Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exe.dev

exe.dev

Post reply on HN
Print view View original

291–300 of 316 posts

Re: Exe.dev

#291

Post by varenc »

crawshaw wrote: post #278
ethin wrote: post #269

You have got to make a better website design. I'm a very curious person so was able to figure out what this was but you cannot expect all visitors of your website to be that way. Also, stop charging for SSO/OAuth2 integration. Seriously. There's a huge list of services that stupidly charge for SSO/OAuth integration at https://sso.tax , and this list needs to get smaller, not grow. SSO doesn't cost anything to impleme…

[exe.dev co-founder here] Hi. Re: oauth2, the last product I built, Tailscale, only did auth by oauth2. I chose this because 1. businesses need it anyway, and 2. passwords are terrible. But it was a choice that does not come for free. I dread a page of buttons for third-party services, and the control I give them over my life. I hate that I never know if I should log in with GitHub, or Google, and for a dozen service…

Appreciate you not following Tailscale's authentication many SSO provider approach. It makes sense for teams/business, (Tailscale's customers) but creates some confusion and extra friction for casual homelab users like me. I have a note in 1Password for tailscale.com just titled "USE GITHUB AUTH".

Passkeys work great for me and I greatly prefer them. Exe.dev I think is the first service I've seen that's so passkey centric and it makes a lot of sense.

Re: Exe.dev

#292

Post by docmars »

notepad0x90 wrote: post #281
docmars wrote: post #201

Earlier quoted context omitted.

It isn't a free service -- only during the alpha you get access to an "Individual" account which would normally run $20/mo once the test period is over. https://exe.dev/docs/pricing

Yes, it should be paid of course. Matter of fact, please charge me more for the privilege of not being asked email,phone, credit cards. Just take my money, and feel free to take whatever steps you think are needed to make sure abuse isn't taking places. I champion requiring a "deposit" where if abuse took place the user would forfeit it. But, my original comment is strictly about email. Even if you asked for a govern…

I think that leaves: how would you prefer to recover your account if you lost access?

Re: Exe.dev

#293

Post by Uptrenda »

I think I get more what they're going for now. A technical person can setup a server for themselves and setup services to work for multiple projects. But its complex to get everything right. Trying to reuse a server, setting up routing, domains, and so on can be tedious. I guess they abstract that problem. The wild card domains -> VM is a neat mapping. Then making it easy to use your resources and dispose of VMs.

I guess its an innovation at the resource management layer where you create / manage VMs. It's interesting they choose to give away individual plans. That's very generous. Though I'd feel bad using any of their resources.

Re: Exe.dev

#294

Post by notepad0x90 »

docmars wrote: post #292
notepad0x90 wrote: post #281

Earlier quoted context omitted.

Yes, it should be paid of course. Matter of fact, please charge me more for the privilege of not being asked email,phone, credit cards. Just take my money, and feel free to take whatever steps you think are needed to make sure abuse isn't taking places. I champion requiring a "deposit" where if abuse took place the user would forfeit it. But, my original comment is strictly about email. Even if you asked for a govern…

I think that leaves: how would you prefer to recover your account if you lost access?

same way I would with my email provider. But I'd expect a recovery code of some sort that i could save.

How would you normally recover an account? Email? So, if my email is compromised, everything gets compromised? That's not sane at all. You should normally have MFA, and if you can recover your MFA/2FA with email, it's just an over-engineered inconvenience. The way it's done right, the MFA recovery code servers as a general account recovery code as well. You save that somewhere safe and offline.

In this case, they use ssh public keys, so there is no need for all that, just add a spare public key to authorized_keys, and keep it's private key offline and safe, ideally in an HSM.

This is a service for technical people, so all that works, for general consumer service, you give them a choice. Either they choose to use a recovery key, a recovery email/phone...or recovery via payment. Let them pay $1 for recovery, proving they control the original method of payment (KYC not crypto). But if nothing else, users should be able to choose recovery code instead of email. It's more secure, because you're not relying on a 3rd party service to also be secure. I don't like them much, but recovery questions have also been used, but if you think about it, those are not that different from recovery codes, they're just more guessable.

Recovery codes aren't one string, they're usually multiple, so if users chose, they can split up their storage. For added reliability, you can require validation of recovery codes periodically, after a successful sign-in.

