121–130 of 173 posts
I haven’t had time to look at the code. Is this generating a unique root certificate per install? If not this could become an attack vector to decrypt TLS traffic.
How does this compare to using a hosts file with known ad servers? like: https://github.com/StevenBlack/hosts
An easy example for comparison is hosts file cannot block YouTube ads, while this one can.
I don't know how it actually works, but won't website like youtube simply deny you access if it detects that the ad related request timed out? I imagine that browser extensions actually tap into the site's code and somehow go around such detection. But if this is a simple firewall, how will this work against any website that doesn't just default to most trivial "import ad service", but rather actually takes steps to…
I've wondered what-if scenarios like this for a long time. I see them being implemented smaller websites, but never at scale like amazon.com or YouTube where they serve petabytes per second. My conclusion is: it gets so expensive to track and block users at session level that they just let go.
Although I think YouTube et al see an increasing amount of revenue and viewership coming from apps... and if they could, I suspect they would kill their web sites in favor of apps where they have much more control.
How does it work compared to a browser extension ad blocker ?
Browsers only work in the browser, this is system-wide
It's a very different story on mobile, but there, certificate pinning can also trivially bypass this kind of blocking, and for good reason too: Imagine a system-wide tool like this getting access to online banking credentials, for example...
Having just posted the app to a couple of small subreddits before sleep and then waking up to being on the front page over here is quite an experience :) I was hoping to make a Show HN post after giving Zen a bit more polish, but I guess here we are.
Thanks for all the constructive feedback. I totally share your concerns about its security and likewise wouldn't use some unverified application trying to install a root CA on my system. For those wanting to audit the certificate generation and installation code, feel free to take a look at certmanager/get.go and certmanager/install_{platformname}.go. It is mostly self-contained and, I hope, easy to understand. The lack of any instructions on how to delete the certificate is an oversight on my part, and I'll be working on this. Regarding the binaries: all of them are built on GitHub's CI. I wish there was a way for users to verify this fact, but to my knowledge, there is no way to do that currently. You can run and build the app yourself using Wails (https://wails.io/docs/gettingstarted/installation). I'll be sure to add more instructions to the repo in the coming days.
As always, any feedback, help, and suggestions are much welcome.
Earlier quoted context omitted.
No one will do this, and those that read source code during installation do not review it for every upgrade. It's one of those 'just do this!' arguments that has little to no basis in reality. There's more of them replying to the parent comment: "Just do this! Just compile a thing! Just verify signatures for every update!". Come on... Meanwhile the negatives immediately implicate anyone with access to the executable.…
If you really wanted/NEEDED this, you could definitely go through all the code. It would take a bit, but it's doable with determination (lol). Also, you don't have to necessarily review all of the code every update. All you have to do is view the changes/new commits every time you want to update. The hardest part is determining that you want to go through all of this hassle to replicate something browser extensions a…
> All you have to do is view the changes/new commits every time you want to update.
These can be thousands of lines of code per day in busy projects.
Earlier quoted context omitted.
No one will do this, and those that read source code during installation do not review it for every upgrade. It's one of those 'just do this!' arguments that has little to no basis in reality. There's more of them replying to the parent comment: "Just do this! Just compile a thing! Just verify signatures for every update!". Come on... Meanwhile the negatives immediately implicate anyone with access to the executable.…
I'm as paranoid about this as you, but this type of verification seems easier today with AI tools. I'm not aware of any that do this, but if LLMs can give insight about what a piece of code is doing, they can surely be trained to detect possible suspicious behavior. Perhaps even by inspecting a binary, but certainly by processing code.
It is just not wise to allow some random application to MiTM your SSL traffic.
How does this compare to using a hosts file with known ad servers? like: https://github.com/StevenBlack/hosts
Fuck the corporate-authoritarians who are taking away the freedom to do what we want to content that enters our machines. They've been fighting that war for a long time, and we can see through the tactics they've been using.
I've been using Proxomitron as a filtering proxy for over 2 decades after its author's death, and it is even more powerful than this (but requires more setup and tuning.)