5 ms·

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server any

by Hondor 10y ago

It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.

swiley 10y ago
I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out port 80 and 22 so I can get to it from pretty much any network.
- mikenon 10y ago
  You could use https://ngrok.com https://ngrok.com to expose the ports.
- robogrowth 10y ago
  Ngrok.com for ssh tunneling.
  - tmat 10y ago
    Can't recommend Ngrok enough... saved my bacon and makes testing on devices so easy and painless.
    - chmars 10y ago
      Hasn't Ngrok the same security risks as GoToMyPC?
      - lukasm 10y ago
        Nope. With Ngrok you don't type password on the website. No xss, csrf etc
- mpnordland 10y ago
  pagekite.net is another great option for ssh and http tunneling.
- ams6110 10y ago
  Is it still the case that for most ISPs the uplink is much slower than the downlink speed? That was one reason running anything other than limited-use servers from your home wasn't feasible.
  - gkop 10y ago
    With the advent of streaming TV and movies, for many of us now the reverse is true.
    - chc 10y ago
      How do streaming movies make your uplink faster than your downlink?
      - gkop 10y ago
        Other subscribers in the cell consume more downlink than uplink, in a steep ratio.
- gkop 10y ago
  In addition to the services mentioned in sibling comments, it's not difficult to outfit a VPS for this purpose. This is a pretty helpful starting point: https://gist.github.com/gdamjan/4586758 https://gist.github.com/gdamjan/4586758
walrus01 10y ago
In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set up an SSH tunneled setup, and want something to "just work" through NAT. My setup looks something like this, with public/private key SSH auth. Copied and pasted from my notes, hostnames and IP addresses redacted: ------- I have a static /30 and forward port 445 on the external side of my home router, through the NAT to port 22 on the workstation PC in my rfc1918 IP space. workstationhostname.domainname.org normally has vnc session listening on port 5901 localhost only, spawned with: vnc4server -geometry 1920x1200 -localhost This is for use with an SSH tunnel coming from hostname.ofmy.static.slash30.org:445 through NAT to workstationname.rfc1918.ip.address port 22 To access from the outside world, on the client, do the following: ssh -v -L 5901:localhost:5901 -N -f -l myusername -p 445 hostname.ofmy.static.slash30.org use client system's vnc client software to connect to 127.0.0.1:5901 To access from inside the LAN, on the client, do the following: ssh -v -L 5901:localhost:5901 -N -f -l myusername -p 22 workstationname.rfc1918.ip.address use client system's vnc client software to connect to 127.0.0.1:5901
- zeta0134 10y ago
  If you're on a Windows system this is even easier. Go to System -> Remote Desktop Connections and check the box to enable incoming connections. On your router, forward port 3389 to the machine you want to access. On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password. For the average home user this is all the setup that's needed, and it doesn't involve handing over your computer's security to a third-party company that is now a giant target for these sorts of attacks. :) I think the big advantage that LogMeIn and GoToMyPC have in the casual realm though is their simplicity. In particular, they entirely dodge the need for the user to know anything technical at all, including port forwarding on the router, which is the bigger technical hurdle here. You just install their program and it does the rest for you. Port forwarding seems like child's play to you or me, but they have a huge market in folks who didn't even know you could log into your router and change settings. Or that even know what a router is, despite owning one.
hackuser 10y ago
> It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Very few users can run their own web servers. We used to deploy GoToMyPC for users; it was reliable, performed well, platform independent (including mobile), and secure. I expect it still is. When the new OS or other new tech came out, GoToMyPC handled any compatibility issues; we didn't have to worry. No matter what the user's remote computer was, it worked (as long as there was an Internet connection). The security was good too: End-to-end encryption, optional one time pads, and even details like blanking the screen of the host machine so that someone in the room with the host couldn't monitor what the user was doing. We stopped using it because we didn't need it any more, but we were happy customers for many years until that point.
- _asummers 10y ago
  > optional one time pads Any good reason why this wouldn't be the default? Speed + key exchange transmissions, maybe?
  - mcpherrinm 10y ago
    One time pads are rarely useful: The key is as big as the data, so you need a secure channel to transmit the key. If you had that channel, why not just transmit the data over it?
    - xoa 10y ago
      Your mistake here is failing to consider that sharing an entropy pool does not (and in fact should not, it must be shared out-of-band anyway) need to be real time. Fundamentally, OTPs involve leveraging physical security and fleeting points of physical contact to create a pre-shared perfectly secure future communication channel. Ie., two people meet up an exchange a USB stick (or HDD), then consume the entropy pool over time. These days that could mean trivially having a pool of hundreds of gigabytes to terabytes, which equates to tens of thousands of hours of high quality voice communications, ludicrous amounts of plain text, etc, and that's assuming direct consumption. If instead it's used just for symmetrical session keys then from a human perspective it'll last forever (can burn through thousands of 512-bit keys an hour for an entire lifetime and still be fine). The issues with OTP include that it doesn't provide authentication, it doesn't scale, pure point-to-point, etc., and that in the end the benefits it offers just don't matter in general right now vs the costs and disadvantages. There's no reason in general not just use a decent pre-shared self-gen cert, PKI or WoT key system instead. OTP applies best to any organization that can already handle physical security. Basically, if an organization moves weapons, money, or drugs around securely then it could move entropy too, so governments, militaries, banks, organized crime and the like. But for anyone to bother all existing crypto would have to be utterly broken, otherwise it's superior to just use standard crypto.

