I prefer the implementation of http://localhost.run
To me it seems a lot cleaner, simply use SSH rather than download any app
Ngrok: Secure tunnels to localhost
71–80 of 195 posts
Re: Ngrok: Secure tunnels to localhost
#72Literally the most terrifying service for any security-minded operations-focused person. Wonderful tool, interesting and useful in a dizzying array of aspects - but dear lord, I've had some real horrific moments when users told me that they installed it to allow access to their (private) repos for testing.
If your users have to resort to this they are not getting the appropriate support they need. If your users are productive, chances are so is the company that pays both your salaries. If your users have to fight their infrastructure people to get their jobs done, you company will fail to effectively compete against those companies that don't. It astounds me that so few security people understand what their purpose is:…
Uh, no. The purpose of a security team is to prevent data from being exfiltrated from the company's control. Passwords, PII, HIPPA/other-compliance-controlled stuff, source code, etc. are all at risk of being stolen at all times, which means that security is a game of constant vigilance. And since everybody has at least a bit of this data under their control, this means that everybody is involved with security. (At least two of my past employers have had the motto, "Everybody is on the security team.")
Productivity means nothing in the face of data exfiltration. You only have to fail once at guarding a password in order to be completely compromised. If we seem tightly wound, it's because we have fully internalized and grok the stakes of our efforts and the entailment of failure.
"Our infrastructure sucked, so I used an insecure tool to leak our credentials to third parties, because I couldn't be productive otherwise!" is not really a valid excuse in this light, since there's no amount of productivity which offsets data exfiltration.
Re: Ngrok: Secure tunnels to localhost
#73Earlier quoted context omitted.
> Besides, what's your proposed alternative? Setup a proper development environment that mirrors the production environment?
If you don't have a static IP that's internet-accessible, and that which you can arbitrarily point your domain to, how would you go about doing this? Some, if not most, services won't allow you to redirect cold to an IP address, they want some domain of sorts. There are alternatives, but I think "setup a proper dev environment" alone misses the point of what ngrok does. The 'easiest' alternative I've tried before was…
Surely you've heard of dynamic DNS?
Re: Ngrok: Secure tunnels to localhost
#74Earlier quoted context omitted.
> Besides, what's your proposed alternative? Setup a proper development environment that mirrors the production environment?
Yes, I have that. How does that help me quickly iterate on getting proper handling for inbound webhooks from Stripe? Stripe wants a URL to send the payloads too, and my proper development environment is (not surprisingly) running inside a vagrant on my dev machine inside our office LAN. I could open up a port on our firewall and forward it through to my laptop but: 1) ngrok is easier 2) ngrok provides additional feat…
I'd imagine that for this purpose a proper dev environment would well be isolated your "office LAN".
ngrok can not possibly be easier than port forwarding.
Re: Ngrok: Secure tunnels to localhost
#75I prefer the implementation of http://localhost.run To me it seems a lot cleaner, simply use SSH rather than download any app
Is this free? I can't find any pricing info
Re: Ngrok: Secure tunnels to localhost
#76Earlier quoted context omitted.
Yes, I have that. How does that help me quickly iterate on getting proper handling for inbound webhooks from Stripe? Stripe wants a URL to send the payloads too, and my proper development environment is (not surprisingly) running inside a vagrant on my dev machine inside our office LAN. I could open up a port on our firewall and forward it through to my laptop but: 1) ngrok is easier 2) ngrok provides additional feat…
I'd imagine that for this purpose a proper dev environment would well be isolated your "office LAN". ngrok can not possibly be easier than port forwarding.
Except it is. By far. And it works everywhere. I could do webhook development on a plane.
Re: Ngrok: Secure tunnels to localhost
#77Earlier quoted context omitted.
please file a false positive bug report against windows defender. there's not much I can do about that if they're misclassifying ngrok
With due respect, shouldn't you be the one filing the report? I mean, that's a potential loss of quite a few clients there...
Been there in the past. You need users to report this. As an app developer you have very little leeway.
Re: Ngrok: Secure tunnels to localhost
#78Earlier quoted context omitted.
Yes, I have that. How does that help me quickly iterate on getting proper handling for inbound webhooks from Stripe? Stripe wants a URL to send the payloads too, and my proper development environment is (not surprisingly) running inside a vagrant on my dev machine inside our office LAN. I could open up a port on our firewall and forward it through to my laptop but: 1) ngrok is easier 2) ngrok provides additional feat…
I'd imagine that for this purpose a proper dev environment would well be isolated your "office LAN". ngrok can not possibly be easier than port forwarding.
ngrok is way easier.
Run `ngrok http 3000` or whatever port your app is running on and you're done. Now you have both an HTTP and HTTPS endpoint that you can publicly access.
Some webhook providing services also require HTTPS. ngrok gives you that right off the bat. Setting up self signed certs and running nginx, or faking a FQDN and using xip so that you can register a real certificate seems like overkill if all you want to do is test a webhook.
ngrok is also perfect for live demo'ing apps to clients.
Re: Ngrok: Secure tunnels to localhost
#79Earlier quoted context omitted.
If you don't have a static IP that's internet-accessible, and that which you can arbitrarily point your domain to, how would you go about doing this? Some, if not most, services won't allow you to redirect cold to an IP address, they want some domain of sorts. There are alternatives, but I think "setup a proper dev environment" alone misses the point of what ngrok does. The 'easiest' alternative I've tried before was…
Surely you've heard of dynamic DNS?
nip.io and xip.io even could be used, but that won't help if there's no static ip.
of course you can portforward your ip via vpn or ssh tunnel. And that's would be the exact equivalent of ngrok, but with way more time and frustration to set it up.
Re: Ngrok: Secure tunnels to localhost
#80Earlier quoted context omitted.
If you don't have a static IP that's internet-accessible, and that which you can arbitrarily point your domain to, how would you go about doing this? Some, if not most, services won't allow you to redirect cold to an IP address, they want some domain of sorts. There are alternatives, but I think "setup a proper dev environment" alone misses the point of what ngrok does. The 'easiest' alternative I've tried before was…
Surely you've heard of dynamic DNS?
Ngrok also works without port forwarding through a router