3 ms·

I appreciate this argument. I had not thought much about self-hosting with a couple of shell scripts. If I think back to when I built this, I think I did it bec

I appreciate this argument. I had not thought much about self-hosting with a couple of shell scripts. If I think back to when I built this, I think I did it because I wanted that, but I could not find a way to do it. In your solution, how would you stream the browser view to the client? Could you support mobile clients? Would they need to download special software? Also, it might be easier and faster, but that sometimes comes as a trade-off with security. It's far easier and faster to just use a regular consumer browser on your device, but you get those risks. Personally, I would feel a large amount of risk running a local VM versus a cloud hosted one. A local VM (sans Tor, sans proxy) would expose my IP, which could still be targeted. The VM could be escaped, I think more readily than a cloud machine. At the same time, I do think that a local isolated server would be a great option if you want to self-host, rather than doing that in the cloud. This is definitely something BrowserGap does.

theamk 7y ago
"kvm" is just a command-line virtualization tool (think Parallels or VMWare Player or Virtualbox). So: - I would not "stream the browser view to client", I'd use default display driver for the virtual machine (I think kvm uses SDL by default). kvm also provides VNC interface, if you want to run it remotely, but running it remotely will increase the latency. - It does not support any clients, including mobile ones. You are not running a client/server setup, you are running virtual machine directly on your desktop/laptop. - Yes, you need to download special software. This is a local-only solution. IP exposure is a real risk, but I'd say it is a privacy risk, not a security one. There are scanners scanning IP address space non-stop; if your computer is vulnerable to IP-only attacks, it would be hacked even if you do not go to any websites at all. VM escaping is a thing, but the cloud machine runs a VM as well, and it can be escaped too -- and then user's computer will be attacked via remote screen connection. So: If one has 2 exploits: browser escape zero-day + VM-escape zero day, they can attack either via Cloud machine or via local VM. But Cloud machine has an additional attack vector: if the infrastructure itself is compromised, then you instantly lose all secrecy, and open client computers to remote exploits. And while you can ensure that your laptop is safe and updated on time, you don't really know much about cloud. That said, I think both of those are pretty unlikely, so the final decision should be based on other factors.

theamk 7y ago

"kvm" is just a command-line virtualization tool (think Parallels or VMWare Player or Virtualbox). So: - I would not "stream the browser view to client", I'd use default display driver for the virtual machine (I think kvm uses SDL by default). kvm also provides VNC interface, if you want to run it remotely, but running it remotely will increase the latency. - It does not support any clients, including mobile ones. You are not running a client/server setup, you are running virtual machine directly on your desktop/laptop. - Yes, you need to download special software. This is a local-only solution. IP exposure is a real risk, but I'd say it is a privacy risk, not a security one. There are scanners scanning IP address space non-stop; if your computer is vulnerable to IP-only attacks, it would be hacked even if you do not go to any websites at all. VM escaping is a thing, but the cloud machine runs a VM as well, and it can be escaped too -- and then user's computer will be attacked via remote screen connection. So: If one has 2 exploits: browser escape zero-day + VM-escape zero day, they can attack either via Cloud machine or via local VM. But Cloud machine has an additional attack vector: if the infrastructure itself is compromised, then you instantly lose all secrecy, and open client computers to remote exploits. And while you can ensure that your laptop is safe and updated on time, you don't really know much about cloud. That said, I think both of those are pretty unlikely, so the final decision should be based on other factors.