Hey! It's been a bit, hasn't it? While we were taking a "break" from writing blog posts, we worked tirelessly to implement many features, but the most important ones are of course the ones targetting security.
Running a file uploader service is a difficult endeavour for, in many peoples' opinions, little reward. I (fzorb) am not one of those people. I am very stubborn. As such, I have decided to go on an adventure of making this as "risk free" as possible while keeping the experience good.
One of the risk-reduction measures in place is the whitelist of approved files for guests, which has mostly worked, however, for a while only the extension was checked, not the actual file contents. As such, anyone who wants to upload whatever could have just changed the extension in the file name.
One of the ways you can more accurately check for such files is by checking the file signature. We have used the fleep library in order to achieve this. Unfortunately, this had a lot of innacuracies and we really did need a better solution for this.
Magika is an AI model which determines the file type based on the file's actual contents. It is incredibly lightweight and it is probably the best way to do this at the moment. At a first glance you might think ".. Google Magika uses complex, heavy AI systems instead of... you know... file extensions. .." ~ idiotic "journalist", but it makes sure that the files are actually what they claim to be.
It has genuinely been working extremely well, except for some niche file formats (TempleOS-related) for which we have (temporarily) implemented whitelists.
People can still upload all kinds of illegal material which must be moderated, however, it certainly makes the service less and less appealing for circles which spread such appaling materials.
We have a lot more ideas in the back of our heads we want to implement soon, such as file expiration dates and pasting, so stay tuned!
