4 ms·

Show HN: Free open-source isolated browser for security

71 points by graderjs 6y ago

mattowen_uk 6y ago
Typo in the readme: clientless, opne-source dual-licensed
- graderjs 6y ago
  Thank you
tmikaeld 6y ago
I don't get the licensing fees, at 1069$/year per user you could put each user on a powerful VM with GPU instead. And I'm not talking under-powered VM, I mean 8-CORE, 48GB RAM, 400GB NVME SSD, 2Gbit connection, NVIDIA Tesla V100 16 GB... [0] Pricing makes no sense! [0] https://www.ovhcloud.com/en/public-cloud/prices/#397 https://www.ovhcloud.com/en/public-cloud/prices/#397
- graderjs 6y ago
  Sorry the pricing needs revision.
  - tmikaeld 6y ago
    Here's some guide-lines, under 17$/mo (350$/mo, 50 users). Then you'll be able to compete with Cloudflares Browser Isolation feature. https://www.cloudflare.com/teams/browser-isolation/ https://www.cloudflare.com/teams/browser-isolation/
    - deleted 6y ago
      [deleted]
- tentacleuno 6y ago
  The pricing is pretty ridiculous from what I've just seen. That's a lot of money when you can just put it on metal yourself.
  - graderjs 6y ago
    I agree. It needs to be revised. Thanks! ;p ;) xx
tuxie_ 6y ago
I think the README could do with some use cases too, it's difficult for me to figure out when I would need to embed a browser in a browser, let alone pay for it.
- graderjs 6y ago
  Yeah, that's fair. I don't know how to market it. People encourage me into the security space, or the co-browsing space. People have also asked about process integration, where you want to include a 3rd party process as part of your app's flow without leaving the main app.
  - capableweb 6y ago
    Before you figure out how to market it, you need to figure out who your user is (in other words: "who to market it to"). Seems right now you're not quite sure, maybe "security" or maybe "co-browsing", but if you want your marketing to be really effective, you need to know exactly who your message is suppose to resonate with, and then you can figure out the right message to market.
    - graderjs 6y ago
      Thank you. I don't know. I'll have to figure it out. I'm taking a break from coding on this from now, to spend some time on marketing. I have this piece of tech, and not much idea who to sell to, or how to reach out to them. So far the only success I've had is with people reaching out to me. "Blind luck" in bound ;p:) xx
petethepig 6y ago
Is this open source Mighty?
- graderjs 6y ago
  Hahaha. NO mate, but good marketing copy (thanks for the idea;)). I believe Mighty works mighty different. They have a focus on crystal clear ultra fast video streaming of the viewport (I'm not sure of their setup, but I've seen suhail tweet about GPUs and one tweet of an image of a "MPEG compression textbook"). I've considered experimenting with ffmpeg as well, but I'm satisfied with my current solution's usability and responsiveness, and low lag over a range of bandwidths, which I prioritize over high framerate, and for what I originally wanted it for a high frame rate didn't matter. People have often commented that the frame rate is too low, or they would like me to make them a "co-browsing / remote browser video streaming" system to stream videos or watch them together. I just think doing streaming really well at high volume is both incredibly expensive and very difficult. I do this alone and I'm coming to the end of my (very gratefully received) GCP "cloud for startups" free credits, so "I have no plans to announce at this time" about doing ffmpeg or not :)
  - tentacleuno 6y ago
    Just going to point out the obvious and say a co-watch remote browser definitely wouldn't work with Netflix. I love the confusion on people's faces when they try to do it over Zoom ("Why is the video black?"). Yay Widevine?
    - graderjs 6y ago
      This is cool! Thanks for bringing that to my attention. I didn't know that and had never tried netflix until your comment just now. First I tried with Firefox, then with Chrome UAs, and tried importing a libwidevine.so. Nothing works, and Netflix says the error is a missing CDM component. I suppose that's better that it doesn't work. I don't think Netflix / Spotify would be cool with that. It's a little disappointing to not me able to test out Netflix on this, but less risky :P ;) xx
