9 ms·
Show HN: BrowserBox – do stuff with browsers that you can't normally
- sergiomattei 4y agoCan someone ELI5 this project?
- Mandatum 4y agoIt looks to be an implementation of "browser in a browser". Originally the project seemed to handle usually unsupported apps, like IMAP clients in the browser. I assume they have a server running, and JS libraries that act as a shim for IMAP et al control via websockets. Also appears to create usable web-based proxies for modern security-controlled websites which would break on legacy web-proxy methods. Ah, it looks like they've MuleSoft'd ViewFinderJS: https://news.ycombinator.com/item?id=28015601 https://news.ycombinator.com/item?id=28015601 Add the most requested features to a commercial offering.
- HeavyFeather 4y agoSounds like it’s VNC centered around a remote browser, that loads in your own browser. It has extra features and fewer limitations than a regular browser I suppose, but that’s what I gather.
- redareda9 4y agoYou can control a remote Chrome browser located on a remote computer (eg: VPS on the cloud) from your own Chrome browser.
- nabusman 4y agoMaybe I'm being obtuse here, but isn't that was Selenium does? How is this different?
- graderjs 4y agoNot obtuse at all! It’s actually not so easy to describe what this is and it took us a while to come up with correct language, and understanding of how to express it even after we knew what it was and had built it: it took us some time to figure out how to communicate that. To answer you: I believe these instrumentation/automation protocols/methods like Selenium/W3C WebDriver Protocol/Remote Debugger Protocol, do not themselves provide user interfaces for controlling their functions, but rather expose APIs. BrowserBox itself uses such a protocol under the hood, but also provides a user interface (that funnily enough looks like a regular browser~~because I wasn’t creative enough to invent a better set of UX interactions/affordances than those already expressed in regular web browser, heh :)). In effect, BrowserBox turns the browser experience into a client server application. And BrowserBox is to those instrumentation/automation APIs, as a front end Client is to a Web application API. That’s a slight simplification because BrowserBox contains a significant server component, however, it’s a useful way to think about it.
- _jezell_ 4y agoSounds like it's VNC that pretends to be open source but has a shady website that wants you to pay millions to use it.
- graderjs 4y agoNo, no no that’s just for the pro version. You can use this normal version fine as long as you respect that Polyform license.
- dpwm 4y agoHad to admit I came to the same conclusion when I read this part of the readme: > The NC license permits "use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding." But on reading the license, personal noncommercial use is fine too. It would have helped me if that info had been in the readme!
- creatonez 4y agoThat license is certainly not open source. Redistribution and commercial use are entirely off the table with Polyform Strict.
- graderjs 4y agoThat’s right. It’s source-available, not Open Source. I hope I make that clear in readme, it’s important.
- Dwedit 4y agoAll I want to do with a browser that I can't do normally is disable CORS. Which genius decided that a webserver on localhost was infinitely more trustworthy than a file:// url?
- supriyo-biswas 4y ago`chromium-browser --disable-web-security --user-data-dir ~/chromium-cors-disabled-profile`
- egeozcan 4y agoThis is perfectly fine for trusted sites, and I've used it a lot in the past for a few, but it disables cors for everything, and that's a bit too much. What I want is unrestricted access for my code, and that the sites keep the sandbox. What I do nowadays is start a server that has basic auth and zero cors, that I can send commands to from my scripts, like, fetch me this resource without cors, or download this to this folder, etc.
- purplecats 4y agowhat about `connect-src`
- jjeaff 4y agoI use the force-cors chrome extension. But I may be misunderstanding your use case.
- jefftk 4y agoThis goes a lot farther than disabling CORS checking: it turns off all same origin policy enforcement. So, ex, if site A opens a tab on site B (and so gets a reference to it), site A can read and modify anything on that page. Or, ads loaded in cross-origin items could read and modify anything on the containing page. It's fine for testing, but don't log into any real accounts in this profile!
- seanp2k2 4y agoEven more ridiculous is the HSTS requirement for localhost, which inspired me to share the techniques in https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost for automating a bit of the frankly ridiculous and idiotic process required to work around this. Who the heck needs a REAL SSL cert for local web dev, and why is it so hard to permanently override that?!
