NZB Directory site with auto upload to SABnzbd

[kaigoh]

Hi guys,

Had an idea floating in my head for the last few days and I wanted to see what you would think about it. 

Would you use an NZB directory site that featured auto uploading of NZBs to your SABnzbd queue?

Let me know what you think?

Thanks,

Kai.

[inpheaux]

What would be the point of this? We already have file-association so you can set your browser to associate nzbs with SABnzbd. That covers getting nzbs into SABnzbd locally with no plugins whatsoever. We also already have nzbdstatus, SAB Connect, and user.js scripts, which all work on a variety of existing nzb indexers and can work with both local and remote SABnzbd installations.

So what make this any different/better/etc than what we have now?

[gnaget]

I don't know what SAB Connect is (a google search doesn't even help clarify it).  There is a definite point to it for people who use SABnzbd on a server.  I've often wished NZBMatrix would allow me to bookmark an nzb so my server will automatically grab it, but alas it does not.  Newzbin supposedly does, and so I am trying to get an invite to try them out. 

[kaigoh]

Well, the idea I have is to create a private NZB directory, i.e. invite only, that works like the other public directories, linking to NZBs, catergorising NZBs etc., but linking your account on the site with your SABnzbd server, so when you click a download link on the directory site, instead of you having to either manually upload the nzb/rely on rss/drop the nzb into your blackhole directory/use third party tools to get the NZBs to your SABnzbd, the site will communicate directly to your server and seamlessly send the nzb over so it starts downloading automatically, with only one click.

I'm away from home alot, so I like the idea of one click downloads, rather than having to find a way of getting the nzb's to my server when I may only have limited internet access.

I'll be working on this over the weekend, so may need some beta testers. Reply here if you are interested...

Kai.

[gnaget]

a word of advice, just keep it simple, and expose bookmarked nzbs via RSS (kinda like MyTvNZB, only for specific NZBs)

[inpheaux]

when you click a download link on the directory site, instead of you having to either manually upload the nzb/rely on rss/drop the nzb into your blackhole directory/use third party tools to get the NZBs to your SABnzbd, the site will communicate directly to your server and seamlessly send the nzb over so it starts downloading automatically, with only one click.

You've got a couple options on how to do this:

1) Store SABnzbd credentials (login, password, url, api key) in cleartext for all users on your site. It would have to be cleartext (or something else that's easily reversible) because you would have to transmit them in cleartext when adding an NZB. This would be super super dangerous, because it means if you get sued (and you would be a target), I believe your user records would be discoverable, meaning whoever sued you could gain access to all of your users' SABnzbd installations.

In addition to being super dangerous, this would be no better than using a third-party tool like nzbdstatus, SABconnect (Sorry I forgot the link last time, I didn't realize it was so difficult to Google), or whatever, because you would still have to go to the effort of making your SABnzbd installation remotely accessible. You'd basically just be using a centralized third-party tool.

2) Store SABnzbd credentials (again, login, password, url, api key) in cleartext in a cookie. You'd still have the same problem of basically using a third-party tool, but you'd have fewer security issues. Your SABnzbd installation would still have to be remotely accessible. This is basically how LeetTV works.

3) Use a bookmark system like Newzbin. Wouldn't work immediately because we'd have to implement your site's API in SABnzbd first. But hey, at least you wouldn't have to store credentials anywhere, and your SABnzbd installation wouldn't need to be remotely accessible. But it also wouldn't be instantaneous.

4) Implement a "Private RSS Feed" like nzbs.org. Essentially a bookmark system, but with RSS instead of an API like Newzbin. This would work immediately, be safe, and not require your SABnzbd installation to be remotely accessible. But again, wouldn't be instantaneous.

Of these options, only #1 is an actually new idea. It is conveniently also the most dangerous one, and I would stay the hell away from such a site if it existed. #4 is probably your best bet, but your implementation would be no better than nzbs.org, and it wouldn't be instantaneous.

So, again, I ask how this would be any better/faster/etc than existing sites or plugins?

I promise I'm not attempting to shit all over your idea, just making sure you don't go through the effort of developing the hard parts of a usenet indexer (setting up your scraper, figuring out how you're going to store all those headers, NZB generation, intelligent post grouping, etc) and have you then find that there's no good, safe, instantaneous method of doing what you actually want.

[kaigoh]

Inpheaux,

Don't worry, I don't think you are trying to shit on my idea, I appreciate your comments and pointers.

Instead of going down newzbin's scraper method, I was thinking more along the lines of nzbmatrix, with users uploading their NZBs.

I was considering No. 1, but utilising HTTPS to talk to SABnzbd and encrypting the users details on an individual basis, i.e. not one shared key.

So essentially, username, password and API would be sent clear text, but over HTTPS. I realise HTTPS isn't 100% safe, but its pretty much up there.

Kai.

[inpheaux]

I was considering No. 1, but utilising HTTPS to talk to SABnzbd and encrypting the users details on an individual basis, i.e. not one shared key.

So essentially, username, password and API would be sent clear text, but over HTTPS. I realise HTTPS isn't 100% safe, but its pretty much up there.

You'd also have to store users' SABnzbd addresses, and to do it over HTTPS users would have to be on SABnzbd 0.5 and actually have HTTPS set up.

And this wouldn't change the fact that you'd still have to store all that data. To encrypt all the sensitive user data you'd have to have a pretty sophisticated system set up like what Digsby does, essentially making it so that the encrypted data you store is NOT decryptable by anything you store. But Digsby doesn't have the same HTTPS problem you have, they can make sure they only transmit the unencrypted data over an SSL channel.

In general, I just think there are waaaaaaay too many security issues to be concerned with here. The safest, easiest, simplest and best way of getting NZBs into a remote SABnzbd installation without worrying about any kind of third-party tool is via a personalized NZB drop box that serves up an HTTPS RSS feed. You lose the immediacy, since you can't break the 15-minute minimum wait time, but you don't have to deal with any of the security problems, it doesn't depend on any third-party tools, your SABnzbd installation doesn't have to be remotely-available, and nothing has to be changed in SABnzbd's code to support it. The only setup you have to do is copy the RSS URL from the site to SABnzbd, as opposed to set up HTTPS, set up dyndns, set up SABnzbd to be remotely accessible, give your SABnzbd login credentials, URL, API key, etc to the site, and so on.

Edit: Plus with RSS you gain a broader audience.

[kaigoh]

Actually, the encryption system I have in place works exactly like Digsby. I only store a hash of the username and password, everything else is encrypted using the cleartext password, of which no trace is stored on the server or stored in cookies.

It would be sensible for me to make SABnzbd 0.5 with HTTPS a prerequisite of using that feature of my site.

Kai.

[duz]

It sounds like all you're doing is recreating all the problems that led to RSS being invented.  You also havn't said how this will be any better than a custom RSS and it seems you have several fundamental misunderstandings about encryption and security.
Honestly you'd be better off if this site generated a custom RSS feed that you could add new items to and anytime without having to go to SAB, kind of like Newzbin's saved searches but even more customizable.

[kaigoh]

It seems you have several fundamental misunderstandings about encryption and security.

Specifically?

K.