Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Httptap: View HTTP/HTTPS requests made by any Linux program

github.com

Post reply on HN
Print view View original

131–140 of 148 posts

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#131

Post by RajT88 »

xg15 wrote: post #113
yoavm wrote: post #4

The "How it was made" section of the README was not less interesting than the tool itself: > The way we have set things up is that we live and practice together on a bit over a hundred acres of land. In the mornings and evenings we chant and meditate together, and for about one week out of every month we run and participate in a meditation retreat. The rest of the time we work together on everything from caring for t…

> For the past few years we have been recording a lecture series called Buddhism for AI. It's about our efforts to design a religion (yes, a religion) based on Buddhism for consumption directly by AI systems. We actually feel this is very important work given the world situation. I think it's an indicator of just how weird the times we're currently living in really are, that this part actually makes perfect sense...…

There was a cool Korean movie which featured a robot Buddha, "Doomsday Book".

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#132

Post by taurknaut »

RajT88 wrote: post #130
taurknaut wrote: post #128

Earlier quoted context omitted.

You'd think that the people willing to talk to a chatbot would not be willing to discuss the self with any honesty, but I'm continually surprised by the world.

I have a friend who has mental health issues thanks to what life has thrown at her. ChatGPT gives out surprisingly solid advice and feedback. It is a bad look that ChatGPT is more emotionally intelligent than her friends.

> It is a bad look that ChatGPT is more emotionally intelligent than her friends.

Shitty humans are forever.

Regardless, I have an extremely hard time imagining that LLMs as they stand are capable of delivering anything but the most shallow of support.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#133

Post by RajT88 »

taurknaut wrote: post #132
RajT88 wrote: post #130

Earlier quoted context omitted.

I have a friend who has mental health issues thanks to what life has thrown at her. ChatGPT gives out surprisingly solid advice and feedback. It is a bad look that ChatGPT is more emotionally intelligent than her friends.

> It is a bad look that ChatGPT is more emotionally intelligent than her friends. Shitty humans are forever. Regardless, I have an extremely hard time imagining that LLMs as they stand are capable of delivering anything but the most shallow of support.

Being bad at emotions does not necessarily make you a shitty person.

If I showed you the transcripts you too would be impressed! I can assure you of that.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#134

Post by dspillett »

gear54rus wrote: post #125
dspillett wrote: post #124

Earlier quoted context omitted.

> especially if it doesn't require proxy configuration It does require trusting a local CA, or apps away from the browser being configured not to validate CAs (or trust the new CA) if they don't push responsibility for that to the OS-level support. I'm not sure it would be a good idea for the non-technical public: teaching them how to setup trust for a custom CA and that it is sometimes a good thing to do, would lead…

> How many times have we seen people install spyware because of claims that it will remove spyware? That is the kind of example that completely disproves your point. How many times do we have to fall into 'just lock everything down for safety' pit and end up with being forced to look at even more ads as a result before we learn? The only way to be safe is to be informed, 'just works' doesn't exist. Don't trust anyone…

> The only way to be safe is to be informed

Unfortunately getting everyone into an informed state is a massive and so far unattainable task, and those not well-informed are not just a potential danger to themselves but to the rest of the network, so we need fail-safe protections in place and to not encourage people to disable them for the sake of convenience.

> Don't trust anyone but yourself.

But do encourage people to trust a CA they have no knowledge how to verify? That CA could also sign things that happen in the background so trusting is potentially trusting a huge portion of the Internet with no further stopping points for the user to verify trust. Your point seems to be internally contradictory.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#135

Post by Thorrez »

dspillett wrote: post #122
bityard wrote: post #98

Earlier quoted context omitted.

A "cult" is a rather specific kind of organization. The typical hallmarks are non-mainstream spiritual beliefs, highly controlling and exploitative leadership, and rules against interacting with outsiders. Non-conformity generally results in outsized (sometimes violent) punishment and shame. Under this definition, for example, Catholic nuns are decidedly not a cult. They know what they are in for when the join, and m…

I think the “[non]mainstream” just changes the word, not the concept. A cult is an organised power-based religion with few members, an organised religion is often cult with many members. Aside from scale, age, and a few superficial differences, I don't see much distinction between, for example, Catholicism and Scientology. Spiritual beliefs don't even have to come into it: some political or sociological movements and…

>I don't see much distinction between, for example, Catholicism and Scientology.

