7 ms·

If there is one thing that I have considered a flaw in computing, it's that there have been few ways for inexperienced developers and users to use one simple sy

by trotsky 13y ago

If there is one thing that I have considered a flaw in computing, it's that there have been few ways for inexperienced developers and users to use one simple system which allowed them to circumvent their host based firewall, their network IDS, their edge based UTM and the OS security assumptions around localhost being a protected, private interface. The value of a point and click system to expose these directly to the internet and a domain that serves as a collection point for them can not be understated. If a service is bonding only to ::1, and not 0.0.0.0 or your current routable ip it's explicitly deciding that it shouldn't be accessible from beyond the local computer. And in a lot of cases, it's right even if it doesn't explain why exactly. When exactly did we decide local port forwarding was too hard even for technical people? Or, I dunno, servers?

HerraBRE 13y ago
Abstracting away all the firewalls and IP addresses and stuff is really convenient. Restrictions aren't always put in place for a good reason, increasingly they are just a function of IP address scarcity. (disclaimer: I created https://pagekite.net/ https://pagekite.net/ which is one of localtunnel's competitors)
- woah 13y ago
  I really like pagekite! very convenient!
- trotsky 13y ago
  and yet when the service binds to localhost instead of a local, private routable address that clearly exists as you're tunneling to the internet, it has said "hey, look, whatever im doing i dont want any other computer anywhere to be able to connect. localhost is identical on everything explicitly so it has zero chance of routing. Why not open tunnels to whatever routable private ip you have up? And while a bit toung in cheek, i'm not too aware of this whole ip address scarcity thing. I've got a decent chunk of a /29, if you could use a /48 or ten for your local networks just ask! Or would it be tough to squeeze down to only 18,446,744,073,709,551,616 local addresses?
  - HerraBRE 13y ago
    Binding to localhost by default is good security hygene, a "closed by default" strategy, which doesn't necessarily mean you never intend to expose that server ever. Tools like PageKite and localtunnel are completely in line with that philosophy, nothing is exposed to the outside world until you explicitly request it and then only the named service you chose (as opposed to whatever is on the port or god forbid everything listening on a particular IP). I personally feel more secure temporarily exposing a server using PageKite than I would if my router had been reconfigured to always allow traffic through on particular ports - it's a lot easier to turn PageKite off than it is to go reconfigure my router every time I am done testing. Convenient security is good security, because it is more likely to be used correctly. IPv6... well, good luck with that. :-) Aside from how few western ISPs offer IPv6 service, consider the fact that the majority of our devices are mobile these days. My laptop changes networks and IPs many times a day and I still like being able to run a visible server on it. Configuring plain IPv4 or IPv6 to do that elegantly is decidedly nontrivial.
drivingmenuts 13y ago
I think I just heard many system administrators collectively clutching their chests in pain. If inexperienced devs and users could suddenly drop their pants at will, imagine the mayhem that would occur if experienced devs with malicious intent were set loose in that environment? You can't pretend they don't exist - in fact, it's better to assume everyone who's not you is out to utterly destroy your data ASAP. Some would argue don't even trust yourself. Those firewalls, ids, utms and assumptions are pretty much the only thing protecting inexperienced users from themselves.
- at-fates-hands 13y ago
  >>I think I just heard many system administrators collectively clutching their chests in pain. I was trained to do this by reflex. Anytime you expose anything on your network, not matter what it is, without some layer of security between you and the internet, you're asking for trouble. Whether this is a warranted reaction or not, I don't know. I'm pretty sure its from spending too much time hanging out with hackers and sys admins. It's just locked in my brain not to doing something like this - ever.
- derefr 13y ago
  I think, if you have a system administrator, you're not the target audience for localtunnel. This is for home users who don't understand how to get their computer+router+apartment building's switch+etc to cooperate in getting them a public route. Maybe they should just make it bind to a port below 1024, so it requires root/Administrator privileges to run. Then, if you are your own sysadmin, you can let yourself in--and if someone else is, you'll have to take it up with them.
  - deleted 13y ago
    [deleted]
  - snowwrestler 13y ago
    I think that making it easy for unsophisticated users to expose their personal machines directly to the public Internet is not a good idea. The way to test a web project in development is to put it on a cheap web host or VPS. If you want to help newbie developers, make that one-click easy.
mhurron 13y ago
I don't even know what to think of this. Are you arguing that it is a good thing for people who have no idea what they're doing to have a 1 button click to remove all security?
- relaxitup 13y ago
  I think you missed the sarcasm and irony that was fairly evident in his comment. However, perhaps we can expect a user who can gem install something to have an acceptable level of awareness of the security implications of such a tool?
  - mhurron 13y ago
    > However, perhaps we can expect a user who can gem install something to have an acceptable level of awareness of the security implications of such a tool? No, we can not. From both personal experience (developers can be dumb as bricks and know nothing outside their specific knowledge domain) and good security practices (you don't trust the user, even if they say they're good for it). And yes I hope it was just sarcasm I missed, but that's why I had to ask.
    - trotsky 13y ago
      it was indeed complete sarcasm.
- PeterisP 13y ago
  Can you elaborate on why you equate this localtunnel to "removing all security" ? I haven't tried it, but it seems to forward a single port that's running service X that I want to make available on the net. Any way whatsoever of fulfilling that need (no matter if it's one button click or setting up a separate VM for that service) would involve making a hole in all relevant firewalls and making the (possibly buggy) service X available to everyone. Is the user goal of "making service X available to everyone" bad in itself?
  - marquis 13y ago