    - 6y ago
stinos 6y ago
not related to the product itself, but what's with the quotes around the commit messages? (well, if "OK" can be named a 'message':) Does this come from some weird shell which doesn't strip quotes from git commit -m "OK" or so? A script which incorrectly double-quotes?
- graderjs 6y ago
  Correct on both counts. Somehow I know where I'm up to and I work on this alone so only for very important milestones or fixes do I include details. Normally, I'm just "saving my work". My custom script[0] is: set +e; message="$1" git submodule foreach --recursive 'gut "'"$message"'" || :' git add .; git commit -m '"'"$message"'"'; git pull; git push; set -e; and my goto "save work" command like is `$ gut OK` :) perhaps you can help me fix that script so I can use multiword commit messages without the quotes??? :) ;p xx [0]: https://github.com/i5ik/environments/blob/master/commands/gut https://github.com/i5ik/environments/blob/master/commands/gu...
  - stinos 6y ago
    Not really an experienced bash user, but just dropping the extra quotes would work? message="$1" git commit -m "$message" You'll have to pass the words in quotes though. Which I'd prefer because it's the common way. Otherwise you'd use message="$@"
    - graderjs 6y ago
      Cool thanks! :)
pgo 6y ago
So under the hood it's chromium headless and you are streaming screenshots back using an extension Curious why not run normal chromium and vnc the whole screen back using a web client such as novnc, would have solved most of your "Normal Browser UI things not yet implemented"
- graderjs 6y ago
  Not an extension. Just your browser, no download needed. So a "clientless" remote isolated browser. it runs headless Chrome, yes (but eventually I want to repurpose it to support other browsers that can be driven by DevTools/WebDriver protocol). Short answer is because a lot of the work of this was building a custom "head", so having a browser engine without a head made sense. Slightly more detailed answer below... :) ;p xx I might experiment with xvfb chrome and vnc in future. Other people certainly have success with this, e.g Reflect (YC S20)[0]. Maybe I got here accidentally. Original purpose was for mapping web app structure, and recording and replaying of web action sequences (automation) from any device. As most of the time the browsers were going to replay without anyone using them having xvfb seemed unnecessary. And doing the mapping and recording in one platform (real chrome + xvfb) then replaying in another I thought would risk many unnecessary, difficult bugs. Also having my own wire protocol based on DevTools, rather than use what a VNC web client uses, I believed would assist in more reproducible recordings and playback for automation. Also I liked the flexibility and control provided by headless+devtools to change the UI, easily work on mobile, custom handlers for tasks like file upload and other modals, as well as the control over the viewport streaming. On streaming, I experimented a lot to get something working across a range of bandwidths, and settled on: a per-frame ack (to avoid congestion), frames over webrtc or binary werbsocket channels, and periodically switching to whichever of webrtc of websocket is faster. I also want it to be really scalable. And I thought that headless+devtools would be much less resource heavy than chrome+xvfb, but I have no hard data on that and can't find any. Plus I just liked the challenge. Plugging in Chrome+xvfb+VNC just seemed too easy, and I wanted something "meatier" (apologies to vegetarians, I'm on my way there, 'Proteinier'?) I could dig my hands into :) [0]: https://news.ycombinator.com/item?id=23897626 https://news.ycombinator.com/item?id=23897626
  - 6y ago
fsflover 6y ago
I prefer virtualization of Qubes OS. It allows to use any browsers and even has Whonix working out of the box.
Tijdreiziger 6y ago
Reminds me of Browservice: https://github.com/ttalvitie/browservice/ https://github.com/ttalvitie/browservice/ (which I discovered via Michael MJD's YouTube channel: https://www.youtube.com/watch?v=5MjZdKtv9ak https://www.youtube.com/watch?v=5MjZdKtv9ak)
- graderjs 6y ago
  Thanks for the link! :) Ah, yeah, this was very cool. I remember seeing it a while back.

