How to prevent abuse when self hosting?

[TheCataliasTNT2k]

The idea is great!
I really like the simplicity, the design, the functionality.
But how can I prevent the abuse of my instance?
There is no login (for the sender or receiver would be enough), so I can allow my friends (which I trust) to use my instance while preventing other people from using it.
Problem is, that I am liable in Germany, if someone shares illegal stuff over my instance.

[Zocker1999NET]

This is not legal advice. Just the opinion of another person living in Germany.

According to the FAQ, the server does never save any files to provide them later on. The server is there to 1. serve the web app which attempts to establish a direct connection between both parties, and 2. it might redirect traffic via its integrated TURN server if both parties cannot establish a direct connection. Further, files are always encrypted between both parties. Hence, because you are technically not able to check the data that might be transfered through your server, IMO you cannot be held lialable by what data does flow through your PairDrop instance.

If you are still unsure, I expect one can disable the TURN feature, then all data will only be transferred directly between both parties without ever going through your server.

[marcusdoc]

It would be advisable to disable any data transfers that would allow files to transfer through one's server (an selectable option if one was self hosting and fully exposing the instance to the web); with the varying degrees of laws of what constitutes legal vs illegal, one would not want to be found being an intermediary of illegal transfers.

[schlagmichdoch]

I'm with @Zocker1999NET on this one. PairDrop acts as a signaling and relay server for encrypted peer-to-peer connections, does not provide accounts and does not log IP addresses. I do not think hosting PairDrop makes you responsible for the data transferred. In fact the official server is hosted in Germany as well.

We should however probably add a privacy note and imprint to ensure conformity with GDPR (DSGVO). The possibility is already implemented - see #214.

Also, you should probably prevent web crawlers from indexing your page if you don't want that via the robots.txt. This should probably be configurable via a env var in the future:

User-agent: * 
Disallow: / 

But how can I prevent the abuse of my instance?

I think built-in password protection is not in the scope of this project as there are multiple solutions you can put in front of your instance. The simplest would be to add basic authentication via your web server. E.g. via nginx: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

Maybe we could add an example .htpasswd file and add info to the examples in the docs.

Does this solve your issue?

[schlagmichdoch]

I forgot GitHub messed up the conversion in issue #214 as well. In short it resulted in the implementation of these environment variables: https://github.com/schlagmichdoch/PairDrop/blob/master/docs/host-your-own.md#customizable-buttons-for-the-about-pairdrop-page

There should probably be an env var to directly set the text of a policy shown in a dialog or below the buttons though. Maybe in the future.

[TheLonelinessOfHS]

Add a layer of authentication in your reverse proxy. With Traefik I use traefik oidc auth.

[TheCataliasTNT2k]

I do not want to prevent the usage for all.
There needs to be at least one person in the "group" which i trust.