Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ngrok: Secure tunnels to localhost

ngrok.com

Post reply on HN
Print view View original

151–160 of 195 posts

Re: Ngrok: Secure tunnels to localhost

#151

Post by martijndwars »

tjoff wrote: post #128
untog wrote: post #116

Earlier quoted context omitted.

"learn how to ngrok" "figuring out what ngrok really is" ...really? You're trying very, very hard to dislike this tool and it's kind of funny. What is the objection to it, exactly? It makes a task easier. You don't have to use it, but others can. If you're proposing SSH tunnels as an alternative, where am I SSHing to? I need a publicly accessible remote box. So I'll need to set that up, then set up an SSH tunnel. Or,…

I don't dislike it, at all. People seem to like it and I have no reason to distrust that. And if you really don't have any box to SSH to and can't see any use of a VPS other than an SSH tunnel then fine - ngrok is probably great. But... If the only reason you do this is because you haven't got a clue about what dynamic DNS is, as many here seems to do, or you feel that setting up a SSH tunnel is complicated then I'm…

I have no clue about the security implications. What can go wrong if I use ngrok for my development environment that receives development webooks? Please enlighten me.

Re: Ngrok: Secure tunnels to localhost

#152

Post by yannis »

For a part-time programmer Mechanical Engineer, it is such a gratifying task to use ngrok. I first came across it a couple of years back. Great Project, great development, open sourced and well written in go. https://github.com/inconshreveable/ngrok/tree/master/src/ngr...

It takes two seconds to deploy an application in the evening from my kitchen table, check it also on my mobile and the next day access it from work also and show it to co-workers.

Call it "usability" for Engineers!

Re: Ngrok: Secure tunnels to localhost

#153

Post by itaysk »

jaequery wrote: post #145
YPCrumble wrote: post #143

A fantastic open-source javascript alternative is localtunnel ( https://github.com/localtunnel/localtunnel ). I've used this more often than ngrok after ngrok became a paid service.

yeah im in the same boat.

ngrok is open source as well: https://github.com/inconshreveable/ngrok I've used localtunnel before but due to some misbehavior on windows (which i can't remember anymore), switched to ngrok.

Re: Ngrok: Secure tunnels to localhost

#154

Post by enraged_camel »

fredoliveira wrote: post #82
tjoff wrote: post #74

Earlier quoted context omitted.

I'd imagine that for this purpose a proper dev environment would well be isolated your "office LAN". ngrok can not possibly be easier than port forwarding.

> ngrok can not possibly be easier than port forwarding. Oh come on, of course it can. I use port forwarding myself, but ngrok literally makes testing remote webhooks as simple as running "ngrok". That's it. It's definitely what I recommend coworkers who just want a quick solution to test out 3rd party service integrations.

>>but ngrok literally makes testing remote webhooks as simple as running "ngrok". That's it.

Not quite. If you are on the free tier, you also need to change your stripe/slack/whatever webhook URL to the new endpoint URL it gives you each time you run it.

Not a huge hassle, but it's worth mentioning.

Re: Ngrok: Secure tunnels to localhost

#155

Post by corford »

Lazare wrote: post #149
corford wrote: post #110

Earlier quoted context omitted.

It's more secure, easier to audit, removes a hard dependency on ngrok, gives you a static IP that never changes and you get more flexibility (plus you can share the same box amongst all your dev team if you wanted - you'd just assign different port combos to each team member). In terms of maintenance, apt-get update && apt-get upgrade in a daily cron job is largely all you'd ever need... Agree none of that may be wor…

> Agree none of that may be worth it in your case. It's not that I don't think that it's worth it, it's that I'm still not seeing the advantage. "More secure", if I assume that throwing a VPS up on Vultr, and adding apt-get update/upgrade to a cron job is more secure. "Easier to audit", if I assume that I go to the trouble to somehow make it auditable. "Removes a hard dependency on ngrok", if I assume that my planned…

Like I said, different trade offs for different circumstances/tastes.

