Cloudflare Drop

https://www.cloudflare.com/drop/

93•coloneltcb•2h ago

Comments

ChrisArchitect•2h ago

> No account needed. Deployment is active for 60 minutes, then expires unless you claim it.

(https://x.com/BraydenWilmoth/status/2074894829616509358)

simonw•1h ago

Same deal as their Cloudflare Workers previews from a few weeks ago: https://blog.cloudflare.com/temporary-accounts/

Bender•2h ago

There must be some really good protection on this. If I enabled such a thing on any of my servers it would be full of warez, porn, malware, CSAM and who knows what else within minutes. Curious how they manage to keep it clean.

DakotaR•1h ago

Yeah, I was going to start a file drop site like 0x until realizing what it'd be used for

mattlondon•1h ago

Only live for an hour.

But that won't stop people doing bad stuff for an hour I guess. Vibe code up some on-demand thing that you ping...

Y-bar•37m ago

One hour is great for spearphishing attacks, once the victim has been infected their IT department will have no trace of the source.

ChrisArchitect•1h ago

Extension of the temporary accounts they needed to enable for Agents https://blog.cloudflare.com/temporary-accounts/

smalltorch•1h ago

Hmm, that's fun and useful. Here is snake game for 60 minutes.

https://drop-e7e6d363-601.important-seat.workers.dev

copper-float•1h ago

What an honor. I got a high score of seven.

tengbretson•1h ago

Your code appears to have a bug where if the arrow keys trigger a change of direction twice in a single frame interval, it can mistakenly send the snake back on itself.

janandonly•1h ago

Makes sense. It plays nicely with the vibe code kids who don’t know how to do GitHub or don’t know to ask their LLM about it.

_pdp_•1h ago

It is cool to see not sure why you would use it.

Also it seems to me that this is a good way to exfiltrate data, rubber stamped by cloudflare themselves.

gruez•1h ago

Isn't there already thousands of ways for exfiltrating data that must be whitelisted by corporate firewalls? office365/gsuite, for instance. Not to mention the classics like dns.

sgt•1h ago

Tried uploading a ZIP and got:

"Something went wrong An unexpected error occurred. Please try again or contact support."

throwaway81523•1h ago

Wait, my first impression was that it points a local browser to your local browser. Now it looks like it uploads your folder to Cloudflare and temporarily serves it over the web. But is that different from what we used to do with FTP? Are there any databases or anything like basic PHP hosts supply? It's just static sites?

Is this a product or what? What's the purpose? Is there an API?

joenot443•53m ago

A minute ago I had an HTML doc I wanted to share with a PM. It was a Claude prepared demo of a hypothetical feature. Lots of screenshots.

I ended up just embedding them directly in the HTML as base64 and sending him a 15mb file, but hypothetically this would have been a nice solution instead.

throwaway81523•42m ago

You could just upload to a personal or other website? I sometimes do that. Is there any security or privacy (e.g. password protection) for this Cloudflare Drop site?

pantelisk•38m ago

There are also solutions for sharing your homelab with others (basically tunneling from your machine->server (internet accessible) <-> client. Though, if your machine would go to sleep that whole chain would fall apart. A few good automatic solutions out there that solve the problem (no "just replace dropbox with ftp" type of argument).

However, I see the appeal of this. Kind of surprised it hasn't happened yet to be honest.

qingcharles•37m ago

Absolutely agree. There's an insane "feature" of Claude Design which means you can only share the link to the design with other users on your account?! You can export the design, though, but then you need somewhere to quickly drop a bunch of HTML + assets. This would be perfect for that.

andrethegiant•1h ago

Netlify made this 10 years ago... they even copied the name! https://app.netlify.com/drop

brightball•1h ago

There are numerous products like this out there. Isn’t that where Dropbox got its name in the first place?

latchkey•14m ago

Don't forget Digital Ocean Droplets.

tech234a•52m ago

And BitBalloon before that (which Netlify acquired) http://web.archive.org/web/20131028083240/https://www.bitbal...

dmillar•36m ago

Low barrier services don't care who's first in this epoch.

