diff --git a/src/wormhole/receive_file.py b/src/wormhole/receive_file.py
index 845572a..dcda6c6 100644
--- a/src/wormhole/receive_file.py
+++ b/src/wormhole/receive_file.py
@@ -1,8 +1,6 @@
-
-import sys, json
+import os, sys, json
 from binascii import unhexlify
 from nacl.secret import SecretBox
-from nacl import utils
 from . import api
 
 APPID = "lothar.com/wormhole/file-xfer"
@@ -16,8 +14,20 @@ them_bytes = r.finish()
 them_d = json.loads(them_bytes.decode("utf-8"))
 print("them: %r" % (them_d,))
 xfer_key = unhexlify(them_d["xfer_key"].encode("ascii"))
-filename = them_d["filename"] # unicode
+filename = os.path.basename(them_d["filename"]) # unicode
 filesize = them_d["filesize"]
 relay = them_d["relay"].encode("ascii")
 
 # now receive the rest of the owl
+encrypted = RECEIVE(relay)
+
+decrypted = SecretBox(xfer_key).decrypt(encrypted)
+
+# only write to the current directory, and never overwrite anything
+here = os.path.abspath(os.getcwd())
+target = os.path.abspath(os.path.join(here, filename))
+assert os.path.dirname(target) == here
+assert not os.path.exists(target)
+with open(target, "wb") as f:
+    f.write(decrypted)
+print("%s written" % filename)
diff --git a/src/wormhole/receive_text.py b/src/wormhole/receive_text.py
index 9bf6fdd..69db776 100644
--- a/src/wormhole/receive_text.py
+++ b/src/wormhole/receive_text.py
@@ -1,9 +1,7 @@
-
 import sys, json
 from . import api
 
 APPID = "lothar.com/wormhole/text-xfer"
-RELAY = "example.com"
 
 # we're receiving
 code = sys.argv[1]
diff --git a/src/wormhole/send_file.py b/src/wormhole/send_file.py
index a3a26cc..87b6a61 100644
--- a/src/wormhole/send_file.py
+++ b/src/wormhole/send_file.py
@@ -1,4 +1,3 @@
-
 import os, sys, json
 from binascii import hexlify
 from nacl.secret import SecretBox
@@ -28,4 +27,12 @@ them_bytes = i.finish()
 them_d = json.loads(them_bytes.decode("utf-8"))
 print("them: %r" % (them_d,))
 
+box = SecretBox(xfer_key)
+with open(filename, "rb") as f:
+    plaintext = f.read()
+nonce = utils.random(SecretBox.NONCE_SIZE)
+encrypted = box.encrypt(plaintext, nonce)
+
 # now draw the rest of the owl
+SEND(RELAY, encrypted)
+print("file sent")
diff --git a/src/wormhole/send_text.py b/src/wormhole/send_text.py
index 486db88..8ead0ec 100644
--- a/src/wormhole/send_text.py
+++ b/src/wormhole/send_text.py
@@ -1,15 +1,10 @@
-
 import sys, json
-from nacl.secret import SecretBox
-from nacl import utils
 from . import api
 
 APPID = "lothar.com/wormhole/text-xfer"
-RELAY = "example.com"
 
 # we're sending
 message = sys.argv[1]
-xfer_key = utils.random(SecretBox.KEY_SIZE)
 blob = json.dumps({"message": message,
                    }).encode("utf-8")
 i = api.Initiator(APPID, blob)