9 ms·

It is just not wise to allow some random application to MiTM your SSL traffic.

I_Am_Nous 3y ago
No but it might be fun to play with in a Qubes environment or similar where you can inspect packets going in and out for anything weird happening.
- lxgr 3y ago
  Looking at packets will only get you so far if they're encrypted. Software like this has way too many opportunities to exfiltrate information for that approach to work.
  - I_Am_Nous 3y ago
    That's true, but if it is trying to exfiltrate data you will probably see more packets coming out than going in. If the concern is that the SSL cert they add allows them to decrypt your data, and you see it sending your requests anywhere it shouldn't, you'll get a window into what they are trying to do. It's not perfect, but it is possible to gain information in such a way.
develatio 3y ago
If you can read the code and asure that the traffic won’t be sent to a malicious third party, why not? What is the concern?
- sedatk 3y ago
  How would you know if the binary was built from the code verbatim? How would you know that for future updates?
  - rubyn00bie 3y ago
    You could just compile it. For updates you could like pull down the new code, check the diff, and rebuild.
  - jmvoodoo 3y ago
    The build steps are provided as a GitHub action in the repo. You can audit the build pretty easily, or if you're super paranoid you can build it yourself by following the build steps.
    - themerone 3y ago
      Even if the app is trustworthy, it still adds an attack vector to your system. It could have a bug, or the certificate could be exploited by another program.
      - anigbrowl 3y ago
        Equally true of every ad
        lolinder 3y ago
        This would be a reasonable argument if there weren't many alternative ad blocking methods that don't require MITMing your TLS traffic.
        rollcat 3y ago
        It's in no way worse than running a single browser extension with overly broad privileges. If this method of adblocking gains more traction (quite possible, as Google keeps moving to damage in-browser ad blockers), I expect the implementation to receive a lot more scrutiny. I think we have to face the reality that web browsers might no longer be considered "user" agents.
        shiroiuma 3y ago
        >I think we have to face the reality that web browsers might no longer be considered "user" agents. Well obviously, if you keep insisting on using a browser made by Google, an ad company.
        lolinder 3y ago
- BowBun 3y ago
  No one will do this, and those that read source code during installation do not review it for every upgrade. It's one of those 'just do this!' arguments that has little to no basis in reality. There's more of them replying to the parent comment: "Just do this! Just compile a thing! Just verify signatures for every update!". Come on... Meanwhile the negatives immediately implicate anyone with access to the executable. You don't know this person, and I see no personally identifiable information to make me trust them. They could literally be a state actor right now! We've also seen so many large supply-chain attacks over the last decade which could easily target a tiny project like this. I agree with the parent - not wise.
  - stitched2gethr 3y ago
    Yes, some people will do this. I just read the whole project, it's actually a pretty simple program. I'm installing it now and the best part is if I don't like something I can change it. OSS FTW.
  - develatio 3y ago
    But doesn’t that apply to chromium / firefox as well (or any other big application). Web browsers are insanely huge, nobody is reading the entire code. What makes this different?
    - jolux 3y ago
      No, because Google and Mozilla pay loads of people to write and review the code that goes into their browsers and ensure it’s not malicious.
      - Dalewyn 3y ago
        So I can apply the same logic to Microsoft concerning Windows, Office, etc. and you wouldn't dispute me, right? Incidentally, no I have no objections against closed source. I find the religious dogma behind FOSS patently stupid.
        3y ago
- RockRobotRock 3y ago
  Please don't downvote an earnest and important question which should be answered
- lxgr 3y ago
  If I can miss subtle and not-so-subtle bugs in my own team's code that I'm working on every single day, what are the chances I'll get it right on somebody else's project? Being able to MITM any HTTPS request on my system is a privilege I'd not grant lightly. It's up there with browsers, browser extensions (with "all content on all sites" access), and password managers in terms of blast radius in case anything goes wrong.
- eviks 3y ago
  The concern is that it's a huge waste of time for everyone to read the code, and a significant investment of time for anyone to do so, that's why not
fostware 3y ago
But as developers, we're happy enough to suggest `wget -qO - https://github/url https://github/url | sudo bash -s`
- kiney 3y ago
  No, we're not.
- zzo38computer 3y ago
  Unfortunately many people do like that, but I hate it and I don't do stuff like that (and it seems many other people hate it too; fortunately you can just download the file without immediately executing it, if you want to view (and possibly modify) it).
deleted 3y ago
[deleted]
mike_d 3y ago
Why not? We allow Cloudflare to do it every day.

