7 ms·

Could someone write a few sentences about what it is and how it works, and why it is significant? I see neither this post, the GH repo, nor its website really s

Could someone write a few sentences about what it is and how it works, and why it is significant? I see neither this post, the GH repo, nor its website really says much of anything on the subject. I only see info about why it’s being open sourced and how to set it up. If someone were to go to all that trouble, I am surprised they would stop short on just providing basic info.

slowenough 7y ago
Sure, BrowserGap is a remote browser isolation product. RBI means accessing the public internet through a browser that runs in the cloud, rather than through a browser that runs on your device. This helps protect you from attacks on the web.
- slowenough 7y ago
  And, if you're interested, read on for more detail. It works by providing a thin client over the web that you connect your regular browser to. The thin client provides an interface to a remote browser that you interact with the browser the public internet. This is significant because the internet is a cesspool of attacks. Malware, ransomware, virii, tracking, exploited PDFs, ways to deliver device zero days over the web, browser zero days. All these things can lead to the security of your device and network being compromised, causing significant inconvenience, distress and loss for you. BrowserGap and the RBI methodology acknowledges that not all threats can be detected and neutralized (such as by virus scanners), in order to face that reality, RBI adopts a "isolation" posture towards threats, effectively isolating them in the remote machine and preventing them from reaching your device. With BrowserGap, in order to render the content of a web page, the only thing we send to your device form the remote page is pixels. So no HTML, CSS, JavaScript, etc from your browsing is ever executed on your device. Cloud-based internet isolation is another name for this security practice and it is an emerging industry. Symantec recently acquired a company in this space, and Menlo Security was awarded[2] an agreement to build a CBII prototype for DISA, after a June 2018 request for RBI solutions that could eventually serve 60% of DoD's ~ 3 million users[0][1]. See more about RBI[1]. [0]: https://secureview.cloudbrowser.xyz/uploads/fileajqk.kkpgdih.pdf.html https://secureview.cloudbrowser.xyz/uploads/fileajqk.kkpgdih... [1]: https://en.wikipedia.org/wiki/Browser_isolation https://en.wikipedia.org/wiki/Browser_isolation [2]: https://www.menlosecurity.com/press-releases-blog/disa-cloud-based-internet-isolation-cbii-awarded-to-the-by-light-professional-it-services-llc-and-menlo-security-team https://www.menlosecurity.com/press-releases-blog/disa-cloud...
  - oefrha 7y ago
    Genuinely curious: who’s your customer base? I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I’m not even in the completely-disable-JS crowd) and conscious avoidance of shady sites, I managed to pretty easily stay clear of all attacks so far, at least over the past decade. Those way more paranoid than me still have the option of using local VMs/containers without too much compromise. Then the attacker really needs an exceptional exploit chain to escape all the way; it’s hard to imagine any group blowing such a valuable chain on a drive-by. So, why would anyone sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. to reduce the minuscule chance of drive-by attacks (assuming otherwise reasonable opsec)? Extremely high value targets? But then, why would extremely high value targets trust a MITM? (Self-hosting apparently changes that to some extent.) Also, even if you run your browser in the cloud, that browser could still be hacked and leak sensitive information or actively modify traffic, no? So this isn’t even bulletproof for high value targets.
    - o-__-o 7y ago
      I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there. I currently use a proxy and have instructions on how to use FoxyProxy to access each env's environment. This will provide for a much nicer UX where you simply click a link and you're brought to a virtual tab in that env. I'm sure some things will break, so the proxy is a backup, but for 90% of our work I think this is amazing! Solves any app problem where you have the same hostname per environment
      - oefrha 7y ago
        Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I fail to see why it’s hard for you to spin up (possibly gated) dev/staging instances; certainly much easier and much less resource intensive than something like this. Anyway, your use case only makes sense when the code can be self-hosted, but apparently this product / product category has customers before the source is opened up, and that’s what I’m curious about.
- xendipity 7y ago
  Wow, that's awesome! Seems like it opens a lot of powerful possibilities. I am a pretty technical person but also didn't know (and couldn't find) info on what RBI is and how it can be used - would love to see this information highlighted on GH and the website.
  - slowenough 7y ago
    Thanks, I will add that to the GitHub. What really excites me about this is the ability to deliver a secure "workflow automation" solution to people over any device.
- deleted 7y ago
  [deleted]
progval 7y ago
It's like VNC but for browsers, and usable in a browser.
- slowenough 7y ago
  Yes, that's a great way of putting it, thank you!

