Goodbye File Browser, for Real This Time - Henrique DiasSkip to contentH<br>Henrique Dias<br>known as @hacdias

Contact<br>✉️ Email<br>💬 Signal<br>Elsewhere<br>🦋 Bluesky<br>🐙 GitHub<br>📷 Instagram<br>🐘 Mastodon<br>💼 LinkedIn<br>Yesterday, I published the last planned release of File Browser. It includes a few security fixes and a notice about the wind-down of the project. Alongside it, I announced that this was the last planned release and updated the repository so that it&rsquo;s ready to be archived on September 1st. For many people this came as a surprise. For those who&rsquo;ve been following the project from close by, probably not. Either way, I wanted to write a bit about the decision and how we got to this point.<br>Screenshot of File BrowserHow We Got Here<br>This isn&rsquo;t the first time I&rsquo;ve said goodbye. In 2020, I wrote Goodbye File Browser and handed the project over to someone in the community. Maintainers came and went. At the end of last year, I noticed the project hadn&rsquo;t been maintained for a year or so, and I took the reins again. It felt better to do and say something than to keep issues and PRs unanswered.<br>In March, I wrote Update on File Browser: how the project came to be, why it is the way it is, and why I had put it in maintenance-only mode. I won&rsquo;t repeat all of that here, and I&rsquo;d recommend reading it if you&rsquo;re interested. The TLDR is that I started this project as a 15 year old, more than ten years ago, because I wanted a single-binary browser based File Browser. It became far more popular than I could ever have envisioned – over 35 000 stars on GitHub – and it never stopped being code written by a 15 year old.<br>Why I’m Stopping<br>Not much has changed since March. The security vulnerability advisories kept coming. I reviewed each one and write a fix – sometimes myself, sometimes with Claude, sometimes a better fix than others. For certain features, I decided not to touch them at all, because fixing the real source of the problem would require rewriting the whole feature. Those are documented in the repository, and they will stay unfixed.<br>What I&rsquo;ve come to accept is that this can&rsquo;t be patched into shape. File Browser would need to be rewritten from the ground up, with security and a good API in mind, neither of which was on my mind when I was 15. Sessions are the clearest example: expired tokens keep working in some situations, and logging out doesn&rsquo;t invalidate a token, so if someone stole it, it still works. There are many things like this, and each one is a rewrite of its own.<br>Doing any of it well also takes time. I&rsquo;ve been spending a few hours most weekends going through issues and advisories, and it&rsquo;s just not enough. I can tell the quality isn&rsquo;t what I&rsquo;d want it to be. To make something better, I&rsquo;d need much more time than I have.<br>Mostly, though, the will isn&rsquo;t there anymore. For me this is a project from over ten years ago. It reached its goal, it happened to become popular, and maintaining a codebase I don&rsquo;t think is good doesn&rsquo;t give me any pleasure. Another year of weekends wouldn&rsquo;t change that. People have told me over the past years that I should stop, and they&rsquo;ve been right all along. They see the frustration in me.<br>What Now<br>The project is prepared to be archived. No more issues or pull requests can be opened until the archival date. You can still report security vulnerabilities, which will be made public on the day of archival, or before. However, they will not be addressed.<br>The project is delivered as-is. If you want to keep using it, treat it as any other piece of deprecated software: use at your own risk, don&rsquo;t expose it to the public Internet, and be mindful of the known security vulnerabilities listed on the README and on the advisories page.<br>I&rsquo;d rather have you, or any user, using a different alternative. I can&rsquo;t recommend any specific alternative, as I haven&rsquo;t compared them side-by-side, or even used them. What I can point you to is this post on r/selfhosted, where people have been sharing the projects they&rsquo;ve been using for quite some time, or check Awesome Self-hosted. That&rsquo;s where I&rsquo;d start.<br>Thanks to everyone that has ever contributed to the project, and for all the effort that has ever been put here. It&rsquo;s been quite a long journey for something that was never meant to be anything else other than a personal side project.<br>Goodbye File Browser, for real this time! 👋