No but it might be fun to play with in a Qubes environment or similar where you can inspect packets going in and out for anything weird happening.

lxgr 3y ago
Looking at packets will only get you so far if they're encrypted. Software like this has way too many opportunities to exfiltrate information for that approach to work.
- I_Am_Nous 3y ago
  That's true, but if it is trying to exfiltrate data you will probably see more packets coming out than going in. If the concern is that the SSL cert they add allows them to decrypt your data, and you see it sending your requests anywhere it shouldn't, you'll get a window into what they are trying to do. It's not perfect, but it is possible to gain information in such a way.

develatio 3y ago

If you can read the code and asure that the traffic won’t be sent to a malicious third party, why not? What is the concern?

sedatk 3y ago
How would you know if the binary was built from the code verbatim? How would you know that for future updates?
- rubyn00bie 3y ago
  You could just compile it. For updates you could like pull down the new code, check the diff, and rebuild.
- jmvoodoo 3y ago
  The build steps are provided as a GitHub action in the repo. You can audit the build pretty easily, or if you're super paranoid you can build it yourself by following the build steps.
  - themerone 3y ago
    Even if the app is trustworthy, it still adds an attack vector to your system. It could have a bug, or the certificate could be exploited by another program.
    - anigbrowl 3y ago
      Equally true of every ad
      - lolinder 3y ago
        This would be a reasonable argument if there weren't many alternative ad blocking methods that don't require MITMing your TLS traffic.
        rollcat 3y ago
        It's in no way worse than running a single browser extension with overly broad privileges. If this method of adblocking gains more traction (quite possible, as Google keeps moving to damage in-browser ad blockers), I expect the implementation to receive a lot more scrutiny. I think we have to face the reality that web browsers might no longer be considered "user" agents.
        shiroiuma 3y ago
        >I think we have to face the reality that web browsers might no longer be considered "user" agents. Well obviously, if you keep insisting on using a browser made by Google, an ad company.
        lolinder 3y ago
BowBun 3y ago
No one will do this, and those that read source code during installation do not review it for every upgrade. It's one of those 'just do this!' arguments that has little to no basis in reality. There's more of them replying to the parent comment: "Just do this! Just compile a thing! Just verify signatures for every update!". Come on... Meanwhile the negatives immediately implicate anyone with access to the executable. You don't know this person, and I see no personally identifiable information to make me trust them. They could literally be a state actor right now! We've also seen so many large supply-chain attacks over the last decade which could easily target a tiny project like this. I agree with the parent - not wise.
- stitched2gethr 3y ago
  Yes, some people will do this. I just read the whole project, it's actually a pretty simple program. I'm installing it now and the best part is if I don't like something I can change it. OSS FTW.
- develatio 3y ago
  But doesn’t that apply to chromium / firefox as well (or any other big application). Web browsers are insanely huge, nobody is reading the entire code. What makes this different?
  - jolux 3y ago
    No, because Google and Mozilla pay loads of people to write and review the code that goes into their browsers and ensure it’s not malicious.
    - Dalewyn 3y ago
      So I can apply the same logic to Microsoft concerning Windows, Office, etc. and you wouldn't dispute me, right? Incidentally, no I have no objections against closed source. I find the religious dogma behind FOSS patently stupid.
      - 3y ago
RockRobotRock 3y ago
Please don't downvote an earnest and important question which should be answered
lxgr 3y ago
If I can miss subtle and not-so-subtle bugs in my own team's code that I'm working on every single day, what are the chances I'll get it right on somebody else's project? Being able to MITM any HTTPS request on my system is a privilege I'd not grant lightly. It's up there with browsers, browser extensions (with "all content on all sites" access), and password managers in terms of blast radius in case anything goes wrong.
eviks 3y ago
The concern is that it's a huge waste of time for everyone to read the code, and a significant investment of time for anyone to do so, that's why not

fostware 3y ago

But as developers, we're happy enough to suggest `wget -qO - https://github/url https://github/url | sudo bash -s`

kiney 3y ago
No, we're not.
zzo38computer 3y ago
Unfortunately many people do like that, but I hate it and I don't do stuff like that (and it seems many other people hate it too; fortunately you can just download the file without immediately executing it, if you want to view (and possibly modify) it).

deleted 3y ago

[deleted]

mike_d 3y ago

Why not? We allow Cloudflare to do it every day.