Cider9986•1h ago

>Something went wrong An unexpected error occurred. Please try again or contact support.

I have a few qualms with this app.

collabs•1h ago

Congratulations on launching!

I tried uploading a git repository that I have previously successfully published on Github pages. This is a "no build" website I have built with the help of Claude. It should just work but I keep getting an error. Who can I reach out to give them steps to reproduce? The website repository is public and I feel like anyone at Cloudflare who wants to reproduce my problem can quite literally clone my repo and upload it to cloudflare drop.

Please drop your cloudflare email address and I will reach out to you with my repository information.

turtlebits•50m ago

Or you could do some of your own troubleshooting? Uploading a git repo is different than uploading a zipped/folder, especially if your index.htm/l isn't at the root.

altairprime•59m ago

Hah! This is exactly how I’m serving the vestigial remnant of my blogging in the early 2000s from a ZIP-backed Cloudflare Worker today. Should I rebuild my site with Drop+Claim or is it fine as-is? I kind of feel like ‘if what I have works, don’t change it’ is the best path.

heipei•53m ago

Cloudflare is really good at launching features that facility low-friction deployment of malicious content (such as phishing) on the Internet, piggybacking on their hosting reputation and the fact that you can't easily block their ASN or domains.

Waterluvian•43m ago

Be the change you want to see to make the world of your dreams.

And then sell its denizens malice protection services.

simultsop•30m ago

I don't know your experience. Once I was toying around and doing a basic auth with registration and so. The weekend was over and couldn't get back to that couple of months. The worker was quarantined and marked as phishing automatically. So I believe they have something in place to prevent those you complain.

jszymborski•14m ago

Your anecdote just illustrates that their system detects legit uses as abuses, not that they have a system that effectively detects abuses.

system2•53m ago

It would be nice if we could see some information such as file size limitations, demos, link structure, management, etc. Am I expected to upload a random HTML file and see how it works?

Fergusonb•12m ago

Yep, I chucked it a file on my desktop: index.html present Max individual file size 25MB Total file count <2000 Total size less than 100MB

petee•6m ago

[delayed]

ricardobeat•36m ago

I remember doing this in 2006. FTP. Good times.

sleepynoodle•32m ago

This is so cool.

S0y•31m ago

Cloudflare has the astonishing ability to make me hate them more as a company every new feature they launch.

vevoe•29m ago

why?

S0y•26m ago

Every new feature they've launched recently can be used to make the web more dangerous for everyone except those who use Cloudflare.

denismenace•24m ago

How would this make the web more dangerous? Its just static file hosting. Already wildly available!

latchkey•13m ago

phishing

TZubiri•13m ago

The argument would be that they sell the kevlar and the guns

Kevlar:

https://developers.cloudflare.com/bots/ https://www.cloudflare.com/products/turnstile/

Guns:

https://support.cloudflarewarp.com/

To be fair, CF mainly develops defensive cybersecurity products, the extent to which their tools might be used maliciously is pretty on par with other regular tools.

But, it just has bad optics and potential COI/Racketeering when CF is at both sides of the counter.

To be explicit, in case it isn't obvious,Cloudflare emerged as a DDoS protection company, detecting attacks from distributed sources is part of the raison d'etre, and domains and IP addresses are a key part of that infrastructure.

By subletting their own IP addresses for navigation with warp, and their own domains for hosting of webcontent with subdomain hosting, they are providing pooled anonimity for their customers, which is precisely what makes it very hard for defenders on the other side to implement foundational security measures like IP bans, or IP block bans, or domain bans, or Whois/RDAP domain analysis.

toomuchtodo•29m ago

Cloudflare folks: Please consider supporting WARC archives for deployment.

jonluca•24m ago

Wow the people in this thread are a huge bummer. This is much cooler and I doubt this is a real safety issue. You can already sign up for a free cloudflare account and deploy it for free, on your own, on a free workers.dev domain. The friction removal here isn't going to meaningfully change the security / amount of malicious content.

djfobbz•23m ago

Yet I can't drag and drop a plain old HTML file without putting it in a folder or a ZIP file first.

rickcarlino•23m ago

Desktop operating systems should be able to run zipped web apps the way Electron apps run today. It ought to just be part of the OS.