If someone leave Scientology, they're shunned by the rest of their friends and family who are still in Scientology. Not the same for Catholocism.

https://en.wikipedia.org/wiki/Disconnection_(Scientology)

Also see these schemes:

>Under this program, Scientology operatives committed infiltration, wiretapping, and theft of documents in government offices, most notably those of the U.S. Internal Revenue Service.

https://en.wikipedia.org/wiki/Operation_Snow_White

>Operation Freakout, also known as Operation PC Freakout, was a Church of Scientology covert plan intended to have the U.S. author and journalist Paulette Cooper imprisoned or committed to a psychiatric hospital.

https://en.wikipedia.org/wiki/Operation_Freakout

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#136

Post by ranger_danger »

adtac wrote: post #75
ranger_danger wrote: post #23

Why not use eBPF instead? Then you could see all http requests from all processes at once, including ones that are already running. Plus you wouldn't need to bother with TLS at all, just hook on e.g. write(2).

How would hooking on write(2) solve TLS? You'll be able to read and modify the ciphertext, but the process will never call write(2) with the plaintext bytes, so you can't actually read the HTTP request. You'll just see the encrypted bytes that go on the wire, but so does the NSA :) You need the kind of CA certificate trick that httptap uses. It comes with its own set of caveats (e.g. certificate pinning), but it can…

My understanding is that typically a TLS library provides a socket interface for the application to write() to, which can be intercepted by an eBPF program.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#137

Post by dspillett »

Thorrez wrote: post #135
dspillett wrote: post #122

Earlier quoted context omitted.

I think the “[non]mainstream” just changes the word, not the concept. A cult is an organised power-based religion with few members, an organised religion is often cult with many members. Aside from scale, age, and a few superficial differences, I don't see much distinction between, for example, Catholicism and Scientology. Spiritual beliefs don't even have to come into it: some political or sociological movements and…

>I don't see much distinction between, for example, Catholicism and Scientology. If someone leave Scientology, they're shunned by the rest of their friends and family who are still in Scientology. Not the same for Catholocism. https://en.wikipedia.org/wiki/Disconnection_(Scientology) Also see these schemes: >Under this program, Scientology operatives committed infiltration, wiretapping, and theft of documents in gove…

> If someone leave Scientology, they're shunned by the rest of their friends and family who are still in Scientology. Not the same for Catholocism.

Not officially across the whole church, at least not these days, but it certainly happens in some small subsets of the Catholic community and has happened in larger subsets in the not-to-distant past. Any large enough religion tends to develop localised sub-cults.

Stepping away from the Catholics and considering other Christian groups, it definitely happens in small-town America. While there is often some extra factor (daring to be different in some other way), there isn't always, and when there is the extra factor is usually framed as being against the religion or its deit{y|ies}. Sometimes the extra factor itself results in ostracisation from the local church community, so people end up in the same position through a different ordering of the same steps and/or different levels of voluntaryness.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#138

Post by mhss »

yoavm wrote: post #72
erdii wrote: post #11

Earlier quoted context omitted.

To be honest: This sounds like just another of the many many other yoga/spiritual cults that currently exist all over the western world. EDIT: typos and slight wording changes

I believe I grew up in a cult myself, and one of the things I've concluded from that experience, and from leaving it, is that everywhere is a cult. Humans have a tendency towards cult-ish life, and if the cult is big enough we just refer to it as "society". People were as afraid (more or less) to leave the cult I was at, as people are around me now when they consider doing anything that is out of the norm. By no mean…

My understanding is that the definition of cult requires a common object of devotion. What's that object of devotion for "society"? it's too large and diverse of a group to categorize it as such IMHO. I agree however that sometimes people will categorize anything strongly deviating from the norm as cult-ish.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#139

Post by ddelnano »

farnulfo wrote: post #114
ranger_danger wrote: post #106

Earlier quoted context omitted.

absolutely

eBPF TLS tracing: The Past, Present and Future https://blog.px.dev/ebpf-tls-tracing-past-present-future/

Author here :). Happy to answer any questions on this TLS tracing stuff.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#140

Post by redleader55 »

fcpk wrote: post #127

Sadly, certificate pinning/certificate transparency makes this not so useful for apps that want to enforce security. It would be very interesting to get something that can actually hook into the most common ssl libraries and/or decryption functions, and tries to dump things on the fly. Sure it'll still be blocked if there's tampering detection, but at least it could give some real transparent insight on calls done by…

In a few years there will be someone, probably much smarter than me, that figures out how to automatically bypass the checks for the certificate pins and solve 99% of the cases that don't work today.
Post reply on HN