4 ms·

This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This

This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828ebc0e042f03d13caee502/sherlock/main.py#L181 https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.

jmuncor 9mo ago
Just fixed it and implemented a simple http relay, eliminating the mitmproxy and the ssl_insecure=true. The new implementation uses TLS verification, doing last tests and merging it... After the merge can you check it out and tell me if I earned your star? :D
- catlifeonmars 9mo ago
  I’m not sure you fully understand the implications of the misconfiguration of mitmproxy there. Effectively you provided an easily accessible front door for remote code execution on a user’s machine. No offense, but I wouldn’t trust anything else you published. I think it’s great that you are learning and it is difficult to put yourself out there and publish code, but what you originally wrote had serious implications and could have caused real harm to users.
  - jmuncor 9mo ago
    Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
    - jurgenaut23 9mo ago
      No, you’re in the process of vibe coding stuff you don’t understand and you will most likely never understand until you take the time to open a book.
      - ratg13 9mo ago
        Your comment contains nothing but insults. This is not a place for you to try and make yourself feel better by disparaging others.
        jurgenaut23 9mo ago
        You might find my comment insulting but saying that it contains insults is inaccurate. Also, OP claims that he is here to learn, but he is mostly chasing cheap GH stars to boost his resume. How insulting is that?
    - lionkor 9mo ago
      I don't think you can get professionals to review code that you didn't even bother typing yourself. You aren't learning much. You're vibe coding, which means you learn almost nothing, except maybe prompting your LLM better.
    - badeeya 9mo ago
      it's incredible that people pointed out very specifically what's wrong and you fell back to weaponized incompetence to shift the intellectual and mental burden of reviewing the code to outsiders instead of thinking for yourself. this is the problem with relying on LLM,s instead of thinking for yourself you just ask LLMs, and now other real people "idk just fix it for me make it work". do you really not see the problem with this?
- throwaway277432 9mo ago
  >tell me if I earned your star Since you asked: Not in a million years, no. A bug of this type is either an honest typo or a sign that the author(s) don't take security seriously. Even if it were a typo, any serious author would've put a large FIXME right there when adding that line disabling verification. I know I would. In any case a huge red flag for a mitm tool. Seeing that it's vibe coded leads me believe it's due to AI slop, not a simple typo from debugging.
  - jmuncor 9mo ago
    I love the real feedback tbh, I am still learning, and want to learn as much as possible. Would love if you can review it and tell me bluntly either in the repo or here the things that should be improved. I would love to learn more from you and get better :D
    - jamespo 9mo ago
      unlikely to get that from a throwaway
      - jmuncor 9mo ago
        You can always try right?
        antonvs 9mo ago
        Only if you don’t care about your reputation. “Give me your time for free” is not the kind of request that earns respect.
    - throwaway277432 9mo ago
      I'm not going to review it in full, sorry. Reviewing is so much more effort compared to producing something with AI. But don't let me deter you, keep on learning and keep on building. I wish I had the possibilities to learn and build on such a large scale when I started out. AI is a blessing and a curse I guess. My own early projects were most definitely crap, and I made the exact same mistakes in the past. Honestly my first attempts were surely worse. But my projects were also tiny and incomplete, so I never published them. However: What little parts I did publish as open-source or PRs were meticulously reviewed before ever hitting send, and I knew these inside and out and they were as good as I could make it. Vibe-coded software is complete but never as good as you could make it, so the effort in reviewing it is mostly wasted. I guess what I'm trying to say is I'm a bit tired of seeing student-level projects on HN / Github cosplaying as production ready software built by an experienced engineer. It used to be possible to distinguish these from the README or other cues, but nowadays they all look professional and are unintentionally polluting the software space when I'm actually looking for something. Please understand that this is not specifically directed at you, it's pent up frustration from reading HN projects over the last months. Old guy yelling at clouds.
- ewuhic 9mo ago
  You don't understand what you're doing, and never will. Throw away all computing devices you've got.
deleted 9mo ago
[deleted]
Lucasoato 9mo ago
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Balinares 9mo ago
  Ah, getting the job done by disabling important validation, if that isn't the most prominent Opus trait... I wonder how much this will end up costing the industry in aggregate.
  - xmcqdpt2 9mo ago
    Not entirely different from many human engineers...
    - philipwhiuk 9mo ago
      Indeed - most of my StackOverflow credit is for explaining TLS config options.
  - catlifeonmars 9mo ago
    I’m thinking of pivoting into cybersecurity. I suspect that’s where the all money will be in the next couple of years.
    - philipwhiuk 9mo ago
      At least until the pivot by Claude et al from AI for work to AI for cybersec analysis.
      - catlifeonmars 9mo ago
        Same problem, 1 level deeper. It’s cat and mouse until the next breakthrough.
101008 9mo ago
I think the main problem is when OP wrote: > I built this Instead of > I prompted this I am OK with people publishing new ideas to the web as long as they are 100% honest and admit they just had an idea and asked an AI to build it for themselves. That way I can understand they may not have considered all the things that needs to be considered and I can skip it (and then prompt it myself if I want to, adding all the things I consider necesary)
arowthway 9mo ago
Don't use it if you plan to auto accept terminal commands, without a sandbox, while on a public wifi in a cafe, next to a hacker who decides to bet on you running a very niche configuration.
- catlifeonmars 9mo ago
  All you need is to manipulate DNS, inject a record with a long TTL and the rest is not required. It scales very well and I guarantee this is not the only instance of misconfigured host verification. In other words, this is not as niche as you might think.
  - arowthway 9mo ago
    If you're able to manipulate DNS, can't you just issue your own certificate for the domain? Even if it would be revoked moments later, mitmproxy doesnt check it even when ssl_insecure=false: https://github.com/mitmproxy/mitmproxy/issues/2235 https://github.com/mitmproxy/mitmproxy/issues/2235 EDIT: Maybe I incorrectly assumed you meant authoritative DNS.
    - catlifeonmars 9mo ago
      You got it, authoritative not necessary. It just needs to be your router, your ISPs resolver, or the one at your public library/coffee shop/hotel etc. I’d throw BGP route poisoning in there too, but then you have much bigger problems lol. Like you pointed out in your original post, this would be expensive to run as a targeted attack, but it has good unit economics if you scale it up, wait, and then harvest.
monkaiju 9mo ago
And it's already surpassed my most starred project when it was on GitHub, all the more validating to have moved it to forgejo. If vibecoded stuff with unbelievable security vulns can get so much praise the whole star system doesn't work as a quality filter. Similarly a well crafted README used to help reflect quality, no longer...
- catlifeonmars 9mo ago
  I don’t use stars to select dependencies FWIW. I look for age, CVEs and what other reputable projects depend on a repo. Also try to look for other signals, like if claims in the readme don’t match the implementation, or if there’s poor hygiene in the CI workflows. (And yes, I have gotten burned by an otherwise well meaning project with a supply chain vuln). As the saying goes “a little copying is better than a little dependency” (see: https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s).
benreesman 9mo ago
The thing you want has a kind of academic jargon name (coeffects algebra with graded/indexed monads for discharge) but is very intuitive, and it can do useful and complete attestation without compromising anyone credentials (in the limit case because everyone chooses what proxy to run). https://imgur.com/a/Ztyw5x5 https://imgur.com/a/Ztyw5x5
- catlifeonmars 9mo ago
  Sorry but you lost me. How are coeffects different from effects? I think I’m missing some steps between monads and credentials. Maybe fill in the blanks?