slowenough 7y ago

Sure, BrowserGap is a remote browser isolation product. RBI means accessing the public internet through a browser that runs in the cloud, rather than through a browser that runs on your device. This helps protect you from attacks on the web.

slowenough 7y ago
And, if you're interested, read on for more detail. It works by providing a thin client over the web that you connect your regular browser to. The thin client provides an interface to a remote browser that you interact with the browser the public internet. This is significant because the internet is a cesspool of attacks. Malware, ransomware, virii, tracking, exploited PDFs, ways to deliver device zero days over the web, browser zero days. All these things can lead to the security of your device and network being compromised, causing significant inconvenience, distress and loss for you. BrowserGap and the RBI methodology acknowledges that not all threats can be detected and neutralized (such as by virus scanners), in order to face that reality, RBI adopts a "isolation" posture towards threats, effectively isolating them in the remote machine and preventing them from reaching your device. With BrowserGap, in order to render the content of a web page, the only thing we send to your device form the remote page is pixels. So no HTML, CSS, JavaScript, etc from your browsing is ever executed on your device. Cloud-based internet isolation is another name for this security practice and it is an emerging industry. Symantec recently acquired a company in this space, and Menlo Security was awarded[2] an agreement to build a CBII prototype for DISA, after a June 2018 request for RBI solutions that could eventually serve 60% of DoD's ~ 3 million users[0][1]. See more about RBI[1]. [0]: https://secureview.cloudbrowser.xyz/uploads/fileajqk.kkpgdih.pdf.html https://secureview.cloudbrowser.xyz/uploads/fileajqk.kkpgdih... [1]: https://en.wikipedia.org/wiki/Browser_isolation https://en.wikipedia.org/wiki/Browser_isolation [2]: https://www.menlosecurity.com/press-releases-blog/disa-cloud-based-internet-isolation-cbii-awarded-to-the-by-light-professional-it-services-llc-and-menlo-security-team https://www.menlosecurity.com/press-releases-blog/disa-cloud...
- oefrha 7y ago
  Genuinely curious: who’s your customer base? I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I’m not even in the completely-disable-JS crowd) and conscious avoidance of shady sites, I managed to pretty easily stay clear of all attacks so far, at least over the past decade. Those way more paranoid than me still have the option of using local VMs/containers without too much compromise. Then the attacker really needs an exceptional exploit chain to escape all the way; it’s hard to imagine any group blowing such a valuable chain on a drive-by. So, why would anyone sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. to reduce the minuscule chance of drive-by attacks (assuming otherwise reasonable opsec)? Extremely high value targets? But then, why would extremely high value targets trust a MITM? (Self-hosting apparently changes that to some extent.) Also, even if you run your browser in the cloud, that browser could still be hacked and leak sensitive information or actively modify traffic, no? So this isn’t even bulletproof for high value targets.
  - o-__-o 7y ago
    I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there. I currently use a proxy and have instructions on how to use FoxyProxy to access each env's environment. This will provide for a much nicer UX where you simply click a link and you're brought to a virtual tab in that env. I'm sure some things will break, so the proxy is a backup, but for 90% of our work I think this is amazing! Solves any app problem where you have the same hostname per environment
    - oefrha 7y ago
      Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I fail to see why it’s hard for you to spin up (possibly gated) dev/staging instances; certainly much easier and much less resource intensive than something like this. Anyway, your use case only makes sense when the code can be self-hosted, but apparently this product / product category has customers before the source is opened up, and that’s what I’m curious about.
xendipity 7y ago
Wow, that's awesome! Seems like it opens a lot of powerful possibilities. I am a pretty technical person but also didn't know (and couldn't find) info on what RBI is and how it can be used - would love to see this information highlighted on GH and the website.
- slowenough 7y ago
  Thanks, I will add that to the GitHub. What really excites me about this is the ability to deliver a secure "workflow automation" solution to people over any device.
deleted 7y ago
[deleted]

progval 7y ago

It's like VNC but for browsers, and usable in a browser.

slowenough 7y ago
Yes, that's a great way of putting it, thank you!