Skip to content

FFL

v3.8.3 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 4mo Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cosmopolitan-libc data-transfer end-to-end-encryption file-sharing folder-share networking
+4 more
peer-to-peer transfer tunnel webrtc

Summary

AI summary

Virtual File System and Event Hook support were added, enabling embedded integration of ffl.

Full changelog

🚀 What's New in v3.8.3

🔌 Embedded Mode: VFS & Event Hooks

This release introduces powerful tools for developers to integrate ffl into other applications (including our upcoming Android version).

  • Virtual File System (--vfs):
    You can now map specific files or folders to internal vfs:// URIs. This allows ffl to serve content from abstract sources (like Android's content:// providers) as if they were standard files.
  • Event Hooks (--hook):
    Monitor transfer status in real-time without parsing CLI output.
    • File Mode: Pass a file path (e.g., --hook logs.jsonl) to stream events as JSON Lines.
    • Webhook Mode: Pass a URL (e.g., --hook http://localhost:8080/event) to POST events via HTTP.
      This makes ffl incredibly easy to wrap or embed inside other software.

🔐 Security & Privacy

  • Environment Variable for Passwords:
    Added support for FFL_AUTH_PASSWORD. You can now set the authentication password via environment variable to keep it out of your shell history and process list.

🐛 Bug Fixes & Improvements

  • Robust DTLS Fragmentation (Low-MTU Fix):
    Resolved a connectivity issue where APE builds (especially on Firefox) would hang on specific tunnels (e.g., 852) or networks with strict MTU limits. The P2P handshake now correctly handles large packet fragmentation, ensuring direct P2P connections succeed reliably without falling back to relay.
  • Concurrent Stdin Streaming:
    Fixed a race condition where multiple recipients downloading from stdin simultaneously could cause data corruption or connection drops. Streaming to multiple peers is now robust.
  • Cleaner Shutdown:
    Silenced spurious asyncio warnings (e.g., "Task was destroyed but it is pending!") that appeared during exit.
  • General UI Polish:
    Various minor tweaks to log messages for better clarity.

📦 Which file should I download?

  • If you want a single file that runs everywhere, across OSes? choose APE (ffl.com / fflo.com).
  • If you want platform-optimized size/perf, choose a native build. 🙂
  • On Linux and unsure about glibc (or on musl)? -> APE ffl.com is the safest choice.

ℹ️ On the first run of a native build, the app performs an internal extraction step (by pyapp), so startup is temporarily slower once.
The install scripts pre-warm this step; manual downloads will see the one-time delay.
APE builds (ffl.com / fflo.com) are single-file and do not have this first-run warmup.


Windows (native)

  • x86_64ffl-v3.8.3-x86_64-windows.zip
    Unzip to get ffl.exe.

Linux (native)

We publish two glibc baselines. Pick the highest baseline that does not exceed your system glibc:

  • glibc 2.39+ — smaller & faster

    • ffl-v3.8.3-manylinux_glibc2.39-x86_64-linux.tar.gz
    • Best for newer distros (e.g., Ubuntu 24).
  • glibc 2.28+ — widest compatibility

    • ffl-v3.8.3-manylinux_glibc2.28-x86_64-linux.tar.gz
    • Works on older distros (e.g., Ubuntu 20); larger due to additional internal linking.

⚠️ If your system is musl-based (e.g., Alpine) or you’re unsure about glibc, prefer APE ffl.com.

macOS (native)

  • Apple Silicon (arm64)ffl-v3.8.3-aarch-darwin.tar.gz
  • Intel (x86_64)ffl-v3.8.3-x86_64-darwin.tar.gz

The archive unpacks to a single ffl binary.

🧰 APE (cross-platform single file, zero external deps)

  • ffl.com — Single-file build that runs natively on Linux, macOS, Windows, FreeBSD, OpenBSD 7.3, NetBSD, BIOS, and Android (Termux).
  • fflo.com — Alternative APE build that is exactly aligned with the open-source repo (no additional/proprietary addons).
    As a result, features that require closed-source components—such as upload to server (e.g., --upload)—are not available.

For a deeper comparison between native and APE, see the README’s notes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track FFL

Get notified when new releases ship.

Sign up free

Related context

Beta — feedback welcome: [email protected]