mhils

11 ms·

61.
by mhils 5y ago
Could you explain what your use case is? What format would you prefer?
62.
by mhils 5y ago
Shameless plug: We (mitmproxy) have a somewhat reasonable web UI (React/Typescript), but I think there's a lot more potential here. We're also looking for Google Summer of Code students at the moment, so if someone wants to s
63.
by mhils 5y ago
You can have both! mitmproxy will dump TLS master secrets for any app: https://docs.mitmproxy.org/stable/howto-wireshark-tls/
64.
by mhils 5y ago
Not yet. What works reasonably well is to iteratively work with a custom addon (addons are livereloaded on every change). But I'd love to see progress on that front, it'd make a great GSoC project! :)
65.
by mhils 5y ago
FWIW, you can disable the Issues tab on GitHub, there's a setting for it.
66.
by mhils 5y ago
As another pre-war take on the situation, I found this 2014 Chatham House panel discussion to have some really interesting perspectives: https://youtu.be/mxn_DdshwCc . Among the panelists are John Mearsheimer (arguing that N
67.
by mhils 5y ago
Thanks for the pointer! Do we have any idea why the Belgian DPA's press release would skip this part?
68.
by mhils 5y ago
I see your point, but one of the main problems of P3P was its complexity. There's more than two decades of privacy-enhancing technology research showing that privacy controls need to be fundamentally simple. I think DNT/GPC can be
69.
by mhils 5y ago
Nonsurprisingly, the Interactive Advertising Bureau has a slightly different spin on the ruling [1]: "APD Ruling Clears Way For Work on Developing TCF into a Formal GDPR Code of Conduct". I'm surprised that ICCL very assertiv
70.
by mhils 5y ago
https://globalprivacycontrol.org/ goes kind of in that direction. It's a rebranded Do Not Track header, but referencing specific privacy rights under GDPR/CCPA. That hopefully makes it enforceable, whereas adverti
71.
by mhils 5y ago
I absolutely agree that shorter lifetimes are likely preferrable over the additional complexity that comes with OCSP Must-Staple. That being said, one benefit of OCSP Must-Staple is that you don't need to authenticate yourself to get t
72.
by mhils 5y ago
FWIW mitmproxy shouldn't downgrade HTTP/2, at least if you have a version that was released in 2016 or later. If that's not the case please feel free to file a bug and I'll look into it. :)
73.
by mhils 5y ago
Legitimate interest being opt-out makes sense, for example for fraud prevention. I absolutely agree though that adtech often blatantly claims they would have a legitimate interest, whereas they should ask for (opt-in) consent.
74.
by mhils 5y ago
Last message in the thread: > I'm going to go ahead and guess that the problems discussed were fixed, and I'm closing this bug report. If there's anything more to be worked on here, please send a mail to the debbugs addre
75.
by mhils 5y ago
You can export to cURL/httpie export in mitmproxy, it'll be exposed in mitmweb with the next release. :) For automation, take a look at https://docs.mitmproxy.org/stable/overview-features/#server-... !
76.
by mhils 5y ago
Yes, exactly!
77.
by mhils 5y ago
If your server is really just one service on one port, I would just run mitmproxy as a reverse proxy and point your client to that ( https://docs.mitmproxy.org/stable/concepts-modes/ ). If there are multiple service
78.
by mhils 5y ago
Starting with this release you do see TCP-over-TLS in the flows view, we have a small screenshot in the blog post. Interception/modification is still something where we need to iron out the UX for, with version 7 you can at least injec
79.
by mhils 5y ago
I don't recall what changed with v3, but sorry for letting you down. Shortcuts are fully configurable since a few releases: https://docs.mitmproxy.org/stable/concepts-commands/#custom-... . If you have specifi
80.
by mhils 5y ago
If you (or anyone else reading this) is interested, please do reach out on GitHub or our dev Slack. Happy to help you get started. :)
81.
by mhils 5y ago
The currently focused flow should never change when a new one comes in. If that's happening to you, please file a bug over on GitHub or ping me on our dev Slack and we'll get this fixed ASAP. :)
82.
by mhils 5y ago
We have a super diverse userbase, so this is a fun question! Some pointers: Development: - Debug your own apps/devices (which do not come with Chrome Devtools). - Simple Python scripts to replace/inject website content. ( https:&#
83.
by mhils 5y ago
mitmproxy does lookup the upstream certificate by default, but at the moment we only transfer common name, subject alternative names and (new) organization name. The good news is that with version 7 it's very easy to add more here, I&#
84.
by mhils 5y ago
Could you clarify what you mean by packet? Are you talking about HTTP requests or about the new non-HTTP TCP streams? The UI/UX for the latter is very much work-in-progress.
85.
by mhils 5y ago
I think that's a classic "it depends". I see two main challenges for IoT monitoring: 1. Getting the IoT traffic to your proxy machine. As you say this is fairly trivial when you can set a proxy, but a bit tricky otherwise as
86.
by mhils 5y ago
Thanks for the kind words! We have a Google Summer of Code student working with us on mitmweb, our web interface, at the moment, so we'll hopefully have a better GUI story soon as well :)
87.
by mhils 5y ago
If I'm not mistaken they are built from scratch, but that part wasn't built by me. IMO the by far hardest part is actually writing the docs. :)
88.
by mhils 5y ago
Our main docs are built with Hugo ( https://github.com/mitmproxy/mitmproxy/tree/main/docs ). For our API docs we use pdoc ( https://pdoc.dev ), which integrates well with most static site generat
89.
by mhils 5y ago
Mitmproxy dev here, happy to answer any questions! :)
90.
Mitmproxy 7.0(mitmproxy.org)
258 points by mhils 5y ago|75 comments

More ›