mhils

18 ms·

121.
by mhils 8y ago
Instead of throttling, you could also consider doing incremental brownouts where you drop requests for the first ten minutes every hour. PyPI did this recently when they phased out TLS 1.0, which worked really well IMO.
122.
by mhils 8y ago
GitHub's permission system is quite brittle here: Anyone with write access to a repository can silently swap out binaries on the releases page, which are then still listed as "Verified" if the commit is signed. It's a co
123.
by mhils 9y ago
> What TLS 1.3 does appear to do is make it harder to optimize this proxying, and make it impossible to be selective about what you proxy. You have the ServerNameIndication (SNI) in the ClientHello, so selective proxying is very easy to
124.
by mhils 9y ago
Well I agree. My main concern is that we're loosing that control in the name of security, in particular on mobile devices. Take Android as an example, which doesn't respect user-added CAs anymore for application traffic [1]. It&#x
125.
by mhils 9y ago
This needs to be highlighted more often. TLS interception can be a very effective tool to expose insecure APIs and blatant privacy violations. It's ultimately a tradeoff between security (no bad interception) and privacy (no idea what
126.
by mhils 9y ago
Not yet, although this would make a great fit for the new addon mechanism. :)
127.
by mhils 9y ago
It's technically possible, but requires iptables or equivalents. For now, if you want to proxy the whole machine, Charles is your way to go!
128.
by mhils 9y ago
Decompression is usually done automatically, we also try to render some binary application-layer protocols (e.g. protobufs). If you feel that wasn't the case, please lodge an issue on GitHub. :)
129.
by mhils 9y ago
Thanks! This is something we're subconsciously aware of, but it's helpful to hear it as explicit feedback. :) The first steps towards that were indeed OS-specific install instructions on our new website. We currently have a user
130.
Show HN: Mitmproxy 3.0 released, an open-source console-based proxy(mitmproxy.org)
242 points by mhils 9y ago|39 comments
131.
by mhils 9y ago
1. You can `--ignore` specific domains in mitmproxy, and since the ignore pattern is a regex you should be able to construct something that says "ignore everything but those domains" (the ones you then want to block). 2. I think t
132.
by mhils 9y ago
Asking the right questions. :-) This is based on mitmproxy, so upstream certificates should be verified by default. I haven't played around with Chomper, but we have extensive tests for this in mitmproxy. To be clear, compared to brows
133.
by mhils 9y ago
captn3m0 is proposing that you use the server name from the TLS ClientHello message (it's in the SNI extension) to determine if a website should be blocked, and if not, you don't perform a man-in-the-middle attack but just forward
134.
by mhils 9y ago
From the linked document: > Deutsche Telekom Mirai disruption in late November 2016. My hastily assembled initial TR069/64 payload only performed a 'route del default' [...] AFAIK this is not what happened. Deutsche Teleko
135.
by mhils 9y ago
Congrats on the launch and thanks for using mitmproxy! :-)
136.
by mhils 9y ago
This is true for the app store top 10, but from what I've seen not much out of that. In practical terms, the bigger problem is Android 8, which does not trust user-added CAs for app traffic ( https://github.com/mitmprox
137.
by mhils 9y ago
Mitmproxy dev here - please feel free to file a bug on GitHub if you have a reproducible example where we fail. :)
138.
by mhils 9y ago
iOS' App Transport Security is friendly to researchers that install their own CA. Android Nougat is much worse in this regard: Apps disrespect any user-added CAs, which really doesn't contribute to Android's security level bu
139.
by mhils 9y ago
If you have feedback regarding the web ui: We are very receptive to that. :)
140.
by mhils 9y ago
Nitpick: They would still fail for DNS issues with *.github.com, so a domain like githubstatus.com would be even more resilient.
141.
by mhils 9y ago
For Android < N, if you install a custom CA, you'll get a permanent "Network may be monitored by an unknown third party" notification that cannot be dismissed and stays across reboots. Android wasn't really "ins
142.
by mhils 9y ago
+1 to this. We (mitmproxy) see the changes in Android Nougat as a very unfortunate development for this kind of privacy research. :( Some context: https://github.com/mitmproxy/mitmproxy/issues/2054
143.
by mhils 10y ago
I'm a GSoC org admin for a few years now. To be honest, the bureaucracy that comes with GSoC is really negligible from my point of view. The application form is fairly short, the evaluations during the summer are literally done in five
144.
by mhils 10y ago
The Zero-Width-Joiner allows for some really strange things: https://blog.emojipedia.org/ninja-cat-the-windows-only-emoji... . One can basically achieve an unlimited number of emojis by concatenating the current ones.
145.
by mhils 10y ago
Not for normal minesweeper, but there are always-solvable variants: http://www.chiark.greenend.org.uk/~sgtatham/puzzles/js/mines...
146.
by mhils 10y ago
Does Cloudflare have complete logs to rule out that someone noticed this before taviso and used it to massively exfiltrate data by visiting one of the vulnerable sites repeatedly? If they can't tell, someone may now be sitting on a lo
147.
by mhils 10y ago
Thanks! We actually use https://github.com/python-hyper/hyper-h2 to implement mitmproxy's HTTP/2 support and have our own HTTP/2 mini-stack for fuzzing that (which is also exposed in pathod).
148.
by mhils 10y ago
Not sure if this answers your question: You can download our precompiled standalone binaries from https://github.com/mitmproxy/mitmproxy/releases/ , run the mitmweb executable and your browser should open.
149.
by mhils 10y ago
> I hope this doesn't mean that the command-line interface is going to become a second-class interface? No worries - the command line interface is definitely staying a first-class interface. We're also planning to mirror the CL
150.
by mhils 10y ago
Author(s) here - happy to answer any questions and take feedback! :)

More ›