71 points by graderjs 6y ago

mattowen_uk 6y ago

Typo in the readme: clientless, opne-source dual-licensed

graderjs 6y ago
Thank you

tmikaeld 6y ago

I don't get the licensing fees, at 1069$/year per user you could put each user on a powerful VM with GPU instead. And I'm not talking under-powered VM, I mean 8-CORE, 48GB RAM, 400GB NVME SSD, 2Gbit connection, NVIDIA Tesla V100 16 GB... [0] Pricing makes no sense! [0] https://www.ovhcloud.com/en/public-cloud/prices/#397 https://www.ovhcloud.com/en/public-cloud/prices/#397

graderjs 6y ago
Sorry the pricing needs revision.
- tmikaeld 6y ago
  Here's some guide-lines, under 17$/mo (350$/mo, 50 users). Then you'll be able to compete with Cloudflares Browser Isolation feature. https://www.cloudflare.com/teams/browser-isolation/ https://www.cloudflare.com/teams/browser-isolation/
  - deleted 6y ago
    [deleted]
tentacleuno 6y ago
The pricing is pretty ridiculous from what I've just seen. That's a lot of money when you can just put it on metal yourself.
- graderjs 6y ago
  I agree. It needs to be revised. Thanks! ;p ;) xx

tuxie_ 6y ago

I think the README could do with some use cases too, it's difficult for me to figure out when I would need to embed a browser in a browser, let alone pay for it.

graderjs 6y ago
Yeah, that's fair. I don't know how to market it. People encourage me into the security space, or the co-browsing space. People have also asked about process integration, where you want to include a 3rd party process as part of your app's flow without leaving the main app.
- capableweb 6y ago
  Before you figure out how to market it, you need to figure out who your user is (in other words: "who to market it to"). Seems right now you're not quite sure, maybe "security" or maybe "co-browsing", but if you want your marketing to be really effective, you need to know exactly who your message is suppose to resonate with, and then you can figure out the right message to market.
  - graderjs 6y ago
    Thank you. I don't know. I'll have to figure it out. I'm taking a break from coding on this from now, to spend some time on marketing. I have this piece of tech, and not much idea who to sell to, or how to reach out to them. So far the only success I've had is with people reaching out to me. "Blind luck" in bound ;p:) xx

petethepig 6y ago

Is this open source Mighty?

graderjs 6y ago
Hahaha. NO mate, but good marketing copy (thanks for the idea;)). I believe Mighty works mighty different. They have a focus on crystal clear ultra fast video streaming of the viewport (I'm not sure of their setup, but I've seen suhail tweet about GPUs and one tweet of an image of a "MPEG compression textbook"). I've considered experimenting with ffmpeg as well, but I'm satisfied with my current solution's usability and responsiveness, and low lag over a range of bandwidths, which I prioritize over high framerate, and for what I originally wanted it for a high frame rate didn't matter. People have often commented that the frame rate is too low, or they would like me to make them a "co-browsing / remote browser video streaming" system to stream videos or watch them together. I just think doing streaming really well at high volume is both incredibly expensive and very difficult. I do this alone and I'm coming to the end of my (very gratefully received) GCP "cloud for startups" free credits, so "I have no plans to announce at this time" about doing ffmpeg or not :)
- tentacleuno 6y ago
  Just going to point out the obvious and say a co-watch remote browser definitely wouldn't work with Netflix. I love the confusion on people's faces when they try to do it over Zoom ("Why is the video black?"). Yay Widevine?
  - graderjs 6y ago
    This is cool! Thanks for bringing that to my attention. I didn't know that and had never tried netflix until your comment just now. First I tried with Firefox, then with Chrome UAs, and tried importing a libwidevine.so. Nothing works, and Netflix says the error is a missing CDM component. I suppose that's better that it doesn't work. I don't think Netflix / Spotify would be cool with that. It's a little disappointing to not me able to test out Netflix on this, but less risky :P ;) xx
  - 6y ago

stinos 6y ago

not related to the product itself, but what's with the quotes around the commit messages? (well, if "OK" can be named a 'message':) Does this come from some weird shell which doesn't strip quotes from git commit -m "OK" or so? A script which incorrectly double-quotes?

