alexflint

7 ms·

1.
by alexflint 10d ago
This github search returns just 11 results, and the issues are more or less reasonable. Doesn't seem that egregious.
2.
by alexflint 2y ago
Thanks! Yeah linux network namespaces are a powerhouse that we're only just starting to fully utilize (outside of containerization).
3.
by alexflint 2y ago
Thank you! mitmproxy is fantastic - thanks for all the work that's gone into that project. Maybe we can get in touch and chat about all this stuff.
4.
by alexflint 2y ago
Nothing at all! You do need write access to /dev/net/tun. This is standard for all users for the distros that I've looked into, but it is ultimately a distro-specific thing.
5.
by alexflint 2y ago
Unfortunately TLS happens inside the the application, not in the kernel, so using eBPF to hook syscalls to write won't help with TLS decryption.
6.
by alexflint 2y ago
Fascinating, I hadn't heard of WARC - thanks for the pointer and I'll consider it.
7.
by alexflint 2y ago
Yeah that photo is real! That's where I live! Yes, it's true, actually doing it is hard, but to be honest not as hard as a lot of other stuff (getting a phd for example, or goodness gracious buying a house in San Francisco). I lov
8.
by alexflint 2y ago
Wireshark is awesome but yeah as others mentioned it's the TLS decryption piece that is difficult in that workflow
9.
by alexflint 2y ago
Woah, this is super helpful info. Thanks. That sounds like a real possibility for a macOS port actually.
10.
by alexflint 2y ago
This is a very interesting possibility actually. Not 100% sure what the implication would be but maybe there is something here.
11.
by alexflint 2y ago
Yeah mitmproxy is great. The main difference with httptap is that it's an HTTP proxy server, so you have to configure your program to use a proxy server. When I wrote httptap I wanted to be able to run `httptap <command>` and see
12.
by alexflint 2y ago
Thanks! I did try this with firefox but it doesn't work right now due to (I think) the user namespace messing with user IDs. I think I should be able to fix this, though. I will have to try it with other desktop apps soon too...
13.
by alexflint 2y ago
Same here actually -- have wanted this from time to time for years. Finally sat down and worked it out.
14.
by alexflint 2y ago
Yep. This is the first time I've mentioned this but there are actually two implementations of this in the codebase -- one uses gVisor and one is an incredibly bare-bones TCP implementation that I wrote myself in 550 lines of Go code (t
15.
by alexflint 2y ago
Very cool! Would love to hear how it goes, especially any features that would be useful in the context of real-world usage.
16.
by alexflint 2y ago
Yep, mitmproxy is fantastic IMO.
17.
by alexflint 2y ago
Yeah learning about gVisor was one of the most fun parts of this project. The gVisor devs are incredibly helpful. If you look through the gvisor-users mailing list you'll see me asking them various questions about this and they really
18.
by alexflint 2y ago
Interesting. Care to share any info about your setup? Would it be a matter of httptap reading a certain environment variable and then forwarding traffic to a SOCKS proxy? FWIW there is also the excellent tun2socks ( https://github
19.
by alexflint 2y ago
Thanks! But yep I agree, you're exactly right, it's ultimately... frustrating that there isn't really an agreed-upon or system-enforced way to specify CA roots to an arbitrary process. It's true that httptap mounts an ov
20.
by alexflint 2y ago
Very good to know about. But you still have the problem of decrypting TLS traffic.
21.
by alexflint 2y ago
Wow, did not know about this!
22.
by alexflint 2y ago
Super cool! Connecting what you capture to Chrome DevTools is fascinating, as is using eBPF. Great work getting the devtools to run as a standalone web app. You won't believe it but I have a half-finished attempt of the same thing for
23.
by alexflint 2y ago
Wow that's an incredible quote! It feels like that to me too.
24.
by alexflint 2y ago
Agreed! So there isn't any interface for modifying requests/responses at present, but it's definitely possible given the underlying approach. If you consider [this line of code]( https://github.com/monasticacad
25.
by alexflint 2y ago
Yeah, for other readers who are looking at this thread, the connection is just that this (httptap) is a Monastic Academy project, and what that means is that there is a group of people living on 123 acres in Vermont according to a fairly tr
26.
by alexflint 2y ago
Thanks! Haven't measured performance at all. However when I decided on the approach I looked at the performance benchmarks from tun2socks, which uses the same gVisor code that httptap uses, and it seems that pretty great performance is
27.
by alexflint 2y ago
httptap is a process-scoped http tracer that you can run without root priveleges. You can run `httptap <command>` where <command> is a linux program and you get a trace of http/https requests and responses in standard outpu
28.
Httptap: View HTTP/HTTPS requests made by any Linux program(github.com)
664 points by alexflint 2y ago|145 comments
29.
Ask HN: Why does ko-fi connect to stripe when stripe doesn't allow crowdfunding?
6 points by alexflint 2y ago|2 comments
30.
by alexflint 9y ago
Great point. We need to address this. Right now the examples are written and owned by us (Kite), so you would technically be in uncertain legal territory (depending on whether fair use was applied per-example or per-page). We will change th

More ›