TZubiri•5m ago

And if there's a form or something with a backend? Just break?

nalekberov•19m ago

The internet will soon be flooded with even more scam landing pages.

BoppreH•14m ago

Dropped a folder with a small HTML project, and after 20 seconds got "Something went wrong. An unexpected error occurred. Please try again or contact support.".

Note how the error has zero information.

Looking at the network requests, a POST request to /upload returned 403 and an HTML page starting with "Sorry, you have been blocked", and to "email the site owner to let them know you were blocked". Happens even with adblocker and cookie extensions disabled, and I don't usually have problems with Cloudflare sites. Firefox on linux.

I'm very tired of this adversarial approach to software and vague errors.

EDIT: it was the 'fsmonitor-watchman.sample' default hook in the .git folder. "Please try again" and "you've been blocked" for committing the sin of uploading a folder that's a git repository. Sigh...

OpenAI no longer recommends SWE-Bench Pro

Chatto is now Open Source

Fable is not a useful model

SWE-1.7 Reach Near GPT 5.5 and Opus Intelligence

Cloudflare Drop

Mistral's Robostral Navigate: a state of the art robotics navigation model

Decoding the obfuscated bash script on a Uniqlo t-shirt

Show HN: Microsoft releases Flint, a visualization language for AI agents

FAANG Simulator

GPT‑Live

A bug which affected only left handed users

OpenMandriva: Statement regarding attempted distribution sabotage

Cloudflare Meerkat - Globally distributed consensus

Show HN: Onboard-CLI, a LLM powered and AST-based tool to visualize codebase

I Built a Telegram Client for Pi

EU now one step away from reviving private message scanning rules

DKIM2 and DMARCbis Have Landed

OpenBSD has a use-after-free allowing local privilege escalation to root

Turning a pile of documents into a searchable useable knowledge base

Understanding B-Tree Indexes in PostgreSQL: A Comprehensive Guide– Part 1

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

Show HN: Agent Draw: An agent draws while you talk, built on TLDraw

TypeScript 7

Show HN: Hnwork.app – UI for Who is hiring posts

Agentic test processes, LLM benchmarks, and other notes on agentic coding fr

Show HN: Follow London Trains in 3D

EVE Online's Carbon engine is now open source: Fenris Creations explains why

PlayStation can delete all your digital games after 3 years of inactivity (EU)

TabFont – guitar tabs rendered as you type

What Do We Know About the Microplastics Inside Us?

Cloudflare Drop

Comments

OpenAI no longer recommends SWE-Bench Pro

Chatto is now Open Source

Fable is not a useful model

SWE-1.7 Reach Near GPT 5.5 and Opus Intelligence

Cloudflare Drop

Mistral's Robostral Navigate: a state of the art robotics navigation model

Decoding the obfuscated bash script on a Uniqlo t-shirt

Show HN: Microsoft releases Flint, a visualization language for AI agents

FAANG Simulator

GPT‑Live

A bug which affected only left handed users

OpenMandriva: Statement regarding attempted distribution sabotage

Cloudflare Meerkat - Globally distributed consensus

Show HN: Onboard-CLI, a LLM powered and AST-based tool to visualize codebase

I Built a Telegram Client for Pi

EU now one step away from reviving private message scanning rules

DKIM2 and DMARCbis Have Landed

OpenBSD has a use-after-free allowing local privilege escalation to root

Turning a pile of documents into a searchable useable knowledge base

Understanding B-Tree Indexes in PostgreSQL: A Comprehensive Guide– Part 1

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

Show HN: Agent Draw: An agent draws while you talk, built on TLDraw

TypeScript 7

Show HN: Hnwork.app – UI for Who is hiring posts

Agentic test processes, LLM benchmarks, and other notes on agentic coding fr

Show HN: Follow London Trains in 3D

EVE Online's Carbon engine is now open source: Fenris Creations explains why

PlayStation can delete all your digital games after 3 years of inactivity (EU)

TabFont – guitar tabs rendered as you type

What Do We Know About the Microplastics Inside Us?