Re: Exe.dev

#295

Post by crawshaw »

varenc wrote: post #255
crawshaw wrote: post #254

Earlier quoted context omitted.

[exe.dev co-founder here] exedev@scarlet-canyon:~$ rsync --version rsync version 3.2.7 protocol version 31 Copyright (C) 1996-2022 by Andrew Tridgell, Wayne Davison, and others. Our base image is most of an Ubuntu server. We trim out, for example, systemd features that are designed for working with system hardware, and then add a lot of standard software, as our block device cloning is a lot faster and more efficient…

Would love it if Tailscale came pre-installed! Or even better: some simple way to make it so every VM I start up is automatically/easily part of my Tailnet. p.s. thanks for making Tailscale. And I'm loving exe.dev so far!

[exe.dev cofounder here] That's a good idea! I will add it to a list I have for exeuntu. Automatic login would be really nice, let me see if I can figure out how to do that. Thanks for trying exe.dev!

Re: Exe.dev

#296

Post by aryonoco »

sbierwagen wrote: post #270
ethin wrote: post #269

You have got to make a better website design. I'm a very curious person so was able to figure out what this was but you cannot expect all visitors of your website to be that way. Also, stop charging for SSO/OAuth2 integration. Seriously. There's a huge list of services that stupidly charge for SSO/OAuth integration at https://sso.tax , and this list needs to get smaller, not grow. SSO doesn't cost anything to impleme…

The only people who care about SSO are large enterprises. Coincidentally, large enterprises also are the only customers that make SAAS profitable. Every other plan is part of the sales funnel to the big enterprise contracts.

Is this meant as sarcasm?

I run a bunch of services for friends and family, things like Immich, wallabag, mealie etc. Less than 10 users, but do you expect me to crate and maintain separate accounts for each one for every service?

The SSO tax is stupid. If your whole business model is based on putting SSO behind a paywall, it’s a sign of a broken business model.

Re: Exe.dev

#297

Post by dependency_2x »

skybrian wrote: post #149
dependency_2x wrote: post #108

Nice one. Love the coding agent web ui. I used https://temp-mail.org as I didn't want to use a real email. Enjoy my creation https://love-storm.exe.xyz:8001

Nobody can see this until you make the website public. (Test with a browser’s Incognito mode.)

Ah ok, and now it is died and not sure how to resurrect. But the prompt was "Poo emoji generator" so try that if you want to experience the fun.

Re: Exe.dev

#298

Post by otterley »

enneff wrote: post #231
otterley wrote: post #198

Earlier quoted context omitted.

Remote resources only get your public key. It’s meant to be shared! Hence the word “public.” The threat is having a private key stolen, in which case, having multiple keys can mitigate the amount of damage a threat actor can do. However, to steal your private key would involve a successful attack against your client, not against any server you might have given the public key to.

There is also the threat of the server sending a data sequence that exploits a vulnerability in your terminal. It has happened before, but it’s rare.

Always encrypt your SSH private key! It shouldn’t be so easily stolen.

Re: Exe.dev

#299

Post by strathmeyer »

ricardobeat wrote: post #165
codingdave wrote: post #86

Earlier quoted context omitted.

Not a mobile issue. I am on desktop and had no idea what this service was because nothing on the initial UI explained what we were looking at. I went and double-checked when people here were talking about pricing and VMs. From the home page, I figured it was some text-based game or experiment and closed the page. It looks like some people who work there are watching this thread, so to them I say: You have got to expl…

It's odd to see how people are not accustomed to plain websites anymore. You click the 'About' link in the footer, and get a direct explanation of what it is, pricing and the entire documentation.

[dead]

Re: Exe.dev

#300

Post by gct »

crawshaw wrote: post #254
rsync wrote: post #216

Earlier quoted context omitted.

Is rsync installed in the stock vm environment by default? Asking for a friend…

[exe.dev co-founder here] exedev@scarlet-canyon:~$ rsync --version rsync version 3.2.7 protocol version 31 Copyright (C) 1996-2022 by Andrew Tridgell, Wayne Davison, and others. Our base image is most of an Ubuntu server. We trim out, for example, systemd features that are designed for working with system hardware, and then add a lot of standard software, as our block device cloning is a lot faster and more efficient…

emacs!
Post reply on HN