4 ms·
Great news, and very good work, thanks for sharing. One thing that I am concerned about (or have questions about), is how would you make sure you are not expos
by alimoeeny 12y ago
Great news, and very good work, thanks for sharing.
One thing that I am concerned about (or have questions about), is how would you make sure you are not exposing the service to outside, so that when the laptop is on a coffee shop network others can query the credentials?
I mean, it often happens that a developer needs to expose a webserver they are running to outside to showcase something or demo or .... It is not very hard to make a mistake and expose everything right?
- frugalfirbolg 12y agoHmm, judging from the source code the default listenAddress is on '0.0.0.0:3100' so it's listening on every interface, but it's instantiated to use TLS and in server.go HandleServerRequest does SSH authentication. This service is separate from whatever the developer is working on that needs to call to it. If the work in progress exposes temporary credentials it's not the end of the world.
- earless1 12y agoOn the Ec2 side security groups can be used to only allow access for the company IP. Then VPN can be used to secure connections from coffee houses back the the office.
- silversupreme 12y agoThat's what we do at AdRoll, and it seems to work pretty well for us. :)
- epall 12y agoThe hologram server is privileged and should run behind a firewall. It will only hand out keys to successfully authenticated (using an SSH challenge-response) clients, so it could be publicly accessible, but why go to that risk? The hologram agent that runs on your laptop, and could potentially be exposed in a cafe, attaches to lo0, so there's no way somebody on your coffee shop wifi could get the creds.