant self-hosted file transfer &amp;amp; sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files.&lt;p&gt;Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to combine ease-to-use file transfer tooling with security and control.&lt;p&gt;You can watch a live demo at &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;demo.youtransfer.io&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;demo.youtransfer.io&lt;/a&gt;&lt;p&gt;If you want to see it in action on your own environment, you can use the Docker image (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;hub.docker.com&amp;#x2F;r&amp;#x2F;remie&amp;#x2F;youtransfer&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;hub.docker.com&amp;#x2F;r&amp;#x2F;remie&amp;#x2F;youtransfer&amp;#x2F;&lt;/a&gt;) or NPM package (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.npmjs.com&amp;#x2F;package&amp;#x2F;youtransfer&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.npmjs.com&amp;#x2F;package&amp;#x2F;youtransfer&lt;/a&gt;)</text></comment>
<story><title>Show HN: YouTransfer – Self-hosted file sharing</title><url>http://www.youtransfer.io</url></story><parent_chain></parent_chain><comment><author>dchest</author><text>If I read it correctly, this is how a file token is generated, which is supposed to be secure:&lt;p&gt;&lt;pre&gt;&lt;code&gt;     file.id = md5(file.name + (Math.random() * 1000));
&lt;/code&gt;&lt;/pre&gt;
First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn&amp;#x27;t also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandomValues in browsers.&lt;p&gt;PS And multiplication by 1000... is it just for fun?</text></comment>