3 ms·

Genuinely curious: who’s your customer base? I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I’m not even in the

by oefrha 7y ago

Genuinely curious: who’s your customer base? I mean, in theory the web is a cesspool of malware, but with reasonably good content blocking (I’m not even in the completely-disable-JS crowd) and conscious avoidance of shady sites, I managed to pretty easily stay clear of all attacks so far, at least over the past decade. Those way more paranoid than me still have the option of using local VMs/containers without too much compromise. Then the attacker really needs an exceptional exploit chain to escape all the way; it’s hard to imagine any group blowing such a valuable chain on a drive-by. So, why would anyone sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. to reduce the minuscule chance of drive-by attacks (assuming otherwise reasonable opsec)? Extremely high value targets? But then, why would extremely high value targets trust a MITM? (Self-hosting apparently changes that to some extent.) Also, even if you run your browser in the cloud, that browser could still be hacked and leak sensitive information or actively modify traffic, no? So this isn’t even bulletproof for high value targets.

o-__-o 7y ago
I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there. I currently use a proxy and have instructions on how to use FoxyProxy to access each env's environment. This will provide for a much nicer UX where you simply click a link and you're brought to a virtual tab in that env. I'm sure some things will break, so the proxy is a backup, but for 90% of our work I think this is amazing! Solves any app problem where you have the same hostname per environment
- oefrha 7y ago
  Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I fail to see why it’s hard for you to spin up (possibly gated) dev/staging instances; certainly much easier and much less resource intensive than something like this. Anyway, your use case only makes sense when the code can be self-hosted, but apparently this product / product category has customers before the source is opened up, and that’s what I’m curious about.
  - slowenough 7y ago
    > genifnly curious: who's your customer base? Customer base is people and organizations who are having problems with malware and cyber attacks. > Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. > it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I totally agree the image quality can be much improved. So I'm really sorry you had this experience today trying it out! Would you be unwilling to mail me cris@dosycorp.com and I can contact you if and when I have image improvements to share? Initially, I used JPEG for all clients, then for clients with browsers that support WebP (chrome) I switch on WebP since the quality increase is a LOT (but WebP in FF looks pixelated, so I hope I can find a way around that), even tho the bandwidth is the same. For Safari and iOS the quality is on JPEG. It sounds like it has sacrificed the ability ot interact with text, resolution, color accuracy and frame rate, etc. I'm really sorry about this. Some people seem okay to roll RBI out in a test deployment, without the code being open-sourced. I can't speak directly for them, but I assume that Symantec (who bought FireGlass Browser), Menlo, WEBGAP, Light Point, Ericom, Authentic8, Citrix all have some customers even tho they are not OSS. I think that, often, as long as the contract provides the ability to examine the code if required (due diligence) even without publishing it openly, sales happen. It sounds like you're unfamiliar with RBI, is that right? This is still an emerging industry so it makes sense to me that even if you are in security you are unfamiliar with RBI.
    - oefrha 7y ago
      Appreciate the detailed response. Over the past few years I've seen a couple of similar remote browser services and was curious who actually need it, glad you shared firsthand knowledge. Now I can see that while this would probably be an overkill security-conscious individuals, it might make sense for organizations because there are always employees who can be easily tricked into clicking anything. I do wonder whether it's more effective and productive to instead enforce host-based blocking + browser-level content blocking + lightweight virtualization (like Windows Sandbox? Not sure how well it works since I'm a Mac user for the most part), but I'm in no position to evaluate for organizations. Having checked Symantec's website, they seem to advocate falling back to a remote browser when the site is potentially risky, which sounds reasonable. > then for clients with browsers that support WebP (chrome) I switch on WebP since the quality increase is a LOT Yeah, I first tried the service on my iPad Pro, image quality was terrible. I have since tried it again in desktop Chrome and it's definitely passable. That's unfortunate. Anyway, I'm probably not in the target market, but best of luck to your business.
- slowenough 7y ago
  Thank you for this use-case! Would you like to email me cris@dosycorp.com and we can discuss something tailored towards this? :) I'd be really happy to help you.
slowenough 7y ago
Thanks for this feedback, you make some great points which I really appreciate you taking the time to make. And your experience of being malware free is mostly my experience as well. It sounds like with reasonably good content blocking a person can avoid all attacks, and it looks like using local VMs/containers mean then the attack needs an exceptional exploit chain to escape all the way, and it's hard to imagine any target being caught in a drive-by. I agree. Also, internet-based attacks are a real problem for many businesses and organizations. For example, in 2016 Singapore government mandated that RBI had to be used because of ongoing attacks.[0] How can it both be true that most people avoid any attacks whatsoever (and therefore that most simple measures are sufficient) while at the same time, malware is a real industry inflicting real damage on organizations? I think of malware as an "industry" and as a collection "criminal enterprises" and from that viewpoint the malware industry has certain goals and markets it seeks to penetrate. If you don't find yourself in one of those target groups, that's a good thing. If you do, then you probably are already exploring RBI or CBII to some extent. So your logic is correct and it looks like you are simply not in the target group. At the same time, I think categorizing the only victim of web-based malware that can benefit from RBI/CBII as "extremely high value targets" is misleading. Perhaps the finance department in a Fortune 500 company is an "EHVT", but there's a lot of web-based attacks that succeed at targeting businesses and organization units of many different sorts, and the costs inflicted are significant and important, not just to "EHVTs". Your concern about trust and the cloud is valid, and perceptive, as is the solution you propose (self-hosting). Self-hosting is indeed the right choice for many. That's one reason I think OSS has a role to play in RBI/CBII. [0]: https://secureview.cloudbrowser.xyz/uploads/file1uod.8tyb6vb.pdf.html https://secureview.cloudbrowser.xyz/uploads/file1uod.8tyb6vb...
infokiller 7y ago
Even if the security is not significantly enhanced over a content blocker, tracking using JS will be much harder (assuming the cloud device is randomized in some way).

