Wait, I tried this, but there is now way to simply get a link to the image to use it in an IMG tag?
Show HN: Plus – Self-updating screenshots
111–120 of 126 posts
Re: Show HN: Plus – Self-updating screenshots
#112The idea is really cool, but implementation seems hard to get right. Apart from the security issues mentioned by others (related to storing user auth/session data), what happens if there's an update to the website/application where the screenshot is being taken from? Or if they add an announcement banner at the top, all content will be displaced.
I was thinking through similar scenarios. I think there will be tons of fringe cases that this won’t work well with, but for the core use cases (Google Analytics, Amplitude, etc.) it will work more predictably. An analytics tool should have minimal announcements, pop-ups, A/B tests, etc. This isn’t the right tool for perpetually updating screenshots of a specific region of CNN’s homepage.
Re: Show HN: Plus – Self-updating screenshots
#113Wait, I tried this, but there is now way to simply get a link to the image to use it in an IMG tag?
It also says that I am "logged out" for a screenshot on a landing page where there is no login needed: https://i.snipboard.io/5INswy.jpg
Re: Show HN: Plus – Self-updating screenshots
#114This product looks great, but I can’t get over how fresh the design of the landing page is. Great work
Re: Show HN: Plus – Self-updating screenshots
#115This seems like a spectacular way to break permissions restrictions and escape data to non-authorized entities. If it's successful, it's the sort of thing that will be brutally blocked by IT all over the place. Very slick, though.
(I'm an EM at Plus) Yeah, we think about the permissions/data escape a lot. I'm glad to see others are commenting with scrutiny too. We've put a lot of effort into our security model, since we know that we're handling very sensitive data. To give a bit of a peek in: All of the session data we store is encrypted with a key unique to each organization, managed through AWS KMS. We've also built a fully event driven arch…
The cases I'm thinking about would more be internal data protections.
I'll give an example:
We have wikis that are internally and externally accessible, with permission systems for internal users and external partner users that carry different restrictions (e.g., VPN concentrator address range restrictions). If someone tries to access a page in the wiki that they don't have access to, the result is the same as if the page doesn't exist. This reduces leakage from link-guessing (I bet there's still a timing side-channel attack). Additionally, if someone builds a page that uses excerpts from pages that they don't have access to, the excerpt will appear blank. This has led to plenty of funny meetings where one party was talking about a status or readout and the rest of the room was deeply confused (due to a lack of access).
This particular wiki is one of dozens of internal tools with similar (but not identical) compartmentalization protections that I use weekly. Unless Plus can safely and securely account for such restrictions, it's going to be a tough sale for us, and limited coverage areas from partial integration would likely leave the tool with usage start-up issues. To some extent this is a classic uncrackable nut, as the most natural approach (integrate with services and systems) isn't entirely under the control of one party. The next left turn is to integrate with popular software/service providers, something they'll resist due to the natural incentive to avoid disintermediation and the high risk of incorporation of other access models.
Maybe in 10 years Plus will have been the source of a comprehensive delclarative permissions modeling system replete with formally verified macro system composition (boil the ocean style), or maybe I'm missing a clever simplifier to address these and other headwinds stemming from business model and tech architecture intersections. Either way, the explainability of the feature and the end-customer simplicity leave me hoping that things work out. It'll definitely be an interesting ride.
Re: Show HN: Plus – Self-updating screenshots
#116Any plans to actually scrape the data instead of just the images? Having the actual data saved in a tabular format would really make this a killer product... You could probably do this by finding the elements within your selection and parsing the rendered HTML. Images are great but for doing anything more complex than just viewing charts scraping the data would be a huge plus
What’s your usecase? Can you define “more complex”?
Say I want to plug historical data into a predictive model?
Or a probably another common potential use-case... I want to create an alert if a value is above/below a certain threshold.
Re: Show HN: Plus – Self-updating screenshots
#117Earlier quoted context omitted.
(I'm an EM at Plus) Yeah, we think about the permissions/data escape a lot. I'm glad to see others are commenting with scrutiny too. We've put a lot of effort into our security model, since we know that we're handling very sensitive data. To give a bit of a peek in: All of the session data we store is encrypted with a key unique to each organization, managed through AWS KMS. We've also built a fully event driven arch…
The cases I'm thinking about would more be internal data protections. I'll give an example: We have wikis that are internally and externally accessible, with permission systems for internal users and external partner users that carry different restrictions (e.g., VPN concentrator address range restrictions). If someone tries to access a page in the wiki that they don't have access to, the result is the same as if the…
Highly tangential to Plus, but this issue is highly prevalent in IT. Usually, no one knows what systems there are and who has access to what. So Plus (or whoever) cannot really solve this problem without providing separate access management tooling
Re: Show HN: Plus – Self-updating screenshots
#118I worked for a personalization vendor a few years ago and was on an engineering team that built a feature like this. It was ... a major headache, and I don't think anyone was ever completely comfortable with the security implications. So I wish the team good luck, and especially with issues like: * A/B testing. How can you ensure that what your clients are seeing is the same thing you are seeing? Maybe you've been as…
> What if your clients are using Chrome extensions that affect how the page is rendered? How can you replicate that?
You should not rely on anything on the client side, just accept the fact you don't control the code that is run there.
If you care about a few cases like adblockers, just test them in a headless browser.
Re: Show HN: Plus – Self-updating screenshots
#119I was hoping this would autoupdate user documentation based on the latest version of my app.
Re: Show HN: Plus – Self-updating screenshots
#120I worked for a personalization vendor a few years ago and was on an engineering team that built a feature like this. It was ... a major headache, and I don't think anyone was ever completely comfortable with the security implications. So I wish the team good luck, and especially with issues like: * A/B testing. How can you ensure that what your clients are seeing is the same thing you are seeing? Maybe you've been as…
We appreciate the good luck! We're definitely going to need it. I spoke to the security side in a previous comment, but here's some thoughts on the other points you mentioned: * A/B testing: We're grabbing the browser session data, which includes things like cookies and local storage. In our experience, this tends to be where A/B testing group identifiers are stored. But, if it was on something like the IP, then, yea…
> We’re grabbing the browser session data
Correct me if I’m wrong but this is disallowed by many end sites eg Google and circumvents oauth/any real security. If your very new business was hacked in any way you’d be solely on the hook for the massive damage a bad party could do with such an elevated session with no real boundaries.
Cool idea, but I fail to see how this is 1) legal under many ToS’s and 2) not just a dangerous XSS attack waiting to happen.