5 ms·

Ok. One question that bothers me. Why repl.it and company permit internet access through their sandboxes? How is that not restricted? I can just annonymously ru

Ok. One question that bothers me. Why repl.it and company permit internet access through their sandboxes? How is that not restricted? I can just annonymously run stuff and use them as a proxy. That is a big no-no in my book, but I must be missing something.

ezekg 8y ago
They're the only online repl I can use to test API integrations (and produce interactive integration examples), so I think of it as a "feature." ;)
- amasad 8y ago
  Ah cool. Do you have any examples online of how you use it?
  - deleted 8y ago
    [deleted]
  - ezekg 8y ago
    Here's an example: https://repl.it/repls/RustyInsecureEngines https://repl.it/repls/RustyInsecureEngines. I don't have any previous examples that I can find, as I don't usually use it while logged in. Essentially, I use it to help customers out when they're having issues integrating my API product. Real easy to create a repl and send them a link. Edit: relevant repl slug is relevant.
    - amasad 8y ago
      Oh awesome. You can probably also use it for docs. You can now hide keys in a .env file https://repl.it/site/docs/secret-keys https://repl.it/site/docs/secret-keys. Edit: lol re slug. Sometimes I think the title gen aglo is prescient
      - ezekg 8y ago
        Didn't notice you were the founder, nice. I'll check out the link. Semi-related: I've been wanting to give my customers the ability to write/deploy their own webhook handlers, because that's a big roadblock for those that don't have any web/server experience. Been thinking it'd be cool to embed a repl for that (with a "starter" handler per-language), to handle editing/deployment, but I haven't dug too much into that to see if it'd be possible. Been meaning to reach out to your team but I keep putting it off. Like I said, love your platform and been fun watching you grow. :)
        amasad 8y ago
        Thanks -- Keygen looks cool too! Yeah you can embed. It's under the share dialog. More in the docs.
- int0x80 8y ago
  Absolutely. But is unexpected for me at least. But thinking of it, maybe you can log everything and if something bad happens you can blame the origin IP who ever that is. You can also ratelimit the outbound conections to avoid abuses etc. Is not like an open wifi where the client doesnt leave any trace at all. But in the shell account days IIRC you had to register with your name/email etc to use the service, that provided internet access. Maybe that didn't imply any safety either.
  - ezekg 8y ago
    I definitely agree that it may be a better idea to put it behind a login to prevent abuse.
  - amasad 8y ago
    It took us a while before opening up. We only did after building tools to handle abuse, and after hiring someone to help us monitor.
    - int0x80 8y ago
      Thanks for the info. And great product you have!

ezekg 8y ago

They're the only online repl I can use to test API integrations (and produce interactive integration examples), so I think of it as a "feature." ;)

amasad 8y ago
Ah cool. Do you have any examples online of how you use it?
- deleted 8y ago
  [deleted]
- ezekg 8y ago
  Here's an example: https://repl.it/repls/RustyInsecureEngines https://repl.it/repls/RustyInsecureEngines. I don't have any previous examples that I can find, as I don't usually use it while logged in. Essentially, I use it to help customers out when they're having issues integrating my API product. Real easy to create a repl and send them a link. Edit: relevant repl slug is relevant.
  - amasad 8y ago
    Oh awesome. You can probably also use it for docs. You can now hide keys in a .env file https://repl.it/site/docs/secret-keys https://repl.it/site/docs/secret-keys. Edit: lol re slug. Sometimes I think the title gen aglo is prescient
    - ezekg 8y ago
      Didn't notice you were the founder, nice. I'll check out the link. Semi-related: I've been wanting to give my customers the ability to write/deploy their own webhook handlers, because that's a big roadblock for those that don't have any web/server experience. Been thinking it'd be cool to embed a repl for that (with a "starter" handler per-language), to handle editing/deployment, but I haven't dug too much into that to see if it'd be possible. Been meaning to reach out to your team but I keep putting it off. Like I said, love your platform and been fun watching you grow. :)
      - amasad 8y ago
        Thanks -- Keygen looks cool too! Yeah you can embed. It's under the share dialog. More in the docs.
int0x80 8y ago
Absolutely. But is unexpected for me at least. But thinking of it, maybe you can log everything and if something bad happens you can blame the origin IP who ever that is. You can also ratelimit the outbound conections to avoid abuses etc. Is not like an open wifi where the client doesnt leave any trace at all. But in the shell account days IIRC you had to register with your name/email etc to use the service, that provided internet access. Maybe that didn't imply any safety either.
- ezekg 8y ago
  I definitely agree that it may be a better idea to put it behind a login to prevent abuse.
- amasad 8y ago
  It took us a while before opening up. We only did after building tools to handle abuse, and after hiring someone to help us monitor.
  - int0x80 8y ago
    Thanks for the info. And great product you have!