diff --git a/apps/cory/index.json b/apps/cory/index.json
index 9cf2ae61..a4f0b98f 100644
--- a/apps/cory/index.json
+++ b/apps/cory/index.json
@@ -1 +1 @@
-{"type":"tildefriends-app","files":{"app.js":"&mDHhPk+YJm9K32UmO6WNUoJGM1tX4Dx7GIMjLvyurXg=.sha256","index.html":"&WJSszNEPd6ypJkfTUu/YHSDvU8VZrAHvyRmzNoZBPb0=.sha256","vue-material.js":"&K5cdLqXYCENPak/TCINHQhyJhpS4G9DlZHGwoh/LF2g=.sha256","tf-user.js":"&DdJwZYEo7AqFyutYMvEjykoVXxdHVog0UXye6Sbo0TU=.sha256","tf-message.js":"&3dPiSNYjoJE3zn1oTT1SBhbvkW9MHr7ZUDxUJiBI1Ss=.sha256","tf.js":"&DQtOS/nh5/a6QlqNrIb5Zi3Bz4pn3MBe5peRkwLZuyA=.sha256","commonmark.min.js":"&EP0OeR9zyLwZannz+0ga4s9AGES2RLvvIIQYHqqV6+k=.sha256","vue.js":"&g1wvA+yHl1sVC+eufTsg9If7ZeVyMTBU+h0tks7ZNzE=.sha256","vue-material-theme-default-dark.css":"&RP2nr+2CR18BpHHw5ST9a5GJUCOG9n0G2kuGkcQioWE=.sha256","vue-material.min.css":"&kGbUM2QgFSyHZRzqQb0b+0S3EVIlZ0AXpdiAVjIhou8=.sha256","roboto.css":"&jJv43Om673mQO5JK0jj7714s5E+5Yrf82H6LcDx7wUs=.sha256","material-icons.css":"&a28PdcVvgq/DxyIvJAx/e+ZOEtOuHnr3kjLWKyzH11M=.sha256","tf-shared.js":"&+qPP3g4CAUlkt8K4iBCZ+F5Fy6N7fu6MggvSVss2juE=.sha256"}}
\ No newline at end of file
+{"type":"tildefriends-app","files":{"app.js":"&ZPex8H1nwzrEHSgi5SkvfTlSzSIutT6iHOY08LWkwZg=.sha256","index.html":"&H2L4kR9xDS6oS7EDpesDCDB3JXDjcLTBg9XoR2mZaZw=.sha256","vue-material.js":"&K5cdLqXYCENPak/TCINHQhyJhpS4G9DlZHGwoh/LF2g=.sha256","tf-user.js":"&DdJwZYEo7AqFyutYMvEjykoVXxdHVog0UXye6Sbo0TU=.sha256","tf-message.js":"&3dPiSNYjoJE3zn1oTT1SBhbvkW9MHr7ZUDxUJiBI1Ss=.sha256","tf.js":"&RAwMitnSkY+F3lDbyXAvWYT1QOX0lUsNZC+JE7KW4JM=.sha256","commonmark.min.js":"&EP0OeR9zyLwZannz+0ga4s9AGES2RLvvIIQYHqqV6+k=.sha256","vue.js":"&g1wvA+yHl1sVC+eufTsg9If7ZeVyMTBU+h0tks7ZNzE=.sha256","vue-material-theme-default-dark.css":"&RP2nr+2CR18BpHHw5ST9a5GJUCOG9n0G2kuGkcQioWE=.sha256","vue-material.min.css":"&kGbUM2QgFSyHZRzqQb0b+0S3EVIlZ0AXpdiAVjIhou8=.sha256","roboto.css":"&jJv43Om673mQO5JK0jj7714s5E+5Yrf82H6LcDx7wUs=.sha256","material-icons.css":"&a28PdcVvgq/DxyIvJAx/e+ZOEtOuHnr3kjLWKyzH11M=.sha256","tf-shared.js":"&+qPP3g4CAUlkt8K4iBCZ+F5Fy6N7fu6MggvSVss2juE=.sha256"}}
\ No newline at end of file
diff --git a/apps/cory/index/app.js b/apps/cory/index/app.js
index 9c3a8d18..1594653d 100644
--- a/apps/cory/index/app.js
+++ b/apps/cory/index/app.js
@@ -421,6 +421,8 @@ core.register('message', async function(m) {
 		if (g_ready) {
 			await refresh(g_selected);
 		}
+	} else if (m.event == 'storeBlobComplete') {
+		await app.postMessage({storeBlobComplete: m.path});
 	} else if (m.event == 'focus' || m.event == 'blur') {
 		/* Shh. */
 	} else {
diff --git a/apps/cory/index/index.html b/apps/cory/index/index.html
index 7deac997..4f5b0b00 100644
--- a/apps/cory/index/index.html
+++ b/apps/cory/index/index.html
@@ -73,6 +73,9 @@
 							</div>
 						</md-card-content>
 						<md-card-actions>
+							<md-button class="md-icon-button" @click="attach">
+								<md-icon>attach_file</md-icon>
+							</md-button>
 							<md-menu>
 								<md-button md-menu-trigger>Share App</md-button>
 								<md-menu-content>
diff --git a/apps/cory/index/tf.js b/apps/cory/index/tf.js
index 8e1f33de..d7ec7f27 100644
--- a/apps/cory/index/tf.js
