111–120 of 128 posts
Earlier quoted context omitted.
Ah, getting the job done by disabling important validation, if that isn't the most prominent Opus trait... I wonder how much this will end up costing the industry in aggregate.
I’m thinking of pivoting into cybersecurity. I suspect that’s where the all money will be in the next couple of years.
Earlier quoted context omitted.
Ah, getting the job done by disabling important validation, if that isn't the most prominent Opus trait... I wonder how much this will end up costing the industry in aggregate.
Not entirely different from many human engineers...
Earlier quoted context omitted.
Curious to see how you can get Gemini fully intercepted. I've been intercepting its HTTP requests by running it inside a docker container with: -e HTTP_PROXY= http://127.0.0.1:8080 -e HTTPS_PROXY= http://host.docker.internal:8080 -e NO_PROXY=localhost,127.0.0.1 It was working with mitmproxy for a very brief period, then the TLS handshake started failing and it kept requesting for re-authentication when proxied. You c…
Gemini CLI is open source. Don't need to intercept at the network when you can just add inspectGeminiApiRequest() in the source. (I suggest it because I've been maintaining a personal branch with exactly that :)
Earlier quoted context omitted.
>tell me if I earned your star Since you asked: Not in a million years, no. A bug of this type is either an honest typo or a sign that the author(s) don't take security seriously. Even if it were a typo, any serious author would've put a large FIXME right there when adding that line disabling verification. I know I would. In any case a huge red flag for a mitm tool. Seeing that it's vibe coded leads me believe it's d…
I love the real feedback tbh, I am still learning, and want to learn as much as possible. Would love if you can review it and tell me bluntly either in the repo or here the things that should be improved. I would love to learn more from you and get better :D
Earlier quoted context omitted.
I’m not sure you fully understand the implications of the misconfiguration of mitmproxy there. Effectively you provided an easily accessible front door for remote code execution on a user’s machine. No offense, but I wouldn’t trust anything else you published. I think it’s great that you are learning and it is difficult to put yourself out there and publish code, but what you originally wrote had serious implications…
Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
There is no need for MitM, you can set Api base address to your own proxy in all the coding assistants (at least all I know - Claude Code, opencode, gemini, vc plugin).
The changes I made allow use of the models endpoint in litellm at the same base url as telemetry and passing through Claude Max auth. This is not about using your Max with another cli tool, but about recording everything that happens.
There is a tool that can send CC json logs to langfuse but the results are much inferior. You loose parts of the tool call results, timing info etc.
I'm quite happy with this. If anyone is interested I can post a github link.
This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.
Earlier quoted context omitted.
Gemini CLI is open source. Don't need to intercept at the network when you can just add inspectGeminiApiRequest() in the source. (I suggest it because I've been maintaining a personal branch with exactly that :)
Ahh, that seems much simpler. Dump the request / response directly. Now I'm wondering if I can use Gemini to patch Gemini.
Earlier quoted context omitted.
I’m thinking of pivoting into cybersecurity. I suspect that’s where the all money will be in the next couple of years.
At least until the pivot by Claude et al from AI for work to AI for cybersec analysis.