- redareda9 4y agoGreat! I just started using it to access some sensitive accounts (Google/Facebook Ads Platform) on Azure instances. I travel a lot so always need to isolate my accounts in Cloud instances to not get banned (for having a high-risk profile due to the high number of IP adresses). I used to access my accounts through RDP but super slow, this is making it so much smoother
- deleted 4y ago[deleted]
- 8organicbits 4y agoSince you've mentioned Facebook Ads Platform, I'm guessing you're using BrowserBox commercially. Did you have any thoughts on the pricing? A $50,000 license seems quite steep for a "faster RDP".
- redareda9 4y agoNo, will never pay that. I'm using the free version.
- quesera 4y ago> high-risk profile due to the high number of IP adresses Another solution might be to proxy your web traffic through a part of your controlled infrastructure. Also useful if the destination blocks requests unless the source is whitelisted. I use ssh port forwarding for this.
- ttul 4y agoCloudflare’s S2 browser isolation tech should get a solid nod here. S2 was a Seattle startup that figured out how to stream the DOM from a remote headless browser to the client, delivering a very smooth experience that is far superior to RDP or VNC. One of their smartest acquisitions IMHO.
- codetrotter 4y agoI am reminded also of Opera Mini back in the day. It did not stream the DOM, but they were rendering pages on their servers and then using fancy compression techniques to deliver the rendered page to your mobile phone. This was a godsend back in the bad old days of slow mobile phone internet. I am talking about the Java ME application. Not the more recent browsers they’ve made. > It was primarily designed for the Java ME platform, as a low-end sibling for Opera Mobile > […] > The functionality of the Mini mode is somewhat different from a conventional Web browser, with the amount of data which has to be transferred much reduced, but with some loss to functionality. Unlike straightforward web browsers, Opera Mini fetches all content through a proxy server, renders it using the Presto layout engine, and reformats web pages into a format more suitable for small screens. A page is compressed, then delivered to the phone in a markup language called Opera Binary Markup Language (OBML), which Opera Mini can interpret. According to Opera Software, the data compression makes transfer time about two to three times faster, and the pre-processing improves the display of web pages not designed for small screens. https://en.wikipedia.org/wiki/Opera_Mini https://en.wikipedia.org/wiki/Opera_Mini Interestingly I found that someone has written a script to convert OBML to HTML. Their intended use-case for the script is to make pages saved with Opera Mini viewable in other browsers. But to me the main interest is that I would like some day to make something similar to Opera Mini on my own, and the README of the conversion script has some technical details about OBML. > because OBML files are the output of Opera's HTML rendering engine, many elements are pixel-positioned according to the original device's screen size and font metrics. Because many J2ME devices had custom fonts (optimized for low-res screens), it's possible that your computer will show the same text as too-tall or too-wide, and lines may overlap. > […] > OBML does not have <a href=...>, i.e. you cannot actually have text that is also a link. Instead the engine outputs text and links as two separate layers – first it places the actual text at position (X,Y), then overlays it with "link" rectangles at position (X,Y,W,H). > […] > OBML does not have styled widgets the way HTML would. The style is actually pre-rendered, and those pretty 3D effects are made out of pixel-positioned lines and rectangles. Even button gradients are pre-rendered and drawn as a series of 1-pixel thin lines. https://github.com/grawity/obml-parser https://github.com/grawity/obml-parser
- jimmySixDOF 4y agoI have been following a company named Hyperbeam (mentioned in the link) and a few others that have browser in browser capabilities because here are use cases in XR where it comes in handy to access 2D web content without hitting a lot of CORS and other issues [1]. I will definitely add this to a watch list. Good luck with the project ! [1] https://forum.playcanvas.com/t/browse-the-web-in-webxr-vr-hyperbeam-playcanvas/30267 https://forum.playcanvas.com/t/browse-the-web-in-webxr-vr-hy...
- bkyan 4y agoThe readme points to individual.dosyago.com for individual pricing information, but that's not coming up for me...
- deleted 4y ago[deleted]
- nyanpasu64 4y agoDoes this allow browsing the web on the Wii's Internet Channel?
- graderjs 4y agoI'm not familiar with that, so I'll look it up. https://wiibrew.org/wiki/Internet_Channel https://wiibrew.org/wiki/Internet_Channel I mean...theoretically...if you could back-port the client to work on the old rendering engine this uses, sure. When I initially developed this in 2018, I was testing it on an iPhone 4! So, at least for a time, it was able to run on very old tech.
