Live data from Hacker News

Surfly - Surf together on the web

surfly.com

21–30 of 43 posts

Re: Surfly - Surf together on the web

#22
post #16

Earlier quoted context omitted.

Only the controller fires the HTTP requests. The viewer just gets DOM updates, so cookie's (session secrets) or password will never be send to the follower.

I do not quite understand, sorry. I am concerned about security. Why am I allowed to login into say, Trello.com, while I am on surfly.com domain? Shouldn't my browser's cross-domain security policy prohibit this practice? Is it all being done through a proxy? If so, is it not true that a lot of sites don't work over proxy? [Edit] And if it is indeed proxy, doesn't that mean you can read my password(s) in clear text?

The proxy is needed to make sure that we can modify the content in such a way that it works correctly during the session. We sandbox the site so that everything keeps works correctly. I'll go deeper into this in a blog post soon.

The connection to the proxy is encrypted and if the site you login also uses https, your password will never be send in clear text over the wire. Since form submissions are not actually replayed on the viewer's side, we only keep them for the time of the request and only in memory. For those companies who want to control the security fully we are working on a on a solution that can be installed on-premise.

Re: Surfly - Surf together on the web

#23

How is this different from https://togetherjs.com/ ?

I've answered this already somewhere below.

But the biggest difference is the use case, you would use TogetherJS to add collaboration on your site by writing a bit of code. You would Surfly to share your web session with someone else (no need to code, works on any website), use it to explain things, demonstrate your app or give remote product demo's.

Re: Surfly - Surf together on the web

#25

You seem to be acting as a proxy and so I am sending all my passwords to your site so you login on my behalf. I guess the better approach would have been to load the website on client end and only send the DOM to your server OR the other client directly.

We've considered that, but if you want to share everything that is being shown, you will also need be able to have access to that as well. If you do it purely through some sort of script include, you will not be able to hook into 3rd party widgets for example and there are more things that are problematic.

Yes, I understand there would be issues on sending passworded resources that are linked within the page. In my case, you would have to recursively send all the resources of the current page to the other client.

Good work though!

Re: Surfly - Surf together on the web

#26
post #9

Would be great for demos, but unfortunately it doesn't work with the canvas element on my website hashtagify.me

Thanks for reporting, we just looked at your site and saw a different issue causing this problem, we'll push out a fix somewhere tomorrow. This fixes your pretty hashtag cloud.

Great, I'll try your service instead of desktop sharing the next time I'll have to show the service to some user. Thx

Re: Surfly - Surf together on the web

#27
post #9

Would be great for demos, but unfortunately it doesn't work with the canvas element on my website hashtagify.me

Thanks for reporting, we just looked at your site and saw a different issue causing this problem, we'll push out a fix somewhere tomorrow. This fixes your pretty hashtag cloud.

Unfortunately doesn't work with our site: www.peecho.com

Re: Surfly - Surf together on the web

#28

Earlier quoted context omitted.

Thanks for reporting, we just looked at your site and saw a different issue causing this problem, we'll push out a fix somewhere tomorrow. This fixes your pretty hashtag cloud.

Unfortunately doesn't work with our site: www.peecho.com

Thanks for reporting, we'll look into it.
Post reply on HN