jmuncor 9mo ago

Just fixed it and implemented a simple http relay, eliminating the mitmproxy and the ssl_insecure=true. The new implementation uses TLS verification, doing last tests and merging it... After the merge can you check it out and tell me if I earned your star? :D

catlifeonmars 9mo ago
I’m not sure you fully understand the implications of the misconfiguration of mitmproxy there. Effectively you provided an easily accessible front door for remote code execution on a user’s machine. No offense, but I wouldn’t trust anything else you published. I think it’s great that you are learning and it is difficult to put yourself out there and publish code, but what you originally wrote had serious implications and could have caused real harm to users.
- jmuncor 9mo ago
  Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
  - jurgenaut23 9mo ago
    No, you’re in the process of vibe coding stuff you don’t understand and you will most likely never understand until you take the time to open a book.
    - ratg13 9mo ago
      Your comment contains nothing but insults. This is not a place for you to try and make yourself feel better by disparaging others.
      - jurgenaut23 9mo ago
        You might find my comment insulting but saying that it contains insults is inaccurate. Also, OP claims that he is here to learn, but he is mostly chasing cheap GH stars to boost his resume. How insulting is that?
  - lionkor 9mo ago
    I don't think you can get professionals to review code that you didn't even bother typing yourself. You aren't learning much. You're vibe coding, which means you learn almost nothing, except maybe prompting your LLM better.
  - badeeya 9mo ago
    it's incredible that people pointed out very specifically what's wrong and you fell back to weaponized incompetence to shift the intellectual and mental burden of reviewing the code to outsiders instead of thinking for yourself. this is the problem with relying on LLM,s instead of thinking for yourself you just ask LLMs, and now other real people "idk just fix it for me make it work". do you really not see the problem with this?
throwaway277432 9mo ago
>tell me if I earned your star Since you asked: Not in a million years, no. A bug of this type is either an honest typo or a sign that the author(s) don't take security seriously. Even if it were a typo, any serious author would've put a large FIXME right there when adding that line disabling verification. I know I would. In any case a huge red flag for a mitm tool. Seeing that it's vibe coded leads me believe it's due to AI slop, not a simple typo from debugging.
- jmuncor 9mo ago
  I love the real feedback tbh, I am still learning, and want to learn as much as possible. Would love if you can review it and tell me bluntly either in the repo or here the things that should be improved. I would love to learn more from you and get better :D
  - jamespo 9mo ago
    unlikely to get that from a throwaway
    - jmuncor 9mo ago
      You can always try right?
      - antonvs 9mo ago
        Only if you don’t care about your reputation. “Give me your time for free” is not the kind of request that earns respect.
  - throwaway277432 9mo ago
    I'm not going to review it in full, sorry. Reviewing is so much more effort compared to producing something with AI. But don't let me deter you, keep on learning and keep on building. I wish I had the possibilities to learn and build on such a large scale when I started out. AI is a blessing and a curse I guess. My own early projects were most definitely crap, and I made the exact same mistakes in the past. Honestly my first attempts were surely worse. But my projects were also tiny and incomplete, so I never published them. However: What little parts I did publish as open-source or PRs were meticulously reviewed before ever hitting send, and I knew these inside and out and they were as good as I could make it. Vibe-coded software is complete but never as good as you could make it, so the effort in reviewing it is mostly wasted. I guess what I'm trying to say is I'm a bit tired of seeing student-level projects on HN / Github cosplaying as production ready software built by an experienced engineer. It used to be possible to distinguish these from the README or other cues, but nowadays they all look professional and are unintentionally polluting the software space when I'm actually looking for something. Please understand that this is not specifically directed at you, it's pent up frustration from reading HN projects over the last months. Old guy yelling at clouds.
ewuhic 9mo ago
You don't understand what you're doing, and never will. Throw away all computing devices you've got.

