Live data from Hacker News

Ngrok: Secure tunnels to localhost

ngrok.com

141–150 of 195 posts

Re: Ngrok: Secure tunnels to localhost

#141

Hiya there folks - I'm the creator of ngrok, happy to answer any questions

”I want to expose a local server behind a NAT or firewall to the internet.”

This is genius. It immediately simply told me exactly what your and service does. A few common, short examples beneath that would also be great. I would see this being great to show off an app on the development branch to a client in a meeting.

Re: Ngrok: Secure tunnels to localhost

#142

Nice tool, but without committing for annual billing (which I don't intend to do, not for the first year of usage) it's $10 a month. My internet connection, my mobile plan, my Photoshop & Lightroom subscription, a huge collection of music (Spotify), 3K~5K movies and TV shows (Netflix), etc., all cost approximately the same. I mean, sure, $120 a year is pocket change for somebody using Ngrok professionally, but that's…

This comes off as really petty. It's good software that saves you a ton of time and effort. You spend $10 without thinking about it in tons of other places. If anything I think he should charge more

Re: Ngrok: Secure tunnels to localhost

#144
post #73

Earlier quoted context omitted.

Surely you've heard of dynamic DNS?

nip.io and xip.io even could be used, but that won't help if there's no static ip. of course you can portforward your ip via vpn or ssh tunnel. And that's would be the exact equivalent of ngrok, but with way more time and frustration to set it up.

oups, meant "routable" instead of "static"

Re: Ngrok: Secure tunnels to localhost

#146
post #9

Hiya there folks - I'm the creator of ngrok, happy to answer any questions

How does this compare to https://localtunnel.github.io/www/ ?

One is a big proprietary blob of mistrust and the other is localtunnel? Sorry if that sounds harsh but it's a shame I can't build and make sure that everything is above board.

Good on you though , that apart it seems a great idea well implemented. Easy to throw stuff up for prospects/clients in an agile way without having to talk to devops.

Why not free as in bird? It is already free as in beer.

Re: Ngrok: Secure tunnels to localhost

#147

Earlier quoted context omitted.

I don't think you're the target audience. Think of a front end developer working on a mobile site. Now, in an ideal world everyone would know how to set up an SSH tunnel, but let's be real here, even you probably have to look up the exact flags you're supposed to use every time you want to set up one. Combine this with the need for a publicly accessible server somewhere, and it should become somewhat clear that many…

Is the justification really "ssh flags are hard to remember"?

It's intellectually dishonest to cherry-pick that and then ignore the part about having to have a server with DNS, fixed IP, public SSL configured, etc.

Re: Ngrok: Secure tunnels to localhost

#149
post #103

Earlier quoted context omitted.

Yes, but, ngrok is cheaper, easier, faster, and provides some additional niceties that this setup doesn't. What's the advantage? (Plus, now I have a VPS to maintain...)

It's more secure, easier to audit, removes a hard dependency on ngrok, gives you a static IP that never changes and you get more flexibility (plus you can share the same box amongst all your dev team if you wanted - you'd just assign different port combos to each team member). In terms of maintenance, apt-get update && apt-get upgrade in a daily cron job is largely all you'd ever need... Agree none of that may be wor…

> Agree none of that may be worth it in your case.

It's not that I don't think that it's worth it, it's that I'm still not seeing the advantage.

"More secure", if I assume that throwing a VPS up on Vultr, and adding apt-get update/upgrade to a cron job is more secure. "Easier to audit", if I assume that I go to the trouble to somehow make it auditable. "Removes a hard dependency on ngrok", if I assume that my planned usage of ngrok was actually a hard dependency (it's not). "Gives me a static ip", if I assume I have the slightest use for such a thing when my planned use is "spend a couple hours hacking on a webhook handler". "Can share the same box among multiple devs", if I assume that would give me any benefits.

> The above is just an alternative approach with different trade-offs/benefits.

For my specific case, it seems more like an alternative approach which is almost as good, almost as easy, and almost as cheap.

The big question mark is really about security; but in principle you should be using both solutions as an ephemeral tunnel for sending sandbox data from a cloud service to a local dev environment. Even if I assume every single bit of data that I sent through ngrok was being read by an attacker (not a bad assumption!) I'm fine, because no production data, keys, credentials, etc., went through it.

You're quite right that ngrok is doing a very, very basic thing that you could duplicate, if you wanted to, very easily. But it's free (for the sort of use being discussed here), and easy, and the replay/logging is more useful than you might think.

Post reply on HN