Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Lynk – Securely expose local TCP and HTTP services to the web

lynk.sh

Post reply on HN
Print view View original

31–40 of 53 posts

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#31

Post by kelnos »

loopholelabs wrote: post #4
vlovich123 wrote: post #3

Earlier quoted context omitted.

I'm curious about the note that you apply compression. Are you proposing your customers rely on your encryption rather than doing their own E2E encryption? If not how significant are the compression savings if you're just compressing encrypted data.

Yes, we are doing E2E encryption and compression between the Lynk Infrastructure and Lynk Clients. As with Ngrok, for a quick hosted tunnel our encryption will be more than suitable, and we are working to release a self-hosted version soon that will allow you to bring your own certificates (for both ingress traffic and the traffic between the Lynk Client and the Lynk Infrastructure).

Given that many people likely would use this for HTTP traffic, and HTTP already supports compression natively, what's the value-add here?

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#32

Post by loopholelabs »

kelnos wrote: post #31
loopholelabs wrote: post #4

Earlier quoted context omitted.

Yes, we are doing E2E encryption and compression between the Lynk Infrastructure and Lynk Clients. As with Ngrok, for a quick hosted tunnel our encryption will be more than suitable, and we are working to release a self-hosted version soon that will allow you to bring your own certificates (for both ingress traffic and the traffic between the Lynk Client and the Lynk Infrastructure).

Given that many people likely would use this for HTTP traffic, and HTTP already supports compression natively, what's the value-add here?

HTTP will compress traffic from the lynk endpoint but we also compress the traffic from the client to that endpoint which helps save bandwidth and keeps things snappy even in slow network conditions

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#33

Post by loopholelabs »

carlosdp wrote: post #25

If I can just offer one bit of feedback, if you just type any email and password in the "Sign in / Register" page, it just creates an account for you if it doesn't exist. There's a ton of reasons you don't want that, and should probably have a separate "sign up" flow for email/password login. Here's a few: 1. It's not at all clear you can actually do that. One guy in the comments below thinks you can only sign up usi…

That makes a lot of sense, thanks for pointing this out! I assumed that asking people to verify their emails would be enough but it never hurts to make things clear.

I'll make those changes as soon as possible.

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#34

Post by deathanatos »

loopholelabs wrote: post #17
billyhoffman wrote: post #15

I want to be supportive, and I believe this solves a real issue, but this giving me serious pause: > We take security very seriously, especially when it comes to our users. This is why we offer end-to-end SHA-256 encryption You take security seriously, but are confusing pretty basic and fundamental concepts of encrypting vs hashing. Given that the point of this service to expose local services to the internet, and on…

This was a mistake on our website, which as since been removed. 1. We'll be open sourcing our client in the coming weeks so you can check out our code yourselves. 2. We will be offering a self-hosted version which will decouple you entirely from our infrastructure and you can provide you own SSL certificates. 3. Lynk can forward traffic to your encrypted services - which of course would mean losing out on compression…

You allow the user's machine to obtain a valid certificate for a subdomain of lynk.sh? (This would seem to me the only way to accomplish E2EE, given the example of connecting over TLS to a lynk.sh host, and it also seems very unlikely.)

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#35

Post by ficklepickle »

I wanted to like this, but I couldn't get passed the awful landing page.

It brought my phone to crawl. Moving wireframes in the background would have been distracting at the best of times, let alone on an older phone.

It gives me the impression they value style over function, which is a huge turn off for me.

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#36

Post by thanksforfish »

loopholelabs wrote: post #16
billyhoffman wrote: post #10

Earlier quoted context omitted.

You didn't really answer the question about the value of the compression. There are 2 options: 1- If people are using their own E2E encryption below your tunnel, then your compression provides essentially zero value, since properly encrypted traffic should not have repeating patterns to compress. 2- If you are telling people to not use their own E2E encryption, and instead rely on the Lynk tunnel's E2E encryption (wi…

I should have been more clear. The client compresses responses from your local services before they're encrypted and sent to the Lynk infrastructure. This application is designed primarily for development work and takes the hassle out of setting up a reverse proxy or dealing with port-forwarding. If your local application provides its own encryption (ie, it's running over HTTPS), then your traffic won't be exposed to…

Theres an important security tradeoff here. Compress then encrypt leaves you vulnerable to attacks like CRIME[1]. How much this matters depends on the application.

[1] https://security.stackexchange.com/questions/19911/crime-how...

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#37

Post by cbluth »

loopholelabs wrote: post #17
billyhoffman wrote: post #15

I want to be supportive, and I believe this solves a real issue, but this giving me serious pause: > We take security very seriously, especially when it comes to our users. This is why we offer end-to-end SHA-256 encryption You take security seriously, but are confusing pretty basic and fundamental concepts of encrypting vs hashing. Given that the point of this service to expose local services to the internet, and on…

This was a mistake on our website, which as since been removed. 1. We'll be open sourcing our client in the coming weeks so you can check out our code yourselves. 2. We will be offering a self-hosted version which will decouple you entirely from our infrastructure and you can provide you own SSL certificates. 3. Lynk can forward traffic to your encrypted services - which of course would mean losing out on compression…

the certificate at https://loopholelabs.io/ has been invalid for almost a month

Re: Show HN: Lynk – Securely expose local TCP and HTTP services to the web

#40

Post by mcpeepants »

deathanatos wrote: post #34
loopholelabs wrote: post #17

Earlier quoted context omitted.

This was a mistake on our website, which as since been removed. 1. We'll be open sourcing our client in the coming weeks so you can check out our code yourselves. 2. We will be offering a self-hosted version which will decouple you entirely from our infrastructure and you can provide you own SSL certificates. 3. Lynk can forward traffic to your encrypted services - which of course would mean losing out on compression…

You allow the user's machine to obtain a valid certificate for a subdomain of lynk.sh? (This would seem to me the only way to accomplish E2EE, given the example of connecting over TLS to a lynk.sh host, and it also seems very unlikely.)

why does that seem unlikely?
Post reply on HN