Live data from Hacker News

Localtunnel.me

localtunnel.me

11–20 of 51 posts

Re: Localtunnel.me

#11
post #9

I suggest you don't use it until they have upgraded OpenSSL... WARNING: server returned more data than it should - server is vulnerable! (Heartbleed)

I think it is alright to use it.. its just to share the work in progress so it doesnt matter if it is vulnerable

Re: Localtunnel.me

#13
This seems like a bad idea. localtunnel.me is redirecting non-tunnel'd subdomains to its main page, while inactive tunnel'd subdomains return "localtunnel error: no active client for 'adbc'". So, with a little poking, you find that tunnel'd subdomains seem to be [a-z0-9]{4}.localtunnel.me ... which isn't too terribly large of a search space to crawl. If it gets popular, it should be easy to find works-in-progress that might give up access to the user's computer, or keys to prod, or any of the other stuff that people are a little sloppy about on their work machines.

edit: I was wrong, I should've been a little more thorough. Looks like it's [a-z0-9]{4,10}.localtunnel.me, which is significantly larger.

Re: Localtunnel.me

#14
post #9

I suggest you don't use it until they have upgraded OpenSSL... WARNING: server returned more data than it should - server is vulnerable! (Heartbleed)

I think it is alright to use it.. its just to share the work in progress so it doesnt matter if it is vulnerable

I've already seen PHPMyAdmin login and tokens pass by, so I don't think it's only used for showing progress but also to have a reverse tunnel back home..

Re: Localtunnel.me

#15
You can also use ngrok.com which has been around for quite a while. The developer even responds very quickly to support requests.

As a bonus, you also get:

- Custom (sub) domains

- TLS tunnels if you want, not mandatory

- Other protocols than just HTTP/S

Re: Localtunnel.me

#16
post #14

Earlier quoted context omitted.

I think it is alright to use it.. its just to share the work in progress so it doesnt matter if it is vulnerable

I've already seen PHPMyAdmin login and tokens pass by, so I don't think it's only used for showing progress but also to have a reverse tunnel back home..

the slogan is "expose yourself to the world"

Re: Localtunnel.me

#17

It would be nice to have option to allow custom URL

Or at least get to reuse an URL after reboot/dc/something, since this is links you would send to your client/boss, having to email them new ones is a hassle.

Re: Localtunnel.me

#18

You can also use ngrok.com which has been around for quite a while. The developer even responds very quickly to support requests. As a bonus, you also get: - Custom (sub) domains - TLS tunnels if you want, not mandatory - Other protocols than just HTTP/S

Yes, I still find that ngrok works quite well :D

Re: Localtunnel.me

#19
This seems like a bad idea or to phrase it correctly: use it wisely.

Because, you will use this service for the development to give someone outside access to something. If you then close the tunnel, the service will forward any request to its own server either to the main pager or to an error page. That means, all data given with a request, either via GET or via POST, will be given to that service. That could include sensitive data. That means, this kind of service is security risk.

Re: Localtunnel.me

#20

Oh nice! This looks very similar to https://pagekite.net (which is also open source), minus the need for an account. Good call.

Yep, was going to chime in here as the dev of a pagekite is a friend of mine. Glad someone else appreciates it too!
Post reply on HN