4 ms·

Good questions. While Charles and other proxies are doing a fine job our dev team is also frustrated by the way they integrate with OS X. This is what we mean b

Good questions. While Charles and other proxies are doing a fine job our dev team is also frustrated by the way they integrate with OS X. This is what we mean by native experience. The application is in effect a single binary and makes use of various Apple frameworks which are optimised to run flawlessly on apple hardware. Only one platform is supported which means that there is less chance for bugs and platform-specific oddities. Proxy.app works as a sandbox application on OS X, distributed by Mac App Store and makes use of other native components like Keychain, etc. Under the hood the tool is only making use of Apple frameworks. We believe that in the long term this will provide more stability and performance enhancements. Right now it takes just a moment to launch the application and there is zero friction when switching between different project files. We believe that it just works in the same way OS X applications are supposed to work and this in effect makes Proxy.app more pleasant to use.

danpalmer 12y ago
I'll vouch for this. I've used Charles extensively, and while I haven't used Proxy yet, the most annoying things about Charles are always related to it not using proper UI paradigms, components, etc. I'd love something that was a proper Mac app for this. As for the comparison with Burp, I have much less experience with Burp, but the pro version has a huge amount of functionality. Things like plotting the distribution of cookies so you can see if they are backed by a good RNG. It doesn't look like this is quite that advanced yet, but those are the sorts of features that only real pen-testers would be using. For most developers who just need to test stuff, this looks excellent, I really look forward to trying it out.
- passfree 12y ago
  Hi danpalmer, Some tools are much more useful in the browser - and not in the proxy. As for the session management security - you will rarely need this functionality these days unless you do security research. This tool was useful years ago when everyone was implementing their own session management systems. These days most of these sub-systems are part of the core web frameworks and therefore already tested - we hope. That being said, there are still bugs to be found but this falls into the realm of security research.
  - danpalmer 12y ago
    "we hope" It's also something that is tested on the CREST Certified Web Application Tester exam: http://crest-approved.org/information-security-testers/certified-web-application-tester/index.html http://crest-approved.org/information-security-testers/certi...
monkey_slap 12y ago
Right on, thanks for the thoughtful response. Did you guys run into any issues getting the app approved by Apple?
- passfree 12y ago
  We did run into a few roadblocks and as a result we were forced to carve features out from the final product. However, the decision is not final and maybe if we manage to convince the app reviewers that these features are vital to the users we may be able to bring them back soon. We are working on these very hard and also trying to find out other workarounds.
  - snsr 12y ago
    Can you give an example of the type of feature you were required to remove due to the approval process?
  - passfree 12y ago
    Yes of course. We had to remove the integration with the notification API and also remove the facilities which allow us to install the CA certificate smoothly into your device. The second was flagged as breaking a clause which states that all applications should be self-contained. Which in our opinion is understandable concern although the feature would have saved a lot of people an extra step to get the CA and other certificates in the correct place in order to ensure smooth communication.
  - monkey_slap 12y ago
    What blocked you guys (if you can say)? If I can give any tips, whenever I'm questioning if a feature is going to get called out when I submit an app, I always fill that "info for reviewer" section with tons of stuff. Explanations, links to docs & legal to show that I'm not doing anything against the law/rules.

danpalmer 12y ago

I'll vouch for this. I've used Charles extensively, and while I haven't used Proxy yet, the most annoying things about Charles are always related to it not using proper UI paradigms, components, etc. I'd love something that was a proper Mac app for this. As for the comparison with Burp, I have much less experience with Burp, but the pro version has a huge amount of functionality. Things like plotting the distribution of cookies so you can see if they are backed by a good RNG. It doesn't look like this is quite that advanced yet, but those are the sorts of features that only real pen-testers would be using. For most developers who just need to test stuff, this looks excellent, I really look forward to trying it out.

passfree 12y ago
Hi danpalmer, Some tools are much more useful in the browser - and not in the proxy. As for the session management security - you will rarely need this functionality these days unless you do security research. This tool was useful years ago when everyone was implementing their own session management systems. These days most of these sub-systems are part of the core web frameworks and therefore already tested - we hope. That being said, there are still bugs to be found but this falls into the realm of security research.
- danpalmer 12y ago
  "we hope" It's also something that is tested on the CREST Certified Web Application Tester exam: http://crest-approved.org/information-security-testers/certified-web-application-tester/index.html http://crest-approved.org/information-security-testers/certi...

monkey_slap 12y ago

Right on, thanks for the thoughtful response. Did you guys run into any issues getting the app approved by Apple?

passfree 12y ago
We did run into a few roadblocks and as a result we were forced to carve features out from the final product. However, the decision is not final and maybe if we manage to convince the app reviewers that these features are vital to the users we may be able to bring them back soon. We are working on these very hard and also trying to find out other workarounds.
- snsr 12y ago
  Can you give an example of the type of feature you were required to remove due to the approval process?
- passfree 12y ago
  Yes of course. We had to remove the integration with the notification API and also remove the facilities which allow us to install the CA certificate smoothly into your device. The second was flagged as breaking a clause which states that all applications should be self-contained. Which in our opinion is understandable concern although the feature would have saved a lot of people an extra step to get the CA and other certificates in the correct place in order to ensure smooth communication.
- monkey_slap 12y ago
  What blocked you guys (if you can say)? If I can give any tips, whenever I'm questioning if a feature is going to get called out when I submit an app, I always fill that "info for reviewer" section with tons of stuff. Explanations, links to docs & legal to show that I'm not doing anything against the law/rules.