91–100 of 128 posts
This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.
[dead]
This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.
Just fixed it and implemented a simple http relay, eliminating the mitmproxy and the ssl_insecure=true. The new implementation uses TLS verification, doing last tests and merging it... After the merge can you check it out and tell me if I earned your star? :D
Wonder if this is the end of HN.
This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.
Co-Authored-By: Claude Opus 4.5
I wonder how much this will end up costing the industry in aggregate.
Earlier quoted context omitted.
I’m not sure you fully understand the implications of the misconfiguration of mitmproxy there. Effectively you provided an easily accessible front door for remote code execution on a user’s machine. No offense, but I wouldn’t trust anything else you published. I think it’s great that you are learning and it is difficult to put yourself out there and publish code, but what you originally wrote had serious implications…
Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
Earlier quoted context omitted.
Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
No, you’re in the process of vibe coding stuff you don’t understand and you will most likely never understand until you take the time to open a book.
This is not a place for you to try and make yourself feel better by disparaging others.
Earlier quoted context omitted.
Co-Authored-By: Claude Opus 4.5
Ah, getting the job done by disabling important validation, if that isn't the most prominent Opus trait... I wonder how much this will end up costing the industry in aggregate.
HugstonOne uses Enforced Offline policy/ Offline switch because of that. Our Users are so happy lately :) and will realize it clearly in the future.