+++ b/apps/cory/index/tf.js
@@ -143,6 +143,14 @@ function processMessages() {
 			if (g_data.selected == g_data.whoami) {
 				updateEditUser();
 			}
+		} else if (key == 'storeBlobComplete') {
+			var blob = event.data.storeBlobComplete;
+			g_data.post_text = (g_data.post_text || '') + `\n![${blob.name}](${blob.path.substring(1)})`;
+			Vue.set(g_data.mentions, blob.path.substring(1), {
+				link: blob.path.substring(1),
+				name: blob.name,
+				type: blob.type,
+			});
 		} else {
 			g_data[key] = event.data[key];
 		}
@@ -229,6 +237,26 @@ window.addEventListener('load', function() {
 			set_hash(hash) {
 				window.parent.postMessage({action: 'setHash', hash: hash ? hash : '#'}, '*');
 			},
+			attach() {
+				var input = document.createElement('input');
+				input.type = 'file';
+				input.onchange = function(event) {
+					var file = event.target.files[0];
+					file.arrayBuffer().then(function(buffer) {
+						console.log(buffer);
+						window.parent.postMessage({action: 'storeBlob',
+							blob: {
+								name: file.name,
+								type: file.type,
+								buffer: buffer,
+							}
+						}, '*');
+					}).catch(function(e) {
+						console.log('error', e);
+					});
+				};
+				input.click();
+			},
 		}
 	});
 	window.parent.postMessage('ready', '*');
diff --git a/core/client.js b/core/client.js
index 6371b6d2..6bee01f1 100644
--- a/core/client.js
+++ b/core/client.js
@@ -644,6 +644,18 @@ function message(event) {
 		iframe.setAttribute("height", event.data.height);
 	} else if (event.data && event.data.action == "setHash") {
 		window.location.hash = event.data.hash;
+	} else if (event.data && event.data.action == 'storeBlob') {
+		var request = new XMLHttpRequest();
+		request.addEventListener("loadend", function() {
+			if (request.status == 200) {
+				var iframe = document.getElementById("document");
+				iframe.contentWindow.postMessage({'storeBlobComplete': {name: event.data.blob.name, path: request.responseText, type: event.data.blob.type}}, '*');
+			}
+		});
+		request.open('POST', "/save", true);
+		request.setRequestHeader("Content-Type", "application/binary");
+		console.log('storing', event.data.blob.buffer);
+		request.send(event.data.blob.buffer);
 	} else {
 		send({event: "message", message: event.data});
 	}
diff --git a/core/httpd.js b/core/httpd.js
index 6608d900..111529c2 100644
--- a/core/httpd.js
+++ b/core/httpd.js
@@ -390,7 +390,7 @@ function handleConnection(client) {
 				if (headers["content-length"] != undefined) {
 					bodyToRead = parseInt(headers["content-length"]);
 					lineByLine = false;
-					body = "";
+					body = new Uint8Array(bodyToRead);
 					return true;
 				} else if (headers["connection"]
 					&& headers["connection"].toLowerCase().split(",").map(x => x.trim()).indexOf("upgrade") != -1
@@ -406,9 +406,12 @@ function handleConnection(client) {
 				}
 			}
 		} else {
-			line = utf8Decode(line);
-			body += line;
-			bodyToRead -= length;
+			var offset = body.length - bodyToRead;
+			if (line.length > body.length - offset) {
+				line = line.slice(0, body.length - offset);
+			}
+			body.set(line, offset);
+			bodyToRead -= line.length;
 			if (bodyToRead <= 0) {
 				finish();
 			}