On 31/01/13 20:23, Angus Thomas wrote:
This is a problem which I've been thinking about in the context
of
Winged Monkey, but it is more generally applicable.
We want Winged Monkey to be available on people’s phones, tablets etc so
that they can see the state of running instances, receive notifications
whenever there’s an outage etc..
So long as the users are standing fairly near the server which is
running Winged Monkey, and can get wifi connectivity to the same network
that the server is on, then it’s all relatively simple.
However, as soon as users step outside the building, it all gets a bit
more complex. In order for the users’ phone to be able to connect over
the internet to the Winged Monkey server, then either the phone is going
to need to have a VPN connection, which is a significant overhead, or
the Winged Monkey server instance is going to have to be directly
accessible over the internet. A lot of the organisations which are
potential users of Winged Monkey wouldn’t be prepared to do that.
We could use a social network as a messaging conduit between the Winged
Monkey server and a client application on users’ phones.
For the rest of this mail, I’ll expand in this in the context of
Twitter. I don’t *think* this use would be a violation the Twitter’s
terms of service. (
https://twitter.com/tos ). There are several public
social networks which could serve the purpose...
So, here’s how this could work:
* The Winged Monkey server would register a Twitter account, with
protected tweets.
* A user would install and run the Winged Monkey phone app. The first
run would also create a protected Twitter account, and when the user
authenticates, the two Twitter accounts start following each other.
* Thereafter Winged Monkey and the phone app use tweets to communicate
over the internet, sending instructions, status updates etc. as strings
up up to 140 characters. So long as both the server and the client app
poll frequently for new tweets, the responsiveness should be acceptable
to users.
Some of the benefits are:
* The communications are authenticated, with access permission which can
be very quickly revoked by unfollowing an account which is no longer
supported.
* The communications are also (moderately) secure, in the sense that
tweets from and between protected accounts aren’t generally readable.
* The timelines of the accounts constitute an audit history of events
etc.. It would be trivial to scrape that audit history from Twitter if
required.
* The principle benefit, though, is that the requirement for the Winged
Monkey server to be directly accessible over the internet is removed. So
long as the Winged Monkey server can make a client connection to
Twitter.com, stuff just works.
I’m not pretending that this is a flawless proposition, but I think
there’s enough of an idea here to want feedback. I’d love to hear a
better way to solve the problem.
Angus
Angus,
You're proposing we build a backdoork to our users' VPN that can be
exploited by Twitter, Inc. and anyone who gains access to their
infrastructure (a malicious hacker, rogue employee or the US government).
If an organisation puts Winged Monkey behind a VPN and doesn't make the
UI/API available from the outside, this proposal won't fly (pardon the pun).
It seems you're trying to solve two distinct things: use an existing
communication protocol between the mobile app and the server; and have a
way of connecting the app to a hardened server.
For the first option, we can use a wide range of open protocols: XMPP,
RSS, Atom, PubSubHubbub or the API Winged Monkey will provide. Behind
SSL/TLS of course. Any of these would be fine for a mobile client and
are successfully being used.
To provide push notifications to the mobile devices, we can utilise SMS,
email or the native push services (as Jeremy and Steve suggested). Note
that all of these rely on third-party services. They will leak
potentially sensitive data to third parties. Still, it can be useful as
an optional feature.
The issue of connecting to the server is orthogonal to all that. If a
company doesn't want to set up a public connection point for security
reasons, the game is over.
However, I could see us provide a very streamlined, simple and easily
auditable service separate from the main WM/Aeolus API. This would allow
only certain data and operations to flow back and forth and could be
deployed instead of the full-fledged API/UI.
This is similar to running phpMyAdmin on the internal network only and
having the Wordpress admin interface accessible from the outside. They
can both access your internal database, but the Wordpress access is more
limited. Unless there are holes in Wordpress. Hence the need for a
simple and robust solution.
We (or anyone else) could even host this ourselves. That way the
security implications for the company are the same as the original
Twitter proposal but at least it's an open solution and they are not
locked in to a single company's proprietary service.
Thomas