Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abcdesktop – a cloud native desktopless system

abcdesktop.io

Post reply on HN
Print view View original

71–80 of 81 posts

Re: Abcdesktop – a cloud native desktopless system

#71

Post by turboponyy »

antx wrote: post #26
syncbehind wrote: post #24

Earlier quoted context omitted.

Is that bad?

The most probable issue related to this kind of behaviour is pastejacking. It's possible for the server to detect that you're actually using curl (with the help of the user agent of other methods) and also that you're piping it to an interpreter. Knowing that, the server could send you a malicious payload, that wouldn't be apparent when only downloading the file otherwise. Some people think this isn't the real issue,…

How can the server tell whether you're just curling or curling and piping that output to an interpreter?

Re: Abcdesktop – a cloud native desktopless system

#72

Post by franga2000 »

turboponyy wrote: post #71
antx wrote: post #26

Earlier quoted context omitted.

The most probable issue related to this kind of behaviour is pastejacking. It's possible for the server to detect that you're actually using curl (with the help of the user agent of other methods) and also that you're piping it to an interpreter. Knowing that, the server could send you a malicious payload, that wouldn't be apparent when only downloading the file otherwise. Some people think this isn't the real issue,…

How can the server tell whether you're just curling or curling and piping that output to an interpreter?

Weird timing magic, if I recally correctly: https://news.ycombinator.com/item?id=17636032

Re: Abcdesktop – a cloud native desktopless system

#73

Post by hawski »

tehlike wrote: post #68
hawski wrote: post #37

For a cloud native desktopless system I was thinking it should not be remote desktop based. Is there a cloud desktop, that is a bit more like NeWS? I mean text rendering client side as HTML/CSS, image and video view via img/video tags. A sprinkle of JS to make it smooth and dynamic. With normal windows and maybe even a taskbar would be splendid. Possible X or Wayland integration, but as separate windows in such a sys…

https://os-js.org/ https://dustinbrett.com/

Thanks. That is not exactly what I had in mind as far as I understand what those projects do. It seems that they run entirely in the browser. Server just serves HTML/CSS/JS.

I was thinking about a desktop that would be rendered on the browser, but applications would run actually on the remote server. So if you would log in from a different computer you would have exact same desktop opened. A bit like X with this difference, that the text rendering would be done straight on the browser without canvas.

But that's a good entry point.

Re: Abcdesktop – a cloud native desktopless system

#75

Post by chunk_waffle »

gowld wrote: post #66
chunk_waffle wrote: post #30

Earlier quoted context omitted.

If you follow that to it's logical conclusion then "everything is terrible and nothing is secure" (which is probably the reality) My personal gripe with piping curl output to sh is about expectations. If I have some binary I'm running, I have _some_ expectations about what it will do, same for a Makefile, and RPM, etc. None of those things are guaranteed to do what they're supposed to but I have some idea what _shoul…

Makefile, RPM , and shell all essentially do the same thing and have the same power to violate your system.

To re-iterate, for me its not really about the potential for abuse, its more about expectations. You can abuse anything (though I'd also argue that signed packages from companies like RedHat and Canonical are usually up to a higher standard than the random Shell script plucked from the internet.)

If someone places a shoe box on your doorstep you might expect shoes to be inside. Of course, there's a non zero chance its full of bees. But shoes are a reasonable guess.

If someone places a cardboard box on your doorstep with no writing on it whatsoever, there's no expectation about whats in the box. (Unless you hear the bees buzzing from a distance.)

Re: Abcdesktop – a cloud native desktopless system

#76

Post by koumoula »

hedora wrote: post #54
lostapathy wrote: post #9

Earlier quoted context omitted.

What’s a good vnc client and server that actually pulls this off? I’ve never had any luck with it either. At least not on Ubuntu.

TigerVNC

from the abcdesktopio github repository tigervnc this project uses TigerVNC release 1.12.0 it starts the command Xvnc and then websockify python to convert TCP socket as WebSocket

Re: Abcdesktop – a cloud native desktopless system

#77

Post by koumoula »

glmdev wrote: post #12

This seems like a cool concept, but I didn't try it out because the demo requires FULL READ-WRITE access to my GitHub account, its organizations, and private details! Surely reading basic user info would suffice.

The demo.abcdesktop.io OAuth configuration has changed. The demo doesn’t require FULL READ-WRITE access to GitHub account, anymore.

It uses only Personal user data Profile information (read-only), just to display your user name in the top bar. The scope OAuth 2.0 has changed from ‘user’ to 'read:user' You can use a GitHub OAuth safely, it was a misunderstanding in GitHub doc OAuth

Re: Abcdesktop – a cloud native desktopless system

#78

Post by hda111 »

glmdev wrote: post #12

This seems like a cool concept, but I didn't try it out because the demo requires FULL READ-WRITE access to my GitHub account, its organizations, and private details! Surely reading basic user info would suffice.

Good point. Since the Travis incident I don’t give any app write access to anything.

Re: Abcdesktop – a cloud native desktopless system

#79

Post by hda111 »

TuringTest wrote: post #21

Why do I keep getting this distinct impression that people use containers to keep reinventing OS processes, but "in the cloud!"? Next thing, you'll see announced a platform for reusable container services that can be dynamically linked from other containers - to avoid including them multiple times in your application containers that share the same version, and we'll have come full circle. Is there a subtle detail abo…

> Next thing, you'll see announced a platform for reusable container services that can be dynamically linked from other containers

I think that wouldn’t be a bad idea. It’s good for RAM and disk space usage while still isolating processes. Would be useful for IoT devices without much memory or space that still have to run docker.

Re: Abcdesktop – a cloud native desktopless system

#80

Post by koumoula »

pmontra wrote: post #20

Is there any technical reason for not making it work with user / authentication when people download, configure and run their own instances?

Yes, it is for security reason on demo.abcdesktop.io instance. abcdesktop.io supports LDAP, LDAPS, Active Directory services, and Basic, NTLM and Kerberos authentication.
Post reply on HN