- js4ever 4y agoPlease check the pricing here: https://dosyago.com/ https://dosyago.com/ What are they smoking???
- graderjs 4y agoThanks for the link! What are we smoking? Smoking hot! :) ;p
- moneywoes 4y agoUse case for scraping?
- graderjs 4y agoYes, i think so. Web scraping automations often get stuck on some thing like a captcha or the page has changed and BrowserBox Pro let you attach to that running chrome automation instance, see the actual page that it got stuck on, and inspect that in remote version of dev tools (even from mobile!). This could let you quickly investigate and diagnose the issue and come up with a fix, all live. In fact, that’s how some of our customers use it.
- 8organicbits 4y agoThe README lists CloudFlare remote browsers as a similar tool, so I did a price comparison. BrowserBox looks like the more expensive option. I'm seeing $1,000 per seat with a minimum of 50 seats as the lowest tier (for commercial use) [1]. CloudFlare remote browsers is a $10/user/month add-on [2]. BB has a perpetual license, so it becomes the cheaper option if you've got >=50 users for >8 years. You'll also need to self-host BrowserBox, so there's additional cost and complexity to consider. I think a feature comparison would help show why someone should pay that premium. What does BrowserBox have that the others are missing? [1] https://dosyago.com/ https://dosyago.com/ [2] https://www.cloudflare.com/plans/zero-trust-services/ https://www.cloudflare.com/plans/zero-trust-services/ Edit: Clicking "Purchase" shows that the pricing is actually $50,000 for a pack of 50 seats, so 51 users would need 100 seats at $100,000. That's misleading.
- graderjs 4y agoCan you run S2 on your own hardware? That’s what this is for. Thanks for the pricing comparison! And the tips! I really appreciate that. I thought we made the pack of 50 seats clear! I see it’s not, thank you, we’ll fix that.
- graderjs 4y agoI was thinking about this SaaS price: 10/seat/month. I mean honestly we could run SaaS instances of Pro for a fraction of this cost, with 24/7 availability, and even less if you "amortize" it over a pool that supplies an instance on-demand.
- 8organicbits 4y agoCan you clarify the license history? It looks like this is formerly Open Source, but now uses a commercial license. I'm not a lawyer, but anyone who prefers Open Source software may be able to fork the software at an earlier commit under the earlier terms. Why so many license changes? Given the $1000 per seat license cost, I'm not sure this is a great look. BSD: https://github.com/dosyago/BrowserBox/commit/a7a40268effd03d145c742618670ba9b62452b93 https://github.com/dosyago/BrowserBox/commit/a7a40268effd03d... GPL: https://github.com/dosyago/BrowserBox/commit/1ef76981774d95e3d98067770d015bb12f8b03b3 https://github.com/dosyago/BrowserBox/commit/1ef76981774d95e... Commercial: https://github.com/dosyago/BrowserBox/commit/fe88bf64b38a311dbf0d603a8abf7f9254a71a53 https://github.com/dosyago/BrowserBox/commit/fe88bf64b38a311... MIT: https://github.com/dosyago/BrowserBox/commit/c29af3f523a4d1cb4fe3925a3aa48073a637416d https://github.com/dosyago/BrowserBox/commit/c29af3f523a4d1c... Commercial: https://github.com/dosyago/BrowserBox/commit/1ddc800fd230c018c08fbcdb59726427cd5e36e4 https://github.com/dosyago/BrowserBox/commit/1ddc800fd230c01... AGPL: https://github.com/dosyago/BrowserBox/commit/6060cdd29c576d3eeac18f2de05e80e6d73b15a1 https://github.com/dosyago/BrowserBox/commit/6060cdd29c576d3...
- graderjs 4y ago> … formerly OSS … Mm, that’s correct. > … I’m not a lawyer … I’m not sure if they can, but i would prevent that if i could. > … why license changes… Ha, you may be right! I don’t know. I guess I was just duped about the other licenses and the types of protections they can offer. I wasn’t informed and, I don’t know, I guess I was just trying to figure out a business model.
- endigma 4y agoProbably should have licensed it properly from the get-go then, they can and probably will just use old commits.
- graderjs 4y agoThanks for checking out our project, you're welcome! > Probably should have licensed it properly from the get-go then Haha yeah! > they can and probably will just use old commits I don’t know, maybe. some people might. there’s always gonna be some software piracy. Are you a lawyer?