jonfriesen

5 ms·

1.
by jonfriesen 7mo ago
Build a browser on top of an open standard, neglect that standard, then refer to that neglecting as the reason to kill it. This fits that spiderman pointing at spiderman meme perfectly. It's exhausting.
2.
The eBPF Verifier – How Linux Safely Runs User Code in Kernel Space(qpoint.io)
15 points by jonfriesen 1y ago|0 comments
3.
by jonfriesen 1y ago
Yes, since NixOS runs on a standard Linux kernel, Qtap will work. I realized that we weren't scanning the nix store for shared libs (eg. OpenSSL) and added that this morning.
4.
by jonfriesen 1y ago
Thanks! We're really excited about Qcontrol and what it will be able to provide! The rules in that doc are powered by our Rulekit project https://github.com/qpoint-io/rulekit if you're curious about seeing mo
5.
by jonfriesen 1y ago
`ecapture` has been around for a while and do a lot of great stuff and a lot of functionality overlaps. Our aim is to make Qtap extensible and via a plugin system. We have http1/2 streaming capabilities and a plugin engine to run these
6.
by jonfriesen 1y ago
As of today, we don't output pcap or har files though these are additions I'd like to make in the future, they aren't currently on our near term roadmap.
7.
by jonfriesen 1y ago
I think the closest is an app with a full GUI called LittleSnitch. It's pretty impressive. https://www.obdev.at/products/littlesnitch/index.html
8.
by jonfriesen 1y ago
These are all great callouts. We've worked hard to address some of them, some are future endeavours. To address your points: 1. In our testing, uprobes add a statistically insignificant amount of latency and in comparison to a MITM pro
9.
by jonfriesen 1y ago
Not today, maybe one day! Edit: Another user posted a link to https://github.com/gojue/ecapture which looks like it supports android and has some overlapping functionality.
10.
by jonfriesen 1y ago
Qtap does require root privileges to function as it uses eBPF to hook into kernel and userspace program functions. The good news is it can also be run within a container. There are some important flags when spinning it up in docker: `--priv
11.
by jonfriesen 1y ago
You've definitely hit on a point that we've talked about at length and have come to terms that different organizations have different requirements, especially when it comes to regulatory and compliance. Qtap can be locked down wit
12.
by jonfriesen 1y ago
Fair point on -O2 and -O3 optimized bins. We've approached this by building custom bin utils that are optimized for blazingly fast symbol recognition. Traditional ELF tools that focus on providing comprehensive context for debugging, w
13.
by jonfriesen 1y ago
That was one of our biggest motivators when dreaming up Qtap. How can we remove the impact that proxies have on connections, AND see the content without having to manage a custom certificate authority, AND not have to instrument all of our
14.
by jonfriesen 1y ago
This is a great point, and Qtap itself does need to be used with care. The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario. That said, the eBPF verifier has robust security guarantees and runs
15.
by jonfriesen 1y ago
Qtap scans binaries of processes as well known locations for OpenSSL on startup, then passes the offsets to eBPF where it hooks into the SSL_read and SSL_write to get the content before or after it's been encrypted. This is the eBPF si
16.
by jonfriesen 6y ago
A small note, the DigitalOcean dev DBs do have daily backups though these are not accessible by the user and only come into play when there is a non-recoverable issue with the node they are on.
17.
by jonfriesen 6y ago
Hey futhey, The team agreed that we had some gaps that needed to be filled, you will now see new plans: Basic $40/month 4GB RAM & 2 Shared vCPUs Pro $75/month 4GB RAM & 1 Dedicated vCPU We've also increased the vCPU c