Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ngrok: Secure tunnels to localhost

ngrok.com

Post reply on HN
Print view View original

161–170 of 195 posts

Re: Ngrok: Secure tunnels to localhost

#161

Post by scotteh »

conqrr wrote: post #137
scotteh wrote: post #133

Earlier quoted context omitted.

It's absolutely possible. Admittedly I'm still running 2.1.18, but I just tested it there and it still works. https://ngrok.com/docs#subdomain edit: Just in case, I updated to 2.2.4 (newest) and it's still possible to use custom subdomains.

This doesn't work. I just checked. Tunnel session failed: Only paid plans may bind custom subdomains. Failed to bind the custom subdomain 'blahblahblah' for the account xxx

Strange. Did you have the account back when it was still possible? They may have grandfathered the older accounts in.

Re: Ngrok: Secure tunnels to localhost

#162

Post by pfista »

Ngrok is the coolest tool I use on a pretty consistent basis. Developing webhooks locally is usually what I use it for, and the web interface replay capability is amazing. The creator gave a great talk on why he built it and how it progressed over the years: https://www.youtube.com/watch?v=F_xNOVY96Ng

Re: Ngrok: Secure tunnels to localhost

#163

Post by philsnow »

enraged_camel wrote: post #156
noway421 wrote: post #83

Earlier quoted context omitted.

Surely ngrok doesn't access repo directory and only acts as port forwarding tool. Haven't used it to be sure though, but that's what i'm getting from it.

This is correct. You still need to have a service listening on the port you have mapped ngrok to. So simply using ngrok is not a security risk.

well, if you've exposed your dev app running on your laptop to the internet, any exploit in your app now works against your laptop endpoint instead of a production endpoint.

your laptop is a very different environment from production: there are probably different protections, firewalls, monitoring, etc in place. additionally, while your laptop (hopefully) doesn't have direct access to production databases, you probably have stuff lying around that you wouldn't want an attacker to get their hands on: sensitive work documents, your Chrome cookies just sitting in a sqlite database somewhere, source code for all the repositories you have checked out locally (not just the one app that has the exploit).

I don't agree that "using ngrok is not a security risk".

Re: Ngrok: Secure tunnels to localhost

#164

Post by bdcravens »

Cozumel wrote: post #67
bdcravens wrote: post #43

Earlier quoted context omitted.

Happy paying customer :-) Can you speak to security? I love using ngrok to test stuff in dev that requires SSL without having to setup up SSL. Of course that means it's running through your cert. Obviously one shouldn't run anything protected through your system, but what is your visibility into that traffic?

Why not just setup SSL in your development environment? It's seriously not that difficult at all, there's zero reason to use Ngrok (although I'm sure it does what it does very well), plus asking this question after you're already paying is kind of silly.

> asking this question after you're already paying is kind of silly

That assumes this is my only use case for using ngrok :-)

Re: Ngrok: Secure tunnels to localhost

#165

Post by philsnow »

icedchai wrote: post #140
dsr_ wrote: post #94

Earlier quoted context omitted.

You're both right. If the dev team needs something like ngrok, the security team has failed to provide proper tools. If the dev team goes ahead and uses ngrok without consulting the security team, the dev team has likely committed an awful security breach. The dev team and the security team need to think of each other as being on the same team, and talk to each every day about what they want and need.

Pretty sure a lot of people using this don't even have a "security team." They likely have corporate IT that takes 2 weeks to add a DNS entry. Something complex like mapping a public IP to a dev server would take an act of $DEITY.

so register a new domain and set it up in route53? is there some corporate law that says you can't?

just don't use your company's name in the domain name, make it something obscure.

Re: Ngrok: Secure tunnels to localhost

#166

Post by an_account »

brianshaler wrote: post #33
an_account wrote: post #27

Earlier quoted context omitted.

Did the free option go away? (On my phone now so I can't try it out.)

Below the paid options: Free Plan For quick demos and other simple tunneling needs. * HTTP/TCP tunnels on random URLs/ports * 1 online ngrok process * 4 tunnels per ngrok process * 40 connections / minute

Ah, thanks! I didn't scroll down on my phone all the way since the plans were just getting more expensive. It's obvious now that I'm on a desktop.

Re: Ngrok: Secure tunnels to localhost

#167

Post by azinman2 »

tjoff wrote: post #99
fredoliveira wrote: post #82

Earlier quoted context omitted.

> ngrok can not possibly be easier than port forwarding. Oh come on, of course it can. I use port forwarding myself, but ngrok literally makes testing remote webhooks as simple as running "ngrok". That's it. It's definitely what I recommend coworkers who just want a quick solution to test out 3rd party service integrations.

Um, just signing up for ngrok - 10 times more effort than port forwarding. Then you have to learn how to ngrok. And thats that's before actually figuring out what ngrok really is, how sensible it is to route data through a third party etc. etc. etc. For people without public IPs - why not just learn how to setup an SSH tunnel instead? Similar effort , save it as a script. Boom, you actually learned something useful t…

I'm not sure you've ever used ngrok. There's no sign up. You literally just run the binary with a port as a argument and that's it. It also gives you access logging that you wouldn't otherwise have.

So it's not similar effort, especially given that I use it on my corporate network where doing port forwarding more assuredly would be difficult and problematic.

Re: Ngrok: Secure tunnels to localhost

#168

Post by tootie »

notgood wrote: post #29
Arcsech wrote: post #9

Earlier quoted context omitted.

How does this compare to https://localtunnel.github.io/www/ ?

I stopped used ngrok because after opening the tunneled URL a few times it started saying "too many HTTP requests" on a Wordpress project. It is common for those to have many images/scripts/styles so throttling by number of requests makes ngrok unusable, now a happy localtunnel user.

This seems like a problem with WordPress.

Re: Ngrok: Secure tunnels to localhost

#169

Post by tootie »

notgood wrote: post #29
Arcsech wrote: post #9

Earlier quoted context omitted.

How does this compare to https://localtunnel.github.io/www/ ?

I stopped used ngrok because after opening the tunneled URL a few times it started saying "too many HTTP requests" on a Wordpress project. It is common for those to have many images/scripts/styles so throttling by number of requests makes ngrok unusable, now a happy localtunnel user.

This seems like a problem with WordPress.
Post reply on HN