Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A remote browser product, open-sourced

github.com

Post reply on HN
Print view View original

121–130 of 159 posts

Re: Show HN: A remote browser product, open-sourced

#121

Post by gfodor »

slowenough wrote: post #94
throwaway58235 wrote: post #72

Darn... I'm working on almost exactly the same project. The big challenge is getting access to server hardware that is actually meant for webbrowsing. Not only are AWS et al expensive, they primarily offer "webservers" which are optimized for very light not very CPU intensive workloads and needless to say they also don't offer hardware accelerated video decoding.

Hey! Sorry for taking so long to get back to you. I saw your comment and wanted to respond, and I have been very busy today because of this post. Thanks for sharing your feeling about this. It looks like you're working on almost exactly the same project, and that the big challenge is getting access to server hardware for webbrowsing, because not only are AWS etc expensive, they primarily offer "webservers" optimized…

I did an experiment a while ago with streaming chrome to twitch from a gpu-enabled ec2 node and it worked quite well. Was able to stream a webgl experience at 60hz.

Re: Show HN: A remote browser product, open-sourced

#122

Post by ppf »

slowenough wrote: post #99
ppf wrote: post #82

Earlier quoted context omitted.

The free version is kinda unstable, but this is as far as I got: https://imgur.com/QMQVDrk https://imgur.com/E2ZZBaZ

Wow, that is far! It might have been the 10 minute time limit I put on the free version. It used to be 30 minutes but today there were hundreds of people and many people getting told it was already full, so I tried to let everyone have a go. But, haha, I'm really glad that little modal dialog bubbled up the layers! XD It's kind of crazy when you think about what's happening ~~ you're chaining 7 browsers in row, using…

Also, what does the "saved" value refer to? It's quite easy to make it have strange (negative, or very large) values.

Re: Show HN: A remote browser product, open-sourced

#123

Post by slowenough »

o-__-o wrote: post #104
slowenough wrote: post #98

Earlier quoted context omitted.

Thank you for your explanations here, you really get this category! I'm sorry but do you mind if I ask what's your background? I'd like to ask for your advice, I'm at cris@dosycorp.com .... Would you be uninterested in discussing over email?

Hey Cris! I saw your email in another thread and I was gonna reach out but for different reasons! My background is software dev with an emphasis on systems infrastructure and release management. I’ve worked enterprise and startups and my niche right now is M&A transitions. Look out for my email later today!

Thanks, I'll be looking out for it!

Re: Show HN: A remote browser product, open-sourced

#124

Post by slowenough »

ppf wrote: post #122
slowenough wrote: post #99

Earlier quoted context omitted.

Wow, that is far! It might have been the 10 minute time limit I put on the free version. It used to be 30 minutes but today there were hundreds of people and many people getting told it was already full, so I tried to let everyone have a go. But, haha, I'm really glad that little modal dialog bubbled up the layers! XD It's kind of crazy when you think about what's happening ~~ you're chaining 7 browsers in row, using…

Also, what does the "saved" value refer to? It's quite easy to make it have strange (negative, or very large) values.

Oh, sorry. It compares the amount of data you are receiving, versus the amount of data you would be receiving if you were browsing directly.

Saved = (total resource weight of original browsing) - (screenshots + protocol)

Re: Show HN: A remote browser product, open-sourced

#125

Post by slowenough »

gfodor wrote: post #121
slowenough wrote: post #94

Earlier quoted context omitted.

Hey! Sorry for taking so long to get back to you. I saw your comment and wanted to respond, and I have been very busy today because of this post. Thanks for sharing your feeling about this. It looks like you're working on almost exactly the same project, and that the big challenge is getting access to server hardware for webbrowsing, because not only are AWS etc expensive, they primarily offer "webservers" optimized…

I did an experiment a while ago with streaming chrome to twitch from a gpu-enabled ec2 node and it worked quite well. Was able to stream a webgl experience at 60hz.

That's good to know, thank you. What made you do that? Would it be too annoying to share some more about it?

Re: Show HN: A remote browser product, open-sourced

#126

Post by slowenough »

oefrha wrote: post #109
slowenough wrote: post #90

Earlier quoted context omitted.

> genifnly curious: who's your customer base? Customer base is people and organizations who are having problems with malware and cyber attacks. > Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. > it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly…

Appreciate the detailed response. Over the past few years I've seen a couple of similar remote browser services and was curious who actually need it, glad you shared firsthand knowledge. Now I can see that while this would probably be an overkill security-conscious individuals, it might make sense for organizations because there are always employees who can be easily tricked into clicking anything. I do wonder whethe…

Thanks a lot for that response!

Interesting hearing you know about RBI. Did you evaluate any of the other services? What did you feel about them?

I definitely think the approach you say (host level blocking, content blocking and some lightweight virtualization, like Edge/Windows Sandbox, or a local VM) is a valid one that reduces risks.

I think it comes down to considering, when attacks inevitably occur, where do you want to be doing the cleanup? Zapping a few containers, or instances in the cloud and starting them frehh, or decontaminating the local machines and network?

That's the biggest convenience for me so far.

Re: Show HN: A remote browser product, open-sourced

#127

Post by slowenough »

Erlich_Bachman wrote: post #113
slowenough wrote: post #70

Earlier quoted context omitted.

