Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Local development with .local domains and HTTPS

localcan.com

Post reply on HN
Print view View original

91–100 of 108 posts

Re: Show HN: Local development with .local domains and HTTPS

#91

Post by WorldMaker »

EspressoGPT wrote: post #61
afavour wrote: post #40

Earlier quoted context omitted.

And sometimes I hate the HN comment section. Obviously you’re not paying $19 for hosts file editing. Obviously! SSL cert generation is a pain in the ass, a tool that automates all of that for you is a valid tool. And I find the mDNS stuff really interesting, I do a lot of testing on mobile devices and connecting to my dev server from a phone can be really annoying. If you don’t like the price that’s fine: don’t pay i…

Start your app, put Caddy issuing TLS certs in front of it, put your PC's IP behind some name on your router (maybe using something like Zeroconf), and spend the $19 buying some flowers for your partner.

mDNS is proper standards name for what used to be called Zeroconf. This app is doing the same thing you'd do by hand, it's just saving you time by automating it. If it only takes you an hour to setup by hand, is your time less valuable than $19/hour?

Re: Show HN: Local development with .local domains and HTTPS

#92

Post by WorldMaker »

lostmsu wrote: post #77
plorntus wrote: post #8

Earlier quoted context omitted.

Certain browser features/apis are only available when in a secure context https://www.digicert.com/blog/https-only-features-in-browser... so I imagine this might be a reason you would want it. That being said I don't know why you would pay for an application that does this but I guess I'm not the target market.

This long article helpfully forgets to mention, that localhost/loopback addresses are considered secure without https. https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

Some features have still moved to TLS-only even for localhost. "Considered secure" is somewhat orthogonal to "requires TLS". You can only use HTTP/2 with TLS, for instance, whether or not you are in a "secure context".

Re: Show HN: Local development with .local domains and HTTPS

#93

Post by WorldMaker »

drekipus wrote: post #4

Is this something like how ".local" is already a mDNS standard but OSX and android won't support it yet? (Unless they buy your app) I can already access "myserverhost.local" from everything but android and OSX. Windows and Linux work fine automatically.

The FAQ admits that it is just configuring mDNS advertisements.

Re: Show HN: Local development with .local domains and HTTPS

#94

Post by lxgr »

8organicbits wrote: post #90
lxgr wrote: post #60

Earlier quoted context omitted.

This is neat! However, given that allowing private IP resolution from a public DNS subdomain facilitates DNS rebinding attacks, it (and all equivalent approaches) will unfortunately be blocked by quite a few of the more sophisticated home routers out there, including a quite common brand in Germany. Also, doesn't publishing a privkey for a public TLS certificate theoretically require it to be revoked under common bro…

The certificate is revoked, your browser must not be checking for revocation. Browser support for revocation is pretty poor, unfortunately. https://crt.sh/?id=9497801989&opt=ocsp

Hm, are these automatically revoked then as part of the service, or did somebody just revoke it?

Update: Seems to have just happened – after restarting, Firefox now does not accept it anymore!

Re: Show HN: Local development with .local domains and HTTPS

#95

Post by rcarmo »

harrygeez wrote: post #83
rcarmo wrote: post #23

Earlier quoted context omitted.

The mDNS broadcast thing is pretty easy, I've used pybonjour for that for a while. The SSL part, well, it's a bigger hassle.

Bigger yes but valuable knowledge for anyone. The good thing is once you understand it only takes little effort to repeat it.

I automated that away a long time ago: https://github.com/piku/piku/blob/master/piku.py#L814

Re: Show HN: Local development with .local domains and HTTPS

#96

Post by capableweb »

mcny wrote: post #9
capableweb wrote: post #6

Looks like an interesting project. What I guess is not really clear is why you'd want to do TLS for local only connections? Are the services published with the .local domain accessible from outside as well so it's like a ngrok alternative? I'm pretty sure I'm misunderstanding the value-add of having TLS for localhost connections...

> I'm pretty sure I'm misunderstanding the value-add of having TLS for localhost connections... It often feels like the noose is tightening tbh. There are things that contemporary "evergreen" web browsers just flat out refuse to do without https. I think this is where they document this... https://www.chromium.org/Home/chromium-security/prefer-secur... which I got from this stack overflow answer https://stackoverflow…

Yes, which makes sense I guess, but localhost et al are already considered "secure origins" by that, so the features should be available regardless if you're doing TLS or not, if you're loading the document/page/application from localhost.

Re: Show HN: Local development with .local domains and HTTPS

#98

Post by ehPReth »

lapcat wrote: post #46

This submission violates the HN guidelines: "Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity." https://news.ycombinator.com/newsguidelines.html The https://news.ycombinator.com/user?id=jarekceborski account was created 1 day ago, the only submission is this one https://news.ycombinator.com/user?id=jarekceborski and t…

Also from those exact same guidelines: “Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.”

Re: Show HN: Local development with .local domains and HTTPS

#100

Post by lapcat »

ehPReth wrote: post #98
lapcat wrote: post #46

This submission violates the HN guidelines: "Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity." https://news.ycombinator.com/newsguidelines.html The https://news.ycombinator.com/user?id=jarekceborski account was created 1 day ago, the only submission is this one https://news.ycombinator.com/user?id=jarekceborski and t…

Also from those exact same guidelines: “Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.”

> Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken.

It's not an insinuation. The submission author literally said: "I'm Jarek, and I've built this tool". It's an undeniable fact that the submitter is self-promoting. There's no mistake.

The submitter's profile also shows irrefutably that the HN account has never been used for anything except self-promotion.

Another problem is that it's not clear the submission is even on topic for Show HN. Is there anything that HN users can try? It just seems to be a "Buy" page. https://news.ycombinator.com/showhn.html

Post reply on HN