by trotsky 13y ago

HerraBRE 13y ago

Abstracting away all the firewalls and IP addresses and stuff is really convenient. Restrictions aren't always put in place for a good reason, increasingly they are just a function of IP address scarcity. (disclaimer: I created https://pagekite.net/ https://pagekite.net/ which is one of localtunnel's competitors)

woah 13y ago
I really like pagekite! very convenient!
trotsky 13y ago
and yet when the service binds to localhost instead of a local, private routable address that clearly exists as you're tunneling to the internet, it has said "hey, look, whatever im doing i dont want any other computer anywhere to be able to connect. localhost is identical on everything explicitly so it has zero chance of routing. Why not open tunnels to whatever routable private ip you have up? And while a bit toung in cheek, i'm not too aware of this whole ip address scarcity thing. I've got a decent chunk of a /29, if you could use a /48 or ten for your local networks just ask! Or would it be tough to squeeze down to only 18,446,744,073,709,551,616 local addresses?
- HerraBRE 13y ago
  Binding to localhost by default is good security hygene, a "closed by default" strategy, which doesn't necessarily mean you never intend to expose that server ever. Tools like PageKite and localtunnel are completely in line with that philosophy, nothing is exposed to the outside world until you explicitly request it and then only the named service you chose (as opposed to whatever is on the port or god forbid everything listening on a particular IP). I personally feel more secure temporarily exposing a server using PageKite than I would if my router had been reconfigured to always allow traffic through on particular ports - it's a lot easier to turn PageKite off than it is to go reconfigure my router every time I am done testing. Convenient security is good security, because it is more likely to be used correctly. IPv6... well, good luck with that. :-) Aside from how few western ISPs offer IPv6 service, consider the fact that the majority of our devices are mobile these days. My laptop changes networks and IPs many times a day and I still like being able to run a visible server on it. Configuring plain IPv4 or IPv6 to do that elegantly is decidedly nontrivial.

drivingmenuts 13y ago

I think I just heard many system administrators collectively clutching their chests in pain. If inexperienced devs and users could suddenly drop their pants at will, imagine the mayhem that would occur if experienced devs with malicious intent were set loose in that environment? You can't pretend they don't exist - in fact, it's better to assume everyone who's not you is out to utterly destroy your data ASAP. Some would argue don't even trust yourself. Those firewalls, ids, utms and assumptions are pretty much the only thing protecting inexperienced users from themselves.

at-fates-hands 13y ago
>>I think I just heard many system administrators collectively clutching their chests in pain. I was trained to do this by reflex. Anytime you expose anything on your network, not matter what it is, without some layer of security between you and the internet, you're asking for trouble. Whether this is a warranted reaction or not, I don't know. I'm pretty sure its from spending too much time hanging out with hackers and sys admins. It's just locked in my brain not to doing something like this - ever.
derefr 13y ago
I think, if you have a system administrator, you're not the target audience for localtunnel. This is for home users who don't understand how to get their computer+router+apartment building's switch+etc to cooperate in getting them a public route. Maybe they should just make it bind to a port below 1024, so it requires root/Administrator privileges to run. Then, if you are your own sysadmin, you can let yourself in--and if someone else is, you'll have to take it up with them.
- deleted 13y ago
  [deleted]
- snowwrestler 13y ago
  I think that making it easy for unsophisticated users to expose their personal machines directly to the public Internet is not a good idea. The way to test a web project in development is to put it on a cheap web host or VPS. If you want to help newbie developers, make that one-click easy.

mhurron 13y ago

I don't even know what to think of this. Are you arguing that it is a good thing for people who have no idea what they're doing to have a 1 button click to remove all security?

relaxitup 13y ago
I think you missed the sarcasm and irony that was fairly evident in his comment. However, perhaps we can expect a user who can gem install something to have an acceptable level of awareness of the security implications of such a tool?
- mhurron 13y ago
  > However, perhaps we can expect a user who can gem install something to have an acceptable level of awareness of the security implications of such a tool? No, we can not. From both personal experience (developers can be dumb as bricks and know nothing outside their specific knowledge domain) and good security practices (you don't trust the user, even if they say they're good for it). And yes I hope it was just sarcasm I missed, but that's why I had to ask.
  - trotsky 13y ago
    it was indeed complete sarcasm.
PeterisP 13y ago
Can you elaborate on why you equate this localtunnel to "removing all security" ? I haven't tried it, but it seems to forward a single port that's running service X that I want to make available on the net. Any way whatsoever of fulfilling that need (no matter if it's one button click or setting up a separate VM for that service) would involve making a hole in all relevant firewalls and making the (possibly buggy) service X available to everyone. Is the user goal of "making service X available to everyone" bad in itself?
- marquis 13y ago