graderjs 6y ago
Correct on both counts. Somehow I know where I'm up to and I work on this alone so only for very important milestones or fixes do I include details. Normally, I'm just "saving my work". My custom script[0] is: set +e; message="$1" git submodule foreach --recursive 'gut "'"$message"'" || :' git add .; git commit -m '"'"$message"'"'; git pull; git push; set -e; and my goto "save work" command like is `$ gut OK` :) perhaps you can help me fix that script so I can use multiword commit messages without the quotes??? :) ;p xx [0]: https://github.com/i5ik/environments/blob/master/commands/gut https://github.com/i5ik/environments/blob/master/commands/gu...
- stinos 6y ago
  Not really an experienced bash user, but just dropping the extra quotes would work? message="$1" git commit -m "$message" You'll have to pass the words in quotes though. Which I'd prefer because it's the common way. Otherwise you'd use message="$@"
  - graderjs 6y ago
    Cool thanks! :)

pgo 6y ago

So under the hood it's chromium headless and you are streaming screenshots back using an extension Curious why not run normal chromium and vnc the whole screen back using a web client such as novnc, would have solved most of your "Normal Browser UI things not yet implemented"

graderjs 6y ago
Not an extension. Just your browser, no download needed. So a "clientless" remote isolated browser. it runs headless Chrome, yes (but eventually I want to repurpose it to support other browsers that can be driven by DevTools/WebDriver protocol). Short answer is because a lot of the work of this was building a custom "head", so having a browser engine without a head made sense. Slightly more detailed answer below... :) ;p xx I might experiment with xvfb chrome and vnc in future. Other people certainly have success with this, e.g Reflect (YC S20)[0]. Maybe I got here accidentally. Original purpose was for mapping web app structure, and recording and replaying of web action sequences (automation) from any device. As most of the time the browsers were going to replay without anyone using them having xvfb seemed unnecessary. And doing the mapping and recording in one platform (real chrome + xvfb) then replaying in another I thought would risk many unnecessary, difficult bugs. Also having my own wire protocol based on DevTools, rather than use what a VNC web client uses, I believed would assist in more reproducible recordings and playback for automation. Also I liked the flexibility and control provided by headless+devtools to change the UI, easily work on mobile, custom handlers for tasks like file upload and other modals, as well as the control over the viewport streaming. On streaming, I experimented a lot to get something working across a range of bandwidths, and settled on: a per-frame ack (to avoid congestion), frames over webrtc or binary werbsocket channels, and periodically switching to whichever of webrtc of websocket is faster. I also want it to be really scalable. And I thought that headless+devtools would be much less resource heavy than chrome+xvfb, but I have no hard data on that and can't find any. Plus I just liked the challenge. Plugging in Chrome+xvfb+VNC just seemed too easy, and I wanted something "meatier" (apologies to vegetarians, I'm on my way there, 'Proteinier'?) I could dig my hands into :) [0]: https://news.ycombinator.com/item?id=23897626 https://news.ycombinator.com/item?id=23897626
- 6y ago

fsflover 6y ago

I prefer virtualization of Qubes OS. It allows to use any browsers and even has Whonix working out of the box.

Tijdreiziger 6y ago

Reminds me of Browservice: https://github.com/ttalvitie/browservice/ https://github.com/ttalvitie/browservice/ (which I discovered via Michael MJD's YouTube channel: https://www.youtube.com/watch?v=5MjZdKtv9ak https://www.youtube.com/watch?v=5MjZdKtv9ak)

graderjs 6y ago
Thanks for the link! :) Ah, yeah, this was very cool. I remember seeing it a while back.