Personally, I prefer a generic solution that doesn't rely on a specific third party for something as everyday as tunnelling internet requests back to my dev machine. I value that more than the replay and zero-maintenance benefits of ngrok.

Doesn't mean my approach is better than yours. Just means my approach suits me more :)

Edit: btw my earlier post should have read "easier to debug" rather than audit - sorry.

Re: Ngrok: Secure tunnels to localhost

#156

Post by enraged_camel »

noway421 wrote: post #83
packetized wrote: post #41

Literally the most terrifying service for any security-minded operations-focused person. Wonderful tool, interesting and useful in a dizzying array of aspects - but dear lord, I've had some real horrific moments when users told me that they installed it to allow access to their (private) repos for testing.

Surely ngrok doesn't access repo directory and only acts as port forwarding tool. Haven't used it to be sure though, but that's what i'm getting from it.

This is correct. You still need to have a service listening on the port you have mapped ngrok to. So simply using ngrok is not a security risk.

Re: Ngrok: Secure tunnels to localhost

#157

Post by enraged_camel »

YPCrumble wrote: post #143

A fantastic open-source javascript alternative is localtunnel ( https://github.com/localtunnel/localtunnel ). I've used this more often than ngrok after ngrok became a paid service.

Ngrok has a paid tier, but the main service is still free.

Re: Ngrok: Secure tunnels to localhost

#158

Post by shimo5037 »

hueving wrote: post #125
shimo5037 wrote: post #89

Earlier quoted context omitted.

I don't think you're the target audience. Think of a front end developer working on a mobile site. Now, in an ideal world everyone would know how to set up an SSH tunnel, but let's be real here, even you probably have to look up the exact flags you're supposed to use every time you want to set up one. Combine this with the need for a publicly accessible server somewhere, and it should become somewhat clear that many…

Is the justification really "ssh flags are hard to remember"?

I'm not sure how you've interpreted the post that way. The point of that one specific thing was nothing more than to bring attention to the fact that even users who do have the skills to do this all by themselves often can't recall how exactly to get it all going without googling or reading manpages a bit, and that people who are less familiar with these things would be even less likely to know how to set up an SSH tunnel properly, or perhaps even know about them.

For example, even though I use SSH tunnels quite often, and can in fact remember the flags, I sometimes don't remember if the local or remote port came first. A minor issue for me perhaps, but I'm sure you can imagine someone getting stuck at some point, and having to bother a team mate to check what's going on, which is an entirely avoidable waste of time. You also have minor ops overhead for making sure the tunnel servers stay up and running.

In the end, aren't nearly all tech businesses about improving the user experience in some way? For example, you could set up your own mail server (and deal with the issues that come with it) instead of using Mailgun/Sendgrid, or take a taxi (or drive) instead of using Uber/Lyft.

Re: Ngrok: Secure tunnels to localhost

#159

Post by bespoke_engnr »

I see some people arguing that "you should use a dev/staging environment with a public IP" instead of having ngrok tunneling traffic directly to your local dev box.

When you're editing HTML/CSS, you don't have to run a deploy script before checking how your markup renders. Ngrok gives people writing web services the same convenience when dealing with requests from a 3rd party on the Net.

It is the equivalent of saving your HTML/CSS source files and instantly seeing the changes when you reload your browser.

I just wrote a little proof-of-concept Alexa app that crawls HumbleBundle ('Bundled Goods', very much beta quality at the moment) and ngrok was invaluable for developing it quickly.

Re: Ngrok: Secure tunnels to localhost

#160

Post by berdario »

itaysk wrote: post #153
jaequery wrote: post #145

Earlier quoted context omitted.

yeah im in the same boat.

ngrok is open source as well: https://github.com/inconshreveable/ngrok I've used localtunnel before but due to some misbehavior on windows (which i can't remember anymore), switched to ngrok.

Unless you setup your own ngrok server, you cannot use ngrok1, and ngrok2 is not open source
Post reply on HN