Drop-Zone

Most “send a file” tools either store data on someone else’s servers or assume both machines are on the same LAN. I wanted something that works across NATs and networks, stays installable like ordinary CLI software, and treats the introduction server as untrusted infrastructure rather than a place files live.

The system splits into a C++20 client and a storage-free rendezvous daemon. Clients authenticate to each other with passwords and long-lived identity keys; the server only matches usernames, forwards public keys and candidate addresses for the life of a socket, then forgets them. Bulk data uses the same encrypted stream whether it travels over direct TCP, hole-punched UDP, or a last-resort ciphertext relay.

Connectivity is not a single socket strategy. Peers walk a shared ladder—direct TCP, then authenticated UDP hole punching, then server relay only if both sides give up—so campus Wi‑Fi and home NATs degrade gracefully instead of failing silently. Forcing a tier is available for tests; automatic selection is the default product path.

Passwords never sit in the clear on disk; identity keys are sealed in a local keystore. Peers pin each other’s Ed25519 fingerprints on first contact (SSH-style). Payloads use AEAD in large independently-nonced chunks, with AES-GCM or ChaCha20 chosen at runtime from CPU features. Plaintext is optional on trusted networks and refused on the relay so operator machines never hold readable file bytes.

Encryption and I/O are built for throughput (parallel sealing, sendfile when encryption is off). A single Homebrew bottle stays portable by selecting crypto fast paths at runtime rather than compiling for one CPU. Release packaging includes a public formula and a deployable, storage-free server.

Ephemeral groups let several people accept under one name without accounts or persistence: membership exists only while someone is connected, and a group send fans out to whoever is online. That forced careful design around join races, password verifiers, and reconnect behavior—the same class of concurrency and protocol edge cases production networking software has to get right.

The hard parts were not the happy path. NAT traversal that agrees on a two-way path, relay back-pressure without deadlocks, ladder fallback that doesn’t leave one peer stranded with “no pairing,” and accept loops that recover after a failed channel all showed up as real bugs. Fixing them meant reading packet timing and server queueing carefully, not just adding retries.

The repo is structured as client / server / shared protocol code with documented wire format, security notes, and performance notes. Unit tests cover crypto and framing; loopback end-to-end tests exercise every transport tier and group behavior so regressions in the ladder or relay don’t slip through.

The project is a full systems slice: custom protocol design, C++ systems programming, networking and NAT traversal, cryptography used in a product setting, concurrent server I/O, packaging for real users, and debugging production-shaped failure modes. It’s meant to be used, not just demonstrated.