Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emacs Tramp over AWS SSM APIs

martin.baillie.id

Post reply on HN
Print view View original

51–59 of 59 posts

Re: Emacs Tramp over AWS SSM APIs

#51

Post by rgoulter »

forty wrote: post #8
ak217 wrote: post #6

Earlier quoted context omitted.

Yes, the vscode remote development plugin is a game changer. It's the new benchmark for how client-server IDEs should work. I am (and more importantly, my team is) no longer constrained to the terminal and memorizing incredibly obscure emacs or vi commands to get stuff done on a remote instance. There is no input lag because vscode keeps all the IDE UI local while doing all the heavy lifting remotely. And to the arti…

You seem to imply that using vi or emacs is an inferior UX than using VSCode (as it's a constraint), but I'm sure many people people feel differently (me included, and I have used VSCode as my main ide for a while).

I'd infer that most people struggling with vim or emacs UX are people who are newcomers to each editor.

Re: Emacs Tramp over AWS SSM APIs

#52

Post by patrick451 »

ak217 wrote: post #11
natrys wrote: post #9

Earlier quoted context omitted.

Emacs isn't constrained by terminal, Tramp doesn't need knowing any "incredibly obscure" command, and since one uses local Emacs there is no input lag to speak of. I feel like you are conflating Emacs and Vi here even though they are not same at all, only in case of Vi you connect via ssh in a terminal and do everything remote side, not in Emacs. I use Tramp to have local Emacs connect to remote docker container, whe…

To be clear, I was only mentioning vi and emacs together because both have incredibly passionate communities that can be quite myopic to the UX deficiencies of their platforms. I have a lot of muscle memory committed to emacs so I still use it a lot, but I can onboard a dozen junior developers onto vscode in the time it takes me to help someone figure out emacs. And to me, the final missing piece that made vscode sui…

You onboard new hires to an editor? That's ... surprising to say the least.

Re: Emacs Tramp over AWS SSM APIs

#53

Post by square_usual »

patrick451 wrote: post #52
ak217 wrote: post #11

Earlier quoted context omitted.

To be clear, I was only mentioning vi and emacs together because both have incredibly passionate communities that can be quite myopic to the UX deficiencies of their platforms. I have a lot of muscle memory committed to emacs so I still use it a lot, but I can onboard a dozen junior developers onto vscode in the time it takes me to help someone figure out emacs. And to me, the final missing piece that made vscode sui…

You onboard new hires to an editor? That's ... surprising to say the least.

It's not that out of the way. The previous place I worked, we had to help new hires get their editor set up, because most of them hadn't used Ruby/Rails before and didn't know what they'd need. We had an onboarding doc that helped you get started with Code + Solargraph, RubyMine or Sublime + Solargraph so they'd have features they'd have used in other languages. Apart from that, we'd also have to guide them through getting the editor set up to do things like format on save etc. to ensure the codebase was clean.

Re: Emacs Tramp over AWS SSM APIs

#54

Post by gizdan »

tyingq wrote: post #14

"Perhaps more interesting, though, is that for the last couple of years AWS has supported tunneling the SSH protocol over their SSM APIs if you use the SSM “document” called AWS-StartSSHSession." That's interesting. I know some places go to great lengths to keep developers from accessing production without some sort of break-glass procedure through a jump host. I'm curious if they all know about this sort of loophole…

We've been using symops[0] which uses AWS-StartSSHSession document, but what's nice is it allows to set up different workflows for how people access servers. Plus all the advantages of SSM in general (IAM/SSO, CloudTrail etc).

[0] https://symops.com/

Re: Emacs Tramp over AWS SSM APIs

#55

Post by ungamedplayer »

Scarbutt wrote: post #10
taeric wrote: post #5

Earlier quoted context omitted.

How? Tramp has been working at this level for well over a decade, if I'm not mistaken. And you don't have to have anything installed in the "host" that you are connecting to.

When your dev environment is on a remote server, the DX of vscode is superior, everything just works(like all your plugins), it's seamless and fast. Tramp is great for editing some remote files here and there, but to match vscode you will have to put a lot of effort to make everything feel equally fast and make all your packages work. Even then it won't feel as seamless as vscode because it "cheats" by installing a r…

I hate hearing the 'everything just works', because it 'just works' until it doesn't. Apple users use the same term until their software no longer just works.

Re: Emacs Tramp over AWS SSM APIs

#56

Post by gunapologist99 »

tptacek wrote: post #49
gunapologist99 wrote: post #37

> For a good wee while now, AWS SSM (or AWS Systems Manager as I see they are calling it nowadays) has arguably been the most secure way to permit controlled and audited access to an EC2 instance. SSM is definitely not the most secure way[0]. SSM is super complex and super-integrated into the rest of AWS, and also isn't cross-cloud to GCP, Azure, DO, etc, so now everyone needs an account just to log into a Linux serv…

What does being cross-cloud have to do with whether SSM is the most secure way to SSH into an AWS instance?

Because everyone will need a (possibly misconfigured) AWS IAM account just to log into any Linux server.. this increases complexity and reduces isolation, compartmentalization, separation of concerns, least privilege, etc.

I was mentioning that particular misfeature because it was a personal annoyance of mine. Oh well, I suppose everything is about customer lock-in these days.

Re: Emacs Tramp over AWS SSM APIs

#57

Post by kstrauser »

kstrauser wrote: post #50
Scarbutt wrote: post #40

Earlier quoted context omitted.

I'll give it a try, thanks.

Examples, starting with a new connection to a server I haven't accessed recently: ᐅ time ssh myserver exit Executed in 1.66 secs Now visiting it again uses the existing connection: ᐅ time ssh mastodon exit Executed in 55.89 millis

(Assume the hostname is identical in both cases. I edited one and not the other. Oops!)

Re: Emacs Tramp over AWS SSM APIs

#58

Post by tptacek »

gunapologist99 wrote: post #56
tptacek wrote: post #49

Earlier quoted context omitted.

What does being cross-cloud have to do with whether SSM is the most secure way to SSH into an AWS instance?

Because everyone will need a (possibly misconfigured) AWS IAM account just to log into any Linux server.. this increases complexity and reduces isolation, compartmentalization, separation of concerns, least privilege, etc. I was mentioning that particular misfeature because it was a personal annoyance of mine. Oh well, I suppose everything is about customer lock-in these days.

It sounds like you don't think AWS is the most secure place to host an application. That's not the argument being made here; the argument stipulates AWS.

Re: Emacs Tramp over AWS SSM APIs

#59

Post by hibbelig »

ithrow wrote: post #20
taeric wrote: post #5

Earlier quoted context omitted.

How? Tramp has been working at this level for well over a decade, if I'm not mistaken. And you don't have to have anything installed in the "host" that you are connecting to.

Every time you save your edits Tramp makes a new connection to the remote server, it's slow(1sec vs 1ms) and becomes annoying waiting for the save all the time. For doing quick edits it doesn't matter but for doing dev all day it does.

Tramp offers different "connection methods" with different characteristics. For example, the scp connection method uses scp to copy files to/from the remote machine, and this implies a new ssh connection each time.

But the ssh connection method transfers the files inline, using base64 or uu encoding, and then you do not need a new connection each time the file is read or written.

Post reply on HN