Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Subtrace – Wireshark for Docker Containers

github.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: Show HN: Subtrace – Wireshark for Docker Containers

#51

Post by chatmasta »

adtac wrote: post #5
smw wrote: post #3

Can it decrypt tls? Perhaps by hooking the calls to common libraries?

Yes, but we've managed to do it automatically without any library/language specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS root CA certificate and inject it into the system store. The generated certificate is entirely in-memory and never leaves the machine. To make this work without root privileges, we intercept the open(2) syscall to see if it's /etc/ssl/certs/ca-…

This is a great hack. It won’t work 100% of the time but it’ll be close, and damn it’s just so clean. Proxies and intercepts all the way down… I love this.

Re: Show HN: Subtrace – Wireshark for Docker Containers

#52

Post by chatmasta »

adtac wrote: post #23
Arnavion wrote: post #21

Earlier quoted context omitted.

This will not work with HPKP but hopefully nothing is using that any more. ( https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) It won't work with programs that defensively validate the cert chain but those are rare. It won't work with programs that embed their own root cert store, which is also rare but I would guess less rare than the previous one. The usual reason to do this is to minimize OS deps, and in t…

Yep, certificate pinning is the one scenario Subtrace can't handle in my experience, but thankfully, it's fairly rare like you said. And IMO there is no general solution to the problem [1], but it's one of those very interesting problems to daydream thinking about when you're stuck in traffic or whatever :) We still try our best by handling as much of the long tail of environments with some library/framework specific…

No general solution? :) If you came up with this hack I’m sure you can extend it…

Cert pinning has to read a public cert from memory, right? And a public cert has a well-known shape… and you have bpf and access to the memory…

Re: Show HN: Subtrace – Wireshark for Docker Containers

#53

Post by 0xbadcafebee »

dang wrote: post #47
codegeek wrote: post #39

Side question. Why not do a Launch HN instead of Show HN since you are backed by YC ? I thought YC companies can do a launch HN?

They can, but for open-source startups I recommend they do a Show HN first, for the following reasons: (1) If the Show HN succeeds, then they can save their Launch HN card to play later; if it doesn't succeed, they can go ahead and do a Launch HN soon afterwards. (2) Show HN is more about the project/tech, especially when it's open-source. Launch HN is more about the startup/business. (3) Nowadays many startups offer…

There needs to be a new term for this grassroots astroturf... Grasstroturf? Get the nerds' attention with free tech, down-playing the fact that it's a business, so later they can pump them for money easier. The pig doesn't want to see the knife, they just want the free trough.

Re: Show HN: Subtrace – Wireshark for Docker Containers

#54

Post by dang »

0xbadcafebee wrote: post #53
dang wrote: post #47

Earlier quoted context omitted.

They can, but for open-source startups I recommend they do a Show HN first, for the following reasons: (1) If the Show HN succeeds, then they can save their Launch HN card to play later; if it doesn't succeed, they can go ahead and do a Launch HN soon afterwards. (2) Show HN is more about the project/tech, especially when it's open-source. Launch HN is more about the startup/business. (3) Nowadays many startups offer…

There needs to be a new term for this grassroots astroturf... Grasstroturf? Get the nerds' attention with free tech, down-playing the fact that it's a business, so later they can pump them for money easier. The pig doesn't want to see the knife, they just want the free trough.

FWIW, I've spent time at YC open-source events where later-stage founders advise earlier-stage ones, and this isn't anything like the advice they give. They would describe that as a terrible strategy and tell startups to avoid it.

An example of actual advice I've heard, using the terms of your comment, might be: keep "the nerds" happy with free open-source software that actually works, then charge money for things that companies (especially enterprise companies) actually prefer to pay for.

The "paid hosted offering" pattern is the most common of these, since technical users might want to run their own instances but IT departments typically do not.

Re: Show HN: Subtrace – Wireshark for Docker Containers

#55

Post by adtac »

chatmasta wrote: post #52
adtac wrote: post #23

Earlier quoted context omitted.

Yep, certificate pinning is the one scenario Subtrace can't handle in my experience, but thankfully, it's fairly rare like you said. And IMO there is no general solution to the problem [1], but it's one of those very interesting problems to daydream thinking about when you're stuck in traffic or whatever :) We still try our best by handling as much of the long tail of environments with some library/framework specific…

No general solution? :) If you came up with this hack I’m sure you can extend it… Cert pinning has to read a public cert from memory, right? And a public cert has a well-known shape… and you have bpf and access to the memory…

in a different context, maybe: https://news.ycombinator.com/item?id=38044786 :)

Re: Show HN: Subtrace – Wireshark for Docker Containers

#58

Post by 1oooqooq »

cyberax wrote: post #14
adtac wrote: post #5

Earlier quoted context omitted.

Yes, but we've managed to do it automatically without any library/language specific hooks! It's probably one of my favourite things in Subtrace :) We generate an ephemeral TLS root CA certificate and inject it into the system store. The generated certificate is entirely in-memory and never leaves the machine. To make this work without root privileges, we intercept the open(2) syscall to see if it's /etc/ssl/certs/ca-…

I can't decide if I'm horrified or amazed by this :)

as with anything too clever and undocumented, you will be amazed until you waste a few weeks debugging an issue caused by it.

Re: Show HN: Subtrace – Wireshark for Docker Containers

#59

Post by Mekoloto »

adtac wrote: post #36
qwertox wrote: post #31

Wireshark seems a bit misleading. More like a "network inspector" if one leans towards the browser's network tab in the inspector? But it really looks useful and I'll definitely play with it to see if I put it into my toolbox.

Thanks! re the Wireshark analogy: the reason I used that was because: (1) Subtrace operates at roughly the same level in the operating system stack, (2) has similar capabilities, (3) has an overlap in use-cases, and (4) has been the most effective at communicating what Subtrace is in my experience so far. I can see why the analogy is not a perfect 1:1 mapping (obligatory xkcd: https://xkcd.com/624 ), but naming thing…

Wireshark is a weird choice in my opinion because you know, why would i use Subtrace if i can use Wireshark?

and People who don't know how to use Wireshark want probably a better motivation to use Subtrace than 'its like wireshark' because there is a reason why they don't use it.

Re: Show HN: Subtrace – Wireshark for Docker Containers

#60

Post by gerwim »

Looks great! Reading through the docs it seems the subtrace process sends all data to your server. I'm reluctant to do that on a production environment, where API keys and personal data are being handled.

Is there any way to run it completely self hosted? If not, are there plans? And how will you monitize self hosted options (if it's possible)?

Post reply on HN