19 replies to this topic

[Brito]

File Name: filename.pro
File Submitter: Nuno Brito
File Submitted: 07 Jul 2012
File Updated: 14 Jul 2012
File Category: Security

What is this tool about?
Recently we have made available the http://filename.pro as a service to provide information about files. This information is provided by volunteers and this tool is used for submitting files onto the website. For more info about this service, please read http://reboot.pro/17148/ or visit http://filename.pro/discussions

This tool is made available as a Java program that was tested to run under Linux (tested in Ubuntu) and Windows. Possibly it should run fine under MacOSX as well other OS that support Java.


In the future we want to provide good quality information about files, their dependencies, previous versions, vulnerabilities and discover if a given file is reliable or not. We need your help to make this dream possible.


Running:
- From Windows explorer, double-click
- From Windows/Linux command line, type "java -jar filename.pro.jar"


*note to linux users:
- You need to set file as executable on your desktop. Right-click-> Properties -> Set as executable


First time setup:

The tool needs to know your personal key. When running for the first time it will ask for your individual key. This way it becomes possible to know who is providing information and later provide a list of the most active contributors.

To get a key, you need to login to the site and visit http://filename.pro (just click on the button that appears when running the app for the first time)


Your help counts

Each accepted file will become part of the database and you will be highlighted as the contributor that made it possible. We are building a database for the future, thank you for helping and providing feedback.

Press the "support topic" to write your opinion/feedback about this tool. Suggestions are very welcome, thanks!

Click here to download this file

[Holmes.Sherlock]

• Isn't there any separate registration option provided at filename.pro apart from OpenID?
• The mail which is triggered after connecting with OpenID contains malformed HTML tags.
• Can the 'filename' account be changed to 'Nuno'?

[Brito]

• Isn't there any separate registration option provided at filename.pro apart from OpenID?
• The mail which is triggered after connecting with OpenID contains malformed HTML tags.
• Can the 'filename' account be changed to 'Nuno'?

1. It is disabled because of spammers
2. I see your email fine from the admin console, I'm not understanding what you mean
3. I'm using the account to represent staff actions, prefer to have it as "filename" than using a personal name

Have you tried out uploading files?

[Holmes.Sherlock]

2. I see your email fine from the admin console, I'm not understanding what you mean

Forwarded you the mail.

Have you tried out uploading files?

Not yet, I will.

[Holmes.Sherlock]

Not yet, I will.

Uploaded one, but is there any way to see my uploads after I log in to the site?

[Brito]

Uploaded one, but is there any way to see my uploads after I log in to the site?

Good point, I started creating a script for that function. Look here: http://filename.pro/me

The intention is showing files that you uploaded and other details in the future.

[Holmes.Sherlock]

Also the upload client should provide a functionality to 'clear' the list of 'files to be uploaded'. First time, I uploaded, say fileA. After the upload is finished, I try to upload another, say fileB for the second time. Neither the client is smart enough to skip the file which has already been uploaded nor there is any option to reset the list. Therefore, both of the files gets uploaded as a result where the first upload is redundant.

[Brito]

Also the upload client should provide a functionality to 'clear' the list of 'files to be uploaded'. First time, I uploaded, say fileA. After the upload is finished, I try to upload another, say fileB for the second time. Neither the client is smart enough to skip the file which has already been uploaded nor there is any option to reset the list. Therefore, both of the files gets uploaded as a result where the first upload is redundant.

You are correct, however for the moment this is a necessary evil. Adding a local database to prevent duplicates causes trouble (CPU/RAM overload), using the filename.pro database to check duplicates causes traffic hogging.

The way it currently works it is redundant when duplicates occurs, however it saves local/remote memory/cpu and speed up execution and this is my priority.

Users with ADSL will not be worried about bandwidth, users with limited Internet will not be uploading thousands of files and this method this is particularly efficient when processing over 50 000 files from a typical (2Gb RAM, Dual Core CPU) desktop.


---

Now there is a new feature: file download. I like it quite a lot because it helps to find files quickly and then download a version that we need. Will later add restrictions to reduce misusage this feature.

[Holmes.Sherlock]

Good point, I started creating a script for that function. Look here: http://filename.pro/me

List showing blank right now.

[Holmes.Sherlock]

Now there is a new feature: file download.

Where is it?

[Brito]

List showing blank right now.

All previous files was deleted. This means that your files were also removed. You can upload some more files to see them.

Where is it?

On the file details, when looking at the hash of a given file. Here is an example for winbuilder 077: http://filename.pro/...8ba76c3aa023b6c



During my walk home I was thinking about the duplicate file issue. There might exist a good solution to prevent the unnecessary upload of files. At the moment two separate queries are done, one with hash data and the other with the binary data. I was planning to remove one of the queries but I can leave it as is.

The first query can ask if the server wants the file based on the computed SHA1 and if affirmative uploads the file. Will see and then post here the progress on this matter.

[Holmes.Sherlock]

During my walk home I was thinking about the duplicate file issue. There might exist a good solution to prevent the unnecessary upload of files. At the moment two separate queries are done, one with hash data and the other with the binary data. I was planning to remove one of the queries but I can leave it as is.

The first query can ask if the server wants the file based on the computed SHA1 and if affirmative uploads the file. Will see and then post here the progress on this matter.

Quite good. A minor modification could be like this: if there are multiple files awaiting to be uploaded, we can query the DB, start uploading of the first non-duplicate file & "overlap" the SHA-1/MD5 query of subsequent files with the upload time of the previous one in the chain by issuing a separate thread to send the query & en-queue server's response. This way the delay in response will never be noticed by the user.

[Brito]

Update:
The personal area now shows pages of the uploaded files: http://filename.pro/me This done in a dynamic manner, it is still a costly operation to compute the amount of contributed files by a user. Will probably do this later as a cronjob operation.

[Holmes.Sherlock]

Update:
The personal area now shows pages of the uploaded files: http://filename,pro/me

Link is broken.

..., it is still a costly operation to compute the amount of contributed files by a user. Will probably do this later as a cronjob operation.

Not at all, with each upload of file, keep on updating a field holding the number of files contributed by the user.

[Brito]

Link is broken.

Post re-edited. Somehow the paste didn't worked as intended.

Not at all, with each upload of file, keep on updating a field holding the number of files contributed by the user.

Please allow me to correct:
If a field holding the number of files contributed by the user is updated on each upload, then it won't be a costly operation.

And I agree, this is something that can be done on a separate table to speed up performance when displaying the dashboard.

[Brito]

Site updated:

Now it is possible to start browsing the index of records in the database at http://filename.pro/db

Right now I have only added SHA1 records. To ensure speedy display, each page of results is periodically computed and then saved to disk to be loaded by visitors whenever needed.

[Brito]

Added info from the ShadowServer foundation. For the moment I am only testing this feature, the idea is providing information from their analysis of good vs bad files.

I used upx.exe as example: http://filename.pro/...e29edaae481e530

And the link to their server: http://innocuous.sha...e29edaae481e530

[Brito]

A new version of the client was uploaded, some fixes were added.

Worth mentioning that files already available on the server will not be uploaded.

[Holmes.Sherlock]

But how are you planning to restrict uploading of copyrighted/non-sharable contents?

[Brito]

My friend, restricting the upload of whatever is considered as copyrighted/non-shared is simply not feasible without taking into account the geographical location of the person, the efficiency in evaluating the legal terms for each file and so on.

I will be following the same approach as Youtube on this regard. Everyone can upload whatever, if a file is later flagged as violating the terms of service then it is removed, that simple. If a file cannot be viewed on a given country, then it won't be made available to IP addresses on that country.