A P2P file sharing platform. Contribute to nihaocami/berb development by creating an account on GitHub.
Read the original article
Comments
By satvikpendem 2025-06-014:173 reply Are you familiar with Iroh's sendme?
By brw 2025-06-0218:19 I've used sendme a few times after coming across Iroh on Bluesky. It's honestly great. Just Works™, very fast, supports files and folders, resumable transfers, one sender to many receivers, and has fast relays as a fallback when a direct connection truly isn't possible, and it will actually tell you whether you have a direct connection or are using a relay (unlike others like Magic Wormhole or Croc from my experience).
By goodpanda 2025-06-0113:30 This looks very interesting. I will def take a look. thx
By satvikpendem 2025-06-0112:171 reply Yeah that's their website describing about their cli tool. This project (berp.app) works on the web.
By satvikpendem 2025-06-0423:151 reply Sendme works on the web too (at least, theoretically since iroh released web support recently but not sure they updated this repo specifically, I've sent files using iroh myself on the web).
By Alifatisk 2025-06-0513:47 Cool! Is there any website available atm to use iroh over the web?
Connecting browsers directly is a fascinting area to explore in web development. It always goes a little haywire when punching thru NAT and I wish there was more research into what the best methods are.
https://github.com/dmotz/trystero is a one tool I've used to build these kinds of apps.
My understanding is that the signaling server could be used as the perfect place to perform MITM attack. The README does not mention how berb addresses this concern at all.
Oh I would love some more details if you think that's the case. With Berb only two clients can connect really. So let's say you somehow guess a peer ID, which is very tough, and connect to a random user. You can technically send a file but they can easily ignore it since they didn't initiate the transfer. That being said, I can definitely add a way to verify the file is legit like the suggestion in the reply with hashes.
Should users trust the signaling server? IIRC, the signaling server can easily intervene SDP offer/answer so that it can intercept user files or instruct users to send files wherever it wants.
By goodpanda 2025-06-0213:36 Oh I see what you are saying. Yeah I guess if we didn't know what the signalling server was doing, that would be a valid argument. But in my case we can see the server code is pure and simple. Unless you mean there's a bug that allows an attacker to do that?
Either way, would love to know your thoughts on improving trust with this.
By notpushkin 2025-06-015:24 Do you have a proposal? (Showing file hashes could help, perhaps?)
