I prefer the implementation of http://localhost.run To me it seems a lot cleaner, simply use SSH rather than download any app
nice but it seems like it doesn't do anything but http
Ngrok: Secure tunnels to localhost
101–110 of 195 posts
Re: Ngrok: Secure tunnels to localhost
#102Earlier quoted context omitted.
i tend to fire up reverse port forwarding with ssh + special subdomain + ask nginx to proxy to the reverse-forwarded port on that special subdomain to resolve this, obviously you'd still need a static and public ip somewhere, but any ssh-accessible host will now do. it's a bit of setup, but works quite well once set. does _not_ provide the features ngrok does of replay, etc, but at least it's 100% your own infrastruc…
I do exactly this. I also have it set up with let's encrypt so that the Webhooks are encrypted. Locally, I also mirror the LE keys and add a hosts file entry for the test domain to localhost. This means I can test locally with proper ssl certs.
+1 original reason i did it was so i can have the LE cert to test a slack bot i was developing (they require webhooks have SSL to do that)
Re: Ngrok: Secure tunnels to localhost
#103Earlier quoted context omitted.
Yes, I have that. How does that help me quickly iterate on getting proper handling for inbound webhooks from Stripe? Stripe wants a URL to send the payloads too, and my proper development environment is (not surprisingly) running inside a vagrant on my dev machine inside our office LAN. I could open up a port on our firewall and forward it through to my laptop but: 1) ngrok is easier 2) ngrok provides additional feat…
Or just maintain a $2.50 Vultr instance and on your dev box create a bash alias for a command that sets up a reverse ssh tunnel to it. Then all you need to do is a one time setup of nginx on your Vultr (or DO or whatever) box to accept incoming webhook requests from e.g. stripe and proxy them down the ssh tunnel to your dev machine. With the above in place, you'd literally hit one button on your keyboard to establish…
Yes, but, ngrok is cheaper, easier, faster, and provides some additional niceties that this setup doesn't. What's the advantage? (Plus, now I have a VPS to maintain...)
Re: Ngrok: Secure tunnels to localhost
#104Earlier quoted context omitted.
If your users have to resort to this they are not getting the appropriate support they need. If your users are productive, chances are so is the company that pays both your salaries. If your users have to fight their infrastructure people to get their jobs done, you company will fail to effectively compete against those companies that don't. It astounds me that so few security people understand what their purpose is:…
Uh, no. The purpose of a security team is to prevent data from being exfiltrated from the company's control. Passwords, PII, HIPPA/other-compliance-controlled stuff, source code, etc. are all at risk of being stolen at all times, which means that security is a game of constant vigilance. And since everybody has at least a bit of this data under their control, this means that everybody is involved with security. (At l…
That mindset, while successful from the security perspective, can result in the slow death by strangulation. Ensuring the success of a company should always be your #1 priority, security is an important piece in ensuring the success of a company, but it isn't the only piece.
If you're dismissing it as a security nightmare without considering why someone would want to use it and trying to figure out how to make it work or come up with alternatives, then you're failing your mission IMO. There's ways of securing ngrok... you can self host, put it behind a firewall, and whitelist services. It may still open a potential attack vector, but so does the mere existence of connecting to the internet. It's a balancing act, we should all be familiar with.
Re: Ngrok: Secure tunnels to localhost
#105A lot of people seem to be a bit confused about the point of ngrok, why it's useful, how much it costs, etc. Let me try and help out. :) For me, the killer feature for ngrok is testing/developing webhooks. You install ngrok in your dev environment, start it up, then point the stripe/slack/whatever webhook your working on at the generated URL. ngrok will 1) proxy that request through to your dev environment 2) log the…
> Besides, what's your proposed alternative? Setup a proper development environment that mirrors the production environment?
Your dev environment is never going to be identical to your production environment, because you don't write code directly in production. Test and acc should be identical to prod, but for dev that's pointless.
Re: Ngrok: Secure tunnels to localhost
#106Yet another needless cost of not switching to IPv6 already ...
Re: Ngrok: Secure tunnels to localhost
#107Literally the most terrifying service for any security-minded operations-focused person. Wonderful tool, interesting and useful in a dizzying array of aspects - but dear lord, I've had some real horrific moments when users told me that they installed it to allow access to their (private) repos for testing.
If your users have to resort to this they are not getting the appropriate support they need. If your users are productive, chances are so is the company that pays both your salaries. If your users have to fight their infrastructure people to get their jobs done, you company will fail to effectively compete against those companies that don't. It astounds me that so few security people understand what their purpose is:…
> If your users have to resort to this they are not getting the appropriate support they need.
I don't see where this follows from. "private repos" and "testing" implies "local testing" for me. If that implication does not hold, the development workflow is seriously screwed. (Don't tell me there is no money for a local test setup when you have dedicated IT security.)
And in my experience, more often than not, it is screwed because someone decided to use some other flashy tool without realizing the security implications.
If you really, really need to poke holes into your firewall can easily that with ssh to a cheap vm hosted at your trustworthy hoster. If ssh ain't enough, nc and socat are your friends.
Re: Ngrok: Secure tunnels to localhost
#108Makes me sad to see all the negativeness towards this service, which clearly works and serves a need some people have.
Yes, there are alternatives, but I hate when people jump to dismiss service like this, without fully considering what issues the proposed alternatives have. Obviously it is ok to mention the alternative options, but that can be made in constructive way.
Let's celebrate the fact that somebody has built and released something and even seems to have a business model to support it. Instead of complaining about 5-20 bucks per month, try to figure out how you could channel some of your corporate multimillion IT budget to this fellow hacker. Wouldn't it be great if building and running this kind of small solutions would be actually a viable way of making living?
Re: Ngrok: Secure tunnels to localhost
#109Earlier quoted context omitted.
Surely you've noticed this: > don't have a static IP that's internet-accessible I am one of those people :) I don't pay my ISP extra for a "real" IP address, so I have literally no way to receive incoming connections from the internet into my home network, it's all behind their NAT.
You don't need a static IP.
You do need a public IP.
Re: Ngrok: Secure tunnels to localhost
#110Earlier quoted context omitted.
Or just maintain a $2.50 Vultr instance and on your dev box create a bash alias for a command that sets up a reverse ssh tunnel to it. Then all you need to do is a one time setup of nginx on your Vultr (or DO or whatever) box to accept incoming webhook requests from e.g. stripe and proxy them down the ssh tunnel to your dev machine. With the above in place, you'd literally hit one button on your keyboard to establish…
Yes, but, ngrok is cheaper, easier, faster, and provides some additional niceties that this setup doesn't. What's the advantage? (Plus, now I have a VPS to maintain...)
It's more secure, easier to audit, removes a hard dependency on ngrok, gives you a static IP that never changes and you get more flexibility (plus you can share the same box amongst all your dev team if you wanted - you'd just assign different port combos to each team member). In terms of maintenance, apt-get update && apt-get upgrade in a daily cron job is largely all you'd ever need...
Agree none of that may be worth it in your case. Personally, I don't think there's anything wrong with ngrok in certain circumstances. The above is just an alternative approach with different trade-offs/benefits.