Chapril » paste.chapril.org

Je pense que c'est pas possible en zero knowledge que le serveur envoi le contenu avec un Content-Disposition: attachment.

https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-can-i-link-to-raw-pastes-instead-of-taking-users-to-a-web-page
https://github.com/PrivateBin/PrivateBin/issues/386#issuecomment-446332183

François Poulain a écrit :

Je pense que c'est pas possible en zero knowledge que le serveur envoi le contenu avec un Content-Disposition: attachment.

Affirmatif. C'est le Javascript côté client qui doit faire en sorte d'être la source du téléchargement.

De nos jours, ça semble faisable facilement : https://www.bitdegree.org/learn/javascript-download

De ce que j'ai compris du développeur de PrivateBin, il a attend d'identifier un vrai usage avant d'ajouter une fonctionnalité.

Ceci dit c'est possiblement faisable avec cette méthode : https://ourcodeworld.com/articles/read/189/how-to-create-a-file-and-generate-a-download-with-javascript-in-the-browser-without-a-server

François Poulain a écrit :

Ceci dit c'est possiblement faisable avec cette méthode : https://ourcodeworld.com/articles/read/189/how-to-create-a-file-and-generate-a-download-with-javascript-in-the-browser-without-a-server

Ce lien indique que c'est disponible dans Firefox depuis la version 80 qui date de août 2020 (https://en.wikipedia.org/wiki/Firefox_version_history).

Le ticket 386 cité plus haut date de 2018.

Donc il semble que ce soit maintenant techniquement possible et que ça vaut le coup de re-proposer la demande \o/

Courriel envoyé à elrido actif sur pastebin :

Hi ,

I am the animator of https://paste.chapril.org  that use a version of
privatebin . It works fine , no problem.

I am writing to you in the hope that you will accept my request. The
issue manager of the project PrivateBin is on Github. Github is not a
free software, it is a tracking tool for GAFAM, a politic tool (Patriot
Act., Cloud Act., Prism…) and I am disagree with their terms of use. So
I can’t create tickets in the project.

Some details on our use case. We used PrivateBin to share a bot report
with any users. So our bot uploads the text report on PrivateBin and
shares the link on IRC. Then anybody can verify the report and an
operator downloads it to make an archive. A report is 600 lines text
file. So copy/paste is weirding. Actually, with Firefox, the operator
has to do many clicks to get the file: click on "Raw text" button,
right-button, click on "Save as", click twice to select the format text,
then click "Save" button. So many clicks! Therefore a single "Download" 
button to do that would be great useful ot us.
It seems that now with HTML5 it is possible while respecting zeroknowledge.
Look at
https://ourcodeworld.com/articles/read/189/how-to-create-a-file-and-generate-a-download-with-javascript-in-the-browser-without-a-server

Can you ?

Sincerely yours.

Didier Clermonté

Réponse de El rido :

Salut Didier,

> I am writing to you in the hope that you will accept my request. The
> issue manager of the project PrivateBin is on Github. Github is not a
> free software, it is a tracking tool for GAFAM, a politic tool (Patriot
> Act., Cloud Act., Prism…) and I am disagree with their terms of use. So
> I can’t create tickets in the project.

Yeah, I'm not to happy about that either. We started the project out on that platform - way before 
they got bought up by Microsoft - and now are just there mainly for the convenience it has over self
hosting it and the maintenance that includes. At the moment, something like Gitlab (their community edition,
self-hosted) with their runners for the CI/CD would probably the closest in replacement, with minimal
maintenance requirements. This topic is tracked in https://github.com/PrivateBin/PrivateBin/issues/325
(I now, you can't comment there, but for your reference).

> Some details on our use case. We used PrivateBin to share a bot report
> with any users. So our bot uploads the text report on PrivateBin and
> shares the link on IRC. Then anybody can verify the report and an
> operator downloads it to make an archive. A report is 600 lines text
> file. So copy/paste is weirding. Actually, with Firefox, the operator
> has to do many clicks to get the file: click on "Raw text" button,
> right-button, click on "Save as", click twice to select the format text,
> then click "Save" button. So many clicks! Therefore a single "Download" 
> button to do that would be great useful ot us.
> It seems that now with HTML5 it is possible while respecting zeroknowledge.
> Look at
> https://ourcodeworld.com/articles/read/189/how-to-create-a-file-and-generate-a-download-with-javascript-in-the-browser-without-a-server

For this use case I would recommend to use the file upload feature. Either only upload the file
(the reviewers will have to download it, to see it) or you upload it AND paste it into the text area. Example:
https://snip.dssr.ch/?be7be244d0eefa78#Ext9tUbBeeLupJqVPB6jvKkmxx8zdcqRwXSc6iy1wsh

To enable this features, set the parameter "fileupload" to true in your configuration file:
https://github.com/PrivateBin/PrivateBin/wiki/Configuration#fileupload

Hope this helps,
Simon

-- 
"All your base are belong to us!!!" - CATS 

Hi Simon
>
> Yeah, I'm not to happy about that either. We started the project out
> on that platform - way before they got bought up by Microsoft - and
> now are just there mainly for the convenience it has over self hosting
> it and the maintenance that includes. At the moment, something like
> Gitlab (their community edition, self-hosted) with their runners for
> the CI/CD would probably the closest in replacement, with minimal
> maintenance requirements. This topic is tracked in
> https://github.com/PrivateBin/PrivateBin/issues/325 (I now, you can't
> comment there, but for your reference).

We know this is work, so we encourage you all. We are glad to hear
you’re thinking about it.

> For this use case I would recommend to use the file upload feature.
> Either only upload the file (the reviewers will have to download it,
> to see it) or you upload it AND paste it into the text area. Example:
> https://snip.dssr.ch/?be7be244d0eefa78#Ext9tUbBeeLupJqVPB6jvKkmxx8zdcqRwXSc6iy1wsh

 Many thanks for this smart solution. But it uploads twice the same
data. It is clearly only a workaround. And to be honest, it will force
us to code in Java the upload of an attached file.

 The other approach is so simple. We are talking about one button and
ten Javascript lines.

 In order to convince you, here is an example of code integration:

https://forge.april.org/Chapril/paste.chapril.org-privatebin/commit/9bf5b6dbdeb86af0a6faa336ff16d9cddf989324

 You can run it here:
https://paste.chapril.org/?ef6a1b876b5c4526#4a9cGPmXJMzZyPW4diMpvesvx3x8x1NqCuidn6raP8Kn

 Have a good day, from Paris (France)

Sincerely yours

Didier
Animator of https://paste.chapril.org

Réponse d'El Rido :

Hello Didier,

>  The other approach is so simple. We are talking about one button and
> ten Javascript lines.
>
>  In order to convince you, here is an example of code integration:
>
> https://forge.april.org/Chapril/paste.chapril.org-privatebin/commit/9bf5b6dbdeb86af0a6faa336ff16d9cddf989324

I've taken the liberty and raised this as a pull request over in the other project site:
https://github.com/PrivateBin/PrivateBin/pull/774

Kind regards,
Simon

you did the right thing. No restrictions on our part so that you can do
the best for this great project.

Thank's you very much. That’s perfect for us.

 Thanks again for your listening and the smooth communication. With all
our encouragement.

 Have a good day from Paris (France).

Sincerely yours

Didier