deleted 9mo ago

[deleted]

Lucasoato 9mo ago

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Balinares 9mo ago
Ah, getting the job done by disabling important validation, if that isn't the most prominent Opus trait... I wonder how much this will end up costing the industry in aggregate.
- xmcqdpt2 9mo ago
  Not entirely different from many human engineers...
  - philipwhiuk 9mo ago
    Indeed - most of my StackOverflow credit is for explaining TLS config options.
- catlifeonmars 9mo ago
  I’m thinking of pivoting into cybersecurity. I suspect that’s where the all money will be in the next couple of years.
  - philipwhiuk 9mo ago
    At least until the pivot by Claude et al from AI for work to AI for cybersec analysis.
    - catlifeonmars 9mo ago
      Same problem, 1 level deeper. It’s cat and mouse until the next breakthrough.

101008 9mo ago

I think the main problem is when OP wrote: > I built this Instead of > I prompted this I am OK with people publishing new ideas to the web as long as they are 100% honest and admit they just had an idea and asked an AI to build it for themselves. That way I can understand they may not have considered all the things that needs to be considered and I can skip it (and then prompt it myself if I want to, adding all the things I consider necesary)

arowthway 9mo ago

Don't use it if you plan to auto accept terminal commands, without a sandbox, while on a public wifi in a cafe, next to a hacker who decides to bet on you running a very niche configuration.

catlifeonmars 9mo ago
All you need is to manipulate DNS, inject a record with a long TTL and the rest is not required. It scales very well and I guarantee this is not the only instance of misconfigured host verification. In other words, this is not as niche as you might think.
- arowthway 9mo ago
  If you're able to manipulate DNS, can't you just issue your own certificate for the domain? Even if it would be revoked moments later, mitmproxy doesnt check it even when ssl_insecure=false: https://github.com/mitmproxy/mitmproxy/issues/2235 https://github.com/mitmproxy/mitmproxy/issues/2235 EDIT: Maybe I incorrectly assumed you meant authoritative DNS.
  - catlifeonmars 9mo ago
    You got it, authoritative not necessary. It just needs to be your router, your ISPs resolver, or the one at your public library/coffee shop/hotel etc. I’d throw BGP route poisoning in there too, but then you have much bigger problems lol. Like you pointed out in your original post, this would be expensive to run as a targeted attack, but it has good unit economics if you scale it up, wait, and then harvest.

monkaiju 9mo ago

And it's already surpassed my most starred project when it was on GitHub, all the more validating to have moved it to forgejo. If vibecoded stuff with unbelievable security vulns can get so much praise the whole star system doesn't work as a quality filter. Similarly a well crafted README used to help reflect quality, no longer...

catlifeonmars 9mo ago
I don’t use stars to select dependencies FWIW. I look for age, CVEs and what other reputable projects depend on a repo. Also try to look for other signals, like if claims in the readme don’t match the implementation, or if there’s poor hygiene in the CI workflows. (And yes, I have gotten burned by an otherwise well meaning project with a supply chain vuln). As the saying goes “a little copying is better than a little dependency” (see: https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s https://www.youtube.com/watch?v=PAAkCSZUG1c&t=9m28s).

benreesman 9mo ago

The thing you want has a kind of academic jargon name (coeffects algebra with graded/indexed monads for discharge) but is very intuitive, and it can do useful and complete attestation without compromising anyone credentials (in the limit case because everyone chooses what proxy to run). https://imgur.com/a/Ztyw5x5 https://imgur.com/a/Ztyw5x5

catlifeonmars 9mo ago
Sorry but you lost me. How are coeffects different from effects? I think I’m missing some steps between monads and credentials. Maybe fill in the blanks?