Yes! I requested an invite and reached out to Suhail on Twitter (I actually interviewed at Mixpanel ~ 18 months ago before I knew anything about MP or MA) about a technical question about MA that I got to thinking about from my experience building BG but didn't hear back from them. Mixpanel was a cool interview. I remember the question was about data structure for a rank system (it was a heap). The office in SF is be…

> I definitely think the future is mreo 'app virtualization' Why would you think that? Where do you see this trend? Their app looks incredibly stupid to me and it is hard to imagine any large number of people that would use it. Your project aims to provide security, which is an interesting goal, that I think security-conscious people would want to use. But to virtualize a browser... for performance? For browser apps…

I'm sorry to give you a link but I addressed this here[0]. The TL;DR is computing advances will allocate disproportionately to the big cloud providers, consolidating centralized/server compute which, coupled with 5G and AI, will lead to high-bandwidth experiences streamed to comparatively "thin" devices.

For that being said, I agree that virtualizing apps "right now" is stupid outside a niche unless you have some secret sauce (like Mighty must, otherwise why?), because it's too much overhead.

Preserving resources is why I run headless, and that's why I avoided WebRTC/VNC/video instead of judiciously sent screenshots only on change.

[0]: https://news.ycombinator.com/item?id=21562899

Re: Show HN: A remote browser product, open-sourced

#128

Post by arghwhat »

throwaway444912 wrote: post #117

This makes little sense, it doesn't protect you from exploits, they just run on the cloud instead. If an attacker has a browser exploit, they can still.. - read all your email - log all your passwords - wait for you to login to online banking and transfer all the money. You also have to worry about the host being compromised, or the operator logging your activity, etc. If this is something you really want for some re…

> This makes little sense, it doesn't protect you from exploits, they just run on the cloud instead.

I am in no way endorsing this product (or the category of products), but it is incorrect to say that it doesn't protect you from exploits.

It protects against your machine being compromised, and while the browser VM can be compromised, it can theoretically be ephemeral, possibly even only having the lifetime of a single tab (some products in the space does this IIRC).

It's all just a matter of what your threat model is.

> If this is something you really want for some reason, why not just RDP/VNC/Chrome Remote Desktop back to your office/home network.

You could make a minimal linux VM with only a web browser, keep good discipline and never do anything else on it, and RDP into it.

However, these products commonly provide much smaller attack surface than such a setup, and combined with something like VM-based tab isolation, you wouldn't be anywhere near the security features of such a product.

Re: Show HN: A remote browser product, open-sourced

#129

Post by slowenough »

throwaway444912 wrote: post #117

This makes little sense, it doesn't protect you from exploits, they just run on the cloud instead. If an attacker has a browser exploit, they can still.. - read all your email - log all your passwords - wait for you to login to online banking and transfer all the money. You also have to worry about the host being compromised, or the operator logging your activity, etc. If this is something you really want for some re…

Perfect prevention of breaches isn't possible, you must assume compromise. Therefore part of your strategy must be the isolation and containment of an attacker's ability to do damage.

For concerns regarding what you say, it's true. The worst case is a browser zero day that escapes the browser, enables privilege escalation, and goes on to compromise the entire client instance and lurks in the server catching everything. That's definitely a possibility on the free demo.

However, for real deployments there are several layers of mitigation. On the most drastic end, we run each browser and server pair inside its own docker container. In that case, the exploit must, first escape the browser -> escape the Docker container -> gain code execution -> gain privilege escalation -> compromise whole instance.

I would never say it's "impossible" but I would say that we have brought effective defenses against that.

Another layer of mitigation is that each browser is totally scrubbed each time it is used. This is a tradeoff as we lose all session cookies and cache data, but we can do this, if required. You can even scrub it yourself while using it (right click/top hold to get the context menu, and select "Wipe everything".

A further layer of mitigation is we completely reprovision / scrub the entire server every hour / day / week.

I think you are getting the idea.

By separating the client's devices and network from DMZ where "web work" occurs, and containing the attacks within this "air gapped" satellite, we greatly limit the attacker's scope to cause harm, plus we greatly increase our ability to deliver mitigation at any scale and schedule we choose.

Another advantage of this is, you don't need to download anything, RDP/VNC requires some extra app or setup, this is just connect to a web site and you're good to go.

You can self host to manage trust. Organizations typically want to partner with a provider even if they do self-host or go hybrid, because they don't want to manage everything themselves.

Re: Show HN: A remote browser product, open-sourced

#130

Post by mr__y »

slowenough wrote: post #91
FreeHugs wrote: post #71

Earlier quoted context omitted.

Awesome. Thanks for the detailed answer. I dig your dedication! You well earned to be on the front page! Who do you see as the main target audience? And do you have a business model in mind?

Thank you for this! Main audience is people and organizations who are having problems with malware and cyber attacks. Business model I am still working on, but it's a mishmash of licensing (+ maintenance, for hybrid / on-prem) and pay per seat (for cloud-based). Could be other ways to provide value. What's your background? I'm open to new ideas.

>people and organizations who are having problems with malware and cyber attacks.

this sounds like (almost) everyone

Post reply on HN