by Hondor 10y ago

swiley 10y ago

I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out port 80 and 22 so I can get to it from pretty much any network.

mikenon 10y ago
You could use https://ngrok.com https://ngrok.com to expose the ports.
robogrowth 10y ago
Ngrok.com for ssh tunneling.
- tmat 10y ago
  Can't recommend Ngrok enough... saved my bacon and makes testing on devices so easy and painless.
  - chmars 10y ago
    Hasn't Ngrok the same security risks as GoToMyPC?
    - lukasm 10y ago
      Nope. With Ngrok you don't type password on the website. No xss, csrf etc
mpnordland 10y ago
pagekite.net is another great option for ssh and http tunneling.
ams6110 10y ago
Is it still the case that for most ISPs the uplink is much slower than the downlink speed? That was one reason running anything other than limited-use servers from your home wasn't feasible.
- gkop 10y ago
  With the advent of streaming TV and movies, for many of us now the reverse is true.
  - chc 10y ago
    How do streaming movies make your uplink faster than your downlink?
    - gkop 10y ago
      Other subscribers in the cell consume more downlink than uplink, in a steep ratio.
gkop 10y ago
In addition to the services mentioned in sibling comments, it's not difficult to outfit a VPS for this purpose. This is a pretty helpful starting point: https://gist.github.com/gdamjan/4586758 https://gist.github.com/gdamjan/4586758

walrus01 10y ago

In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set up an SSH tunneled setup, and want something to "just work" through NAT. My setup looks something like this, with public/private key SSH auth. Copied and pasted from my notes, hostnames and IP addresses redacted: ------- I have a static /30 and forward port 445 on the external side of my home router, through the NAT to port 22 on the workstation PC in my rfc1918 IP space. workstationhostname.domainname.org normally has vnc session listening on port 5901 localhost only, spawned with: vnc4server -geometry 1920x1200 -localhost This is for use with an SSH tunnel coming from hostname.ofmy.static.slash30.org:445 through NAT to workstationname.rfc1918.ip.address port 22 To access from the outside world, on the client, do the following: ssh -v -L 5901:localhost:5901 -N -f -l myusername -p 445 hostname.ofmy.static.slash30.org use client system's vnc client software to connect to 127.0.0.1:5901 To access from inside the LAN, on the client, do the following: ssh -v -L 5901:localhost:5901 -N -f -l myusername -p 22 workstationname.rfc1918.ip.address use client system's vnc client software to connect to 127.0.0.1:5901

zeta0134 10y ago
If you're on a Windows system this is even easier. Go to System -> Remote Desktop Connections and check the box to enable incoming connections. On your router, forward port 3389 to the machine you want to access. On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password. For the average home user this is all the setup that's needed, and it doesn't involve handing over your computer's security to a third-party company that is now a giant target for these sorts of attacks. :) I think the big advantage that LogMeIn and GoToMyPC have in the casual realm though is their simplicity. In particular, they entirely dodge the need for the user to know anything technical at all, including port forwarding on the router, which is the bigger technical hurdle here. You just install their program and it does the rest for you. Port forwarding seems like child's play to you or me, but they have a huge market in folks who didn't even know you could log into your router and change settings. Or that even know what a router is, despite owning one.

hackuser 10y ago

> It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Very few users can run their own web servers. We used to deploy GoToMyPC for users; it was reliable, performed well, platform independent (including mobile), and secure. I expect it still is. When the new OS or other new tech came out, GoToMyPC handled any compatibility issues; we didn't have to worry. No matter what the user's remote computer was, it worked (as long as there was an Internet connection). The security was good too: End-to-end encryption, optional one time pads, and even details like blanking the screen of the host machine so that someone in the room with the host couldn't monitor what the user was doing. We stopped using it because we didn't need it any more, but we were happy customers for many years until that point.

_asummers 10y ago
> optional one time pads Any good reason why this wouldn't be the default? Speed + key exchange transmissions, maybe?
- mcpherrinm 10y ago
  One time pads are rarely useful: The key is as big as the data, so you need a secure channel to transmit the key. If you had that channel, why not just transmit the data over it?
  - xoa 10y ago
    Your mistake here is failing to consider that sharing an entropy pool does not (and in fact should not, it must be shared out-of-band anyway) need to be real time. Fundamentally, OTPs involve leveraging physical security and fleeting points of physical contact to create a pre-shared perfectly secure future communication channel. Ie., two people meet up an exchange a USB stick (or HDD), then consume the entropy pool over time. These days that could mean trivially having a pool of hundreds of gigabytes to terabytes, which equates to tens of thousands of hours of high quality voice communications, ludicrous amounts of plain text, etc, and that's assuming direct consumption. If instead it's used just for symmetrical session keys then from a human perspective it'll last forever (can burn through thousands of 512-bit keys an hour for an entire lifetime and still be fine). The issues with OTP include that it doesn't provide authentication, it doesn't scale, pure point-to-point, etc., and that in the end the benefits it offers just don't matter in general right now vs the costs and disadvantages. There's no reason in general not just use a decent pre-shared self-gen cert, PKI or WoT key system instead. OTP applies best to any organization that can already handle physical security. Basically, if an organization moves weapons, money, or drugs around securely then it could move entropy too, so governments, militaries, banks, organized crime and the like. But for anyone to bother all existing crypto would have to be utterly broken, otherwise it's superior to just use standard crypto.