4 ms·
Hey, author of bore here! I've been summoned by my friend who saw this on the front page of HN. Thanks for posting. Happy to answer any questions, though the R
by ekzhang 5y ago
Hey, author of bore here! I've been summoned by my friend who saw this on the front page of HN. Thanks for posting.
Happy to answer any questions, though the README has most of the technical details already. Quick FAQ:
--
Q: What inspired this?
A: I wanted to make a really simple CLI tool for forwarding local TCP ports. No TLS termination or any other features. Localtunnel is unmaintained, slow, and requires Node.js. Ngrok v2 is proprietary, while Ngrok v1 is unmaintained, leaks memory, and is complicated to set up (requires wildcard certificates...). Why can't we just write a simple, minimal binary that does this? And focus on user experience (good error messages, clean code, systems correctness). That's the goal.
--
Q: Why Rust?
A: Because Rust gives you a lot of things: tracking lifetimes of variables statically, very fast code execution, data-race freedom guaranteed by the compiler, documentation, unit testing, simple binary distribution in the form of `cargo install`, and a strong focus on correctness. Tokio is also a _really_ great asynchronous runtime for writing network services.
--
Q: Why release a public server?
A: Mostly because I want it to be as easy as possible to try and access Bore, even if you don't have access or the technical means to run an instance in the cloud yourself. That said, "bore.pub" is not hard-coded anywhere inside the source code. The CLI usage examples explicitly pass in a mandatory `--to bore.pub` option to make sure that this software is not tied to any particular server instance. And an explicit goal of bore is to be easy to self-host, just run a single command (it's `bore server`) and you're all set.
--
Q: How much does this cost you?
A: I'm running the public server (bore.pub) on a $6/mo DigitalOcean droplet right now, the smallest size on shared vCPU. I just checked my dashboard, and it's only using 2% CPU at the moment. Will upgrade if I need to, but I don't expect the public server to incur significant fees unless bore gets _really_ popular.
--
Q: Is there potential for abuse?
A: I don't believe there's much potential for abuse here, in terms of distributing illegal content. If you wanted to do that, you could just set up port forwarding on your router and have people connect directly. Also, bore.pub doesn't guarantee you a stable TCP port to share with people; it's intended as a developer tool. So the risk seems fairly low.
--
Q: How can I help with this?
A: You can star the repository, share it with your friends, try using bore, and give any feedback on the issues page. Any help with packaging in software repositories or CI/CD binary builds would always be appreciated as well! Right now the only installation option is from source, using `cargo install bore-cli`. Finally, feel free to follow me on Twitter (https://twitter.com/ekzhang1 https://twitter.com/ekzhang1) where I've been posting some updates on this work.
--
Q: How can I learn more?
A: Read the source code — it's literally 400 lines of Rust, super short if you have an hour or so this afternoon. :)
- dspillett 5y agoAre there planned advantages to this over what can be done with “ssh -g -R”? ngrok for instance can be used record and replay (potentially modified) API calls. > I don't believe there's much potential for abuse here, in terms of distributing illegal content. I think you are quite wrong there. Any public resource can and will be abused. > If you wanted to do that, you could just set up port forwarding on your router That will be easily traced back to the the distributor of the content. By using you as a relay the authorities will hit you first. If you keep accurate logs then you can send them onto the next step (which may well be another open proxy) but you'll have some explaining to do. Also, if it causes any trouble for your service provider they may kick your account first and ask questions later, especially if the content is something insidious like CP. In any case check your service provider's ToS - they may explicitly disallow running open proxy services.
- ekzhang 5y agoThanks for the words of warning! I’ll keep a lookout for malicious uses, especially now that it’s gotten a bit of attention on HN, which was not planned. Feel free to let me know if you see something suspicious, as well.
- reflexe 5y agoGreat job! By the way, the term "bore" (בור) in hebrew means 'pit' :)
- ekzhang 5y agoThanks! That’s great. I was inspired by other commands like “dig” :)
- encryptluks2 5y ago> I'm running the public server (bore.pub) on a $6/mo DigitalOcean droplet right now, the smallest size on shared vCPU. Does this not tunnel traffic. What is your plan once you go over the bandwidth allowance? It seems like you are probably in for some unexpected surprises very soon.