Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ngrok: Secure tunnels to localhost

ngrok.com

Post reply on HN
Print view View original

61–70 of 195 posts

Re: Ngrok: Secure tunnels to localhost

#61

Post by Lazare »

A lot of people seem to be a bit confused about the point of ngrok, why it's useful, how much it costs, etc. Let me try and help out. :)

For me, the killer feature for ngrok is testing/developing webhooks. You install ngrok in your dev environment, start it up, then point the stripe/slack/whatever webhook your working on at the generated URL.

ngrok will 1) proxy that request through to your dev environment 2) log the request 3) log the response 4) let you replay previous requests. It could not be more helpful for developing webhook handlers, and has literally saved me hours of work in the last couple of months alone.

Finally, the free tier is all you need for that; it gives you a unique ngrok subdomain which changes every time you start the tunnel and some (generous) usage caps, both of which are fine for this usage.

People pointing out the potential security issues are correct, but that's an argument to be careful and think about what you're doing. Besides, what's your proposed alternative? Because most of the obvious ones have equally troubling issues.

Re: Ngrok: Secure tunnels to localhost

#62

Post by planetix »

Lazare wrote: post #61

A lot of people seem to be a bit confused about the point of ngrok, why it's useful, how much it costs, etc. Let me try and help out. :) For me, the killer feature for ngrok is testing/developing webhooks. You install ngrok in your dev environment, start it up, then point the stripe/slack/whatever webhook your working on at the generated URL. ngrok will 1) proxy that request through to your dev environment 2) log the…

> Besides, what's your proposed alternative?

Setup a proper development environment that mirrors the production environment?

Re: Ngrok: Secure tunnels to localhost

#63

Post by nachtigall »

inconshreveable wrote: post #2

Hiya there folks - I'm the creator of ngrok, happy to answer any questions

Thanks for creating ngrok. Sharing my experience and use case:

I tried ngrok (and localtunnel) two months ago to show a localhost WordPress site. Both failed because WordPress uses absolute links to reference css, js and img assets.

So the site was visible under whatever.ngrok.com but the assets where still linked to localhost. I read the FAQ at https://ngrok.com/faq#wordpress and tried all the mentioned plugins plus some other hacks. None did work. In the end I wasted almost one day.

I ended up renting a Simple PHP Hosting for 2 days to which I cloned the site. Which was also half a day but only cost me 2 € (site was online only for 2 days or so) and in the end, it did work.

Re: Ngrok: Secure tunnels to localhost

#65

Post by nevi-me »

planetix wrote: post #62
Lazare wrote: post #61

A lot of people seem to be a bit confused about the point of ngrok, why it's useful, how much it costs, etc. Let me try and help out. :) For me, the killer feature for ngrok is testing/developing webhooks. You install ngrok in your dev environment, start it up, then point the stripe/slack/whatever webhook your working on at the generated URL. ngrok will 1) proxy that request through to your dev environment 2) log the…

> Besides, what's your proposed alternative? Setup a proper development environment that mirrors the production environment?

If you don't have a static IP that's internet-accessible, and that which you can arbitrarily point your domain to, how would you go about doing this?

Some, if not most, services won't allow you to redirect cold to an IP address, they want some domain of sorts. There are alternatives, but I think "setup a proper dev environment" alone misses the point of what ngrok does.

The 'easiest' alternative I've tried before was to VPN into my Linux box to get a static internal IP, use a spare domain for the webhook then internally redirect the webhook traffic to my local machine. In the end I'm achieving what ngrok is doing (and none of it involves setting up a proper dev environment, cos I would already have one anyways), but I'd like to hear of better alternatives :)

Re: Ngrok: Secure tunnels to localhost

#66

Post by ageofwant »

packetized wrote: post #41

Literally the most terrifying service for any security-minded operations-focused person. Wonderful tool, interesting and useful in a dizzying array of aspects - but dear lord, I've had some real horrific moments when users told me that they installed it to allow access to their (private) repos for testing.

If your users have to resort to this they are not getting the appropriate support they need.

If your users are productive, chances are so is the company that pays both your salaries. If your users have to fight their infrastructure people to get their jobs done, you company will fail to effectively compete against those companies that don't.

It astounds me that so few security people understand what their purpose is: Your purpose is to assist the company you work for to keep on existing, and even make a profit. If you disempower those that are most effective in helping the company do what it does you're effectively destroying your own livelihood, and everyone else that is dependent on it.

Re: Ngrok: Secure tunnels to localhost

#67

Post by Cozumel »

bdcravens wrote: post #43
inconshreveable wrote: post #2

Hiya there folks - I'm the creator of ngrok, happy to answer any questions

Happy paying customer :-) Can you speak to security? I love using ngrok to test stuff in dev that requires SSL without having to setup up SSL. Of course that means it's running through your cert. Obviously one shouldn't run anything protected through your system, but what is your visibility into that traffic?

Why not just setup SSL in your development environment? It's seriously not that difficult at all, there's zero reason to use Ngrok (although I'm sure it does what it does very well), plus asking this question after you're already paying is kind of silly.

Re: Ngrok: Secure tunnels to localhost

#68

Post by jwr »

inconshreveable wrote: post #2

Hiya there folks - I'm the creator of ngrok, happy to answer any questions

Hey -- great utility! Feature request: a way to kill an existing tunnel. I often forget to take down a tunnel established from a home machine, and then while working on my laptop I find myself locked out. I'd love to be able to optionally kill an existing tunnel and replace it with a current one.

Re: Ngrok: Secure tunnels to localhost

#70

Post by Lazare »

planetix wrote: post #62
Lazare wrote: post #61

A lot of people seem to be a bit confused about the point of ngrok, why it's useful, how much it costs, etc. Let me try and help out. :) For me, the killer feature for ngrok is testing/developing webhooks. You install ngrok in your dev environment, start it up, then point the stripe/slack/whatever webhook your working on at the generated URL. ngrok will 1) proxy that request through to your dev environment 2) log the…

> Besides, what's your proposed alternative? Setup a proper development environment that mirrors the production environment?

Yes, I have that. How does that help me quickly iterate on getting proper handling for inbound webhooks from Stripe?

Stripe wants a URL to send the payloads too, and my proper development environment is (not surprisingly) running inside a vagrant on my dev machine inside our office LAN. I could open up a port on our firewall and forward it through to my laptop but:

1) ngrok is easier

2) ngrok provides additional features

3) This has every drawback ngrok has and more

4) None of this has anything to do with having a proper dev environment. :)

Can't reply so an edit: Yes, ngrok is actually easier than port forwarding. Plus it has logging and replay.

Post reply on HN