8 ms·
Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most o
by pilif 12y ago
Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody).
The solution for this problem: Use SSL.
I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data over the mobile network, you practically must use SSL if you want any kind of guarantees that the data you send to the server is what actually reaches the server (and reverse).
Here's my war story from last year: http://pilif.github.io/2013/09/when-in-doubt-ssl/ http://pilif.github.io/2013/09/when-in-doubt-ssl/
- ctz 12y agoThis would require a vast, vast upgrade of client power to achieve the same communications performance. If you could achieve it all, SSL would also likely decrease reliability over a spotty GSM link.
- pjc50 12y agoIs client CPU actually a limiting factor? How does this affect reliability?
- serf 12y agoas someone unfamiliar with their specific workload, but who has used such boards to do vpn/ssl stuff, no -- it's not a limiting factor unless trying to skim power requirements.
- ctz 12y agoYou cannot physically fit a whole SSL datagram (max size 16KB) into 8KB of RAM. SSL requires multiple passes over the data to (eg) decrypt and verify a datagram. At this point, you cannot use standard SSL at either the server side or client side. On the subject of reliablity: a 8 bit uC running at 16MHz needs a long time to do the public key crypto required to set up the connection. This means you need a GSM data link to be continuously available for a longer period.
- pjc50 12y agoThis is true, but if you're using GSM you have a much beefier processor handling the GSM side and there's no need to use a tiny microcontroller. Some of the GSM modules will offload the whole HTTP(S) request for you. Edit: or you could get a Cortex-M0 with 32K RAM for $2.
- MichaelGG 12y agoSSL supports a null cipher, so why not use that? The handshake alone may be enough to prevent packet inspection.
- pavel_lishin 12y agoWho was replacing numbers with asterisks, and for what purpose?
- goleksiak 12y agoI didn't want to hang our BasicAuth creds out to dry
- lclarkmichalek 12y agoYou were sending them over http, so aren't they already kinda fucked?
- goleksiak 12y agoy, true
- pavel_lishin 12y agoOh, I was asking pilif to comment about their experience.
- pilif 12y agoThat was a "privacy" mode of some personal firewall that was protecting the user's phone number from leaking out. Incidentally, this has leaked the users phone number because only that specific numer was being replaced with asterisks. Welcome to the world of very crappy "security" (-theater) end-user products.
- goleksiak 12y agoWe would really like to use HTTPS but it's not supported by the Arduino chipset as I understand it. Though I'm not the hardware guy here at eatabit...
- angersock 12y agoWhy don't you guys just use a Beaglebone Black ($50), M2M cape (http://www.yantrr.com/products/m2m-cape-for-beaglebone http://www.yantrr.com/products/m2m-cape-for-beaglebone), and a thermal printer (https://www.sparkfun.com/products/10438 https://www.sparkfun.com/products/10438). BOM for that, plus project enclosure, is like $200. That's also just after a bit of quick googling...there's bound to be a much cheaper solution. What's your price point for hardware?
- goleksiak 12y agoWe are at about $200 now for hardware. We have a custom PCB and 3d printed case. We also have an LCD and some control knobs in the mix. Checking out the Beaglebone stuff now...very interesting since there is basically no 3G/4G modems for Arduino right now...
- angersock 12y agoI'm just curious why the default response is still to reach for an Arduino--much more powerful SoC chips are cheap these days.
- goleksiak 12y agoFor us, the reason is that my co-founder and I (both are not hardware guys) were able to build a proof of concept in my garage and Arduino seemed like the best (easiest) choice. Since then, we hired a hardware guy who designed a custom PCB etc. HTTPS would be great but we don't transmit any personal data so it's not a high priority right now.
- Alupis 12y ago
- rubiquity 12y agoCowboy is the name of an Erlang web server and Heroku uses Erlang for their routing. I imagine the reason Cowboy is showing up is due to Heroku's routing layer.
- pilif 12y agoI would agree, but the fact that it suddenly stopped working points to carrier interference rather than Heroku (because as a developer focussed company, they would have informed OPs company of the change)
- shawabawa3 12y agoIt seems it is on Heroku's end. https://news.ycombinator.com/item?id=8515164 https://news.ycombinator.com/item?id=8515164
- monokrome 12y agoHeroku isn't in a frozen state. I'm sure that they change the code daily. The fact that it suddently stopped working doesn't really point to any specific endpoint unless you know which ones have changed. Then it might mean something.
- mentat 12y agoOr perhaps they would have noticed increased error rates for a client and investigated. Monitoring right?
- deleted 12y ago[deleted]
- ldng 12y agoWhat's wrong with transparent proxy ? Isn't how HTTP caching is supposed to work ? I would think the cache headers are the solution rather than SSL. It feels like you are kind of throwing the baby with the bath water. IMHO, badly configured transparent proxy does not mean the concept is bad, does it ?
- pilif 12y agoThe problem is that you have no recourse. When the carrier decides to f up your connections somehow, you can try to work around the issue, until they break it some more to the point where the one thing you really needed also stopped working. Then you can hope that you are big enough to have priority with the carrier or you know somebody who knows somebody who can fix it. Or you don't deal with any of this and just go SSL. A certificate will cost you $100 per year in the worst case. Thats about one hour of your time spent fixing proxy issues (not including customers and/or end users breathing down your neck because their software just stopped working for some as yet unknown reason)
- ldng 12y agoExcept the carrier, or the that case the hoster, did not break anything. It's their software that don't comply to the RFC. HTTP is supposed to be cacheable when it makes sens. With SSL to work that around you break the Internet somehow. To me, there are valid usecase for SSL, using it to work around proxies is not one. That said, I get your point, you prefer the possibly easier and safer way. But you still might run into another set of problems (https://news.ycombinator.com/item?id=8471877 https://news.ycombinator.com/item?id=8471877).
- fulafel 12y agoNo, "transparent proxying" is a clear violation of HTTP specs (as well as TCP protocol, and IP's "thou shall not mess with packets in transit" principle/specs). It's essentially a MITM attack and all bets are off wrt correctness.
- ldng 12y ago