by oefrha 7y ago

o-__-o 7y ago

I'll tell you the value of this software. I can build software for non prod environments and allow my developers/testers access. for instance, with wordpress, domains are hardcoded into the database leaving you with risky sed commands against mysqldumps. With this I can launch wordpress into its own environment where www.foobar.com resolves but I can run all dev code there. I currently use a proxy and have instructions on how to use FoxyProxy to access each env's environment. This will provide for a much nicer UX where you simply click a link and you're brought to a virtual tab in that env. I'm sure some things will break, so the proxy is a backup, but for 90% of our work I think this is amazing! Solves any app problem where you have the same hostname per environment

oefrha 7y ago
Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I fail to see why it’s hard for you to spin up (possibly gated) dev/staging instances; certainly much easier and much less resource intensive than something like this. Anyway, your use case only makes sense when the code can be self-hosted, but apparently this product / product category has customers before the source is opened up, and that’s what I’m curious about.
- slowenough 7y ago
  > genifnly curious: who's your customer base? Customer base is people and organizations who are having problems with malware and cyber attacks. > Have you tried using this? When I said > sacrifice the ability to interact with text, resolution, color accuracy, frame rate, etc. > it’s very much an understatement... Pretty sure your devs/testers won’t appreciate the experience. Frontend devs in particular can’t possibly work with this. I totally agree the image quality can be much improved. So I'm really sorry you had this experience today trying it out! Would you be unwilling to mail me cris@dosycorp.com and I can contact you if and when I have image improvements to share? Initially, I used JPEG for all clients, then for clients with browsers that support WebP (chrome) I switch on WebP since the quality increase is a LOT (but WebP in FF looks pixelated, so I hope I can find a way around that), even tho the bandwidth is the same. For Safari and iOS the quality is on JPEG. It sounds like it has sacrificed the ability ot interact with text, resolution, color accuracy and frame rate, etc. I'm really sorry about this. Some people seem okay to roll RBI out in a test deployment, without the code being open-sourced. I can't speak directly for them, but I assume that Symantec (who bought FireGlass Browser), Menlo, WEBGAP, Light Point, Ericom, Authentic8, Citrix all have some customers even tho they are not OSS. I think that, often, as long as the contract provides the ability to examine the code if required (due diligence) even without publishing it openly, sales happen. It sounds like you're unfamiliar with RBI, is that right? This is still an emerging industry so it makes sense to me that even if you are in security you are unfamiliar with RBI.
  - oefrha 7y ago
    Appreciate the detailed response. Over the past few years I've seen a couple of similar remote browser services and was curious who actually need it, glad you shared firsthand knowledge. Now I can see that while this would probably be an overkill security-conscious individuals, it might make sense for organizations because there are always employees who can be easily tricked into clicking anything. I do wonder whether it's more effective and productive to instead enforce host-based blocking + browser-level content blocking + lightweight virtualization (like Windows Sandbox? Not sure how well it works since I'm a Mac user for the most part), but I'm in no position to evaluate for organizations. Having checked Symantec's website, they seem to advocate falling back to a remote browser when the site is potentially risky, which sounds reasonable. > then for clients with browsers that support WebP (chrome) I switch on WebP since the quality increase is a LOT Yeah, I first tried the service on my iPad Pro, image quality was terrible. I have since tried it again in desktop Chrome and it's definitely passable. That's unfortunate. Anyway, I'm probably not in the target market, but best of luck to your business.
slowenough 7y ago
Thank you for this use-case! Would you like to email me cris@dosycorp.com and we can discuss something tailored towards this? :) I'd be really happy to help you.

slowenough 7y ago

Thanks for this feedback, you make some great points which I really appreciate you taking the time to make. And your experience of being malware free is mostly my experience as well. It sounds like with reasonably good content blocking a person can avoid all attacks, and it looks like using local VMs/containers mean then the attack needs an exceptional exploit chain to escape all the way, and it's hard to imagine any target being caught in a drive-by. I agree. Also, internet-based attacks are a real problem for many businesses and organizations. For example, in 2016 Singapore government mandated that RBI had to be used because of ongoing attacks.[0] How can it both be true that most people avoid any attacks whatsoever (and therefore that most simple measures are sufficient) while at the same time, malware is a real industry inflicting real damage on organizations? I think of malware as an "industry" and as a collection "criminal enterprises" and from that viewpoint the malware industry has certain goals and markets it seeks to penetrate. If you don't find yourself in one of those target groups, that's a good thing. If you do, then you probably are already exploring RBI or CBII to some extent. So your logic is correct and it looks like you are simply not in the target group. At the same time, I think categorizing the only victim of web-based malware that can benefit from RBI/CBII as "extremely high value targets" is misleading. Perhaps the finance department in a Fortune 500 company is an "EHVT", but there's a lot of web-based attacks that succeed at targeting businesses and organization units of many different sorts, and the costs inflicted are significant and important, not just to "EHVTs". Your concern about trust and the cloud is valid, and perceptive, as is the solution you propose (self-hosting). Self-hosting is indeed the right choice for many. That's one reason I think OSS has a role to play in RBI/CBII. [0]: https://secureview.cloudbrowser.xyz/uploads/file1uod.8tyb6vb.pdf.html https://secureview.cloudbrowser.xyz/uploads/file1uod.8tyb6vb...

infokiller 7y ago

Even if the security is not significantly enhanced over a content blocker, tracking using JS will be much harder (assuming the cloud device is randomized in some way).