Hacker News Reader

Comment by armitron | Hacker News Reader

Nice idea but terrible implementation. Mitmproxy solves a lot of annoying problems, but, Python holds it back to such an extent that it's hard to make the case for deploying it in production due to massive inefficiencies.

Can't wait for someone to do it in Go.

View on HN

I thought mitmproxy was designed to make it easier to debug stuff in a local environment. Why would you want to deploy it to production? How would you use it?

I’m also curious about the use case. For debugging things locally, it is ideal for my needs.

Many different applications: Red/blue teaming, metric collection, policy-based decision making.

Seems like a bit of a foot-gun to do these things by effectively undermining your own security.

Red teaming at least is all about undermining ~your security. ;)

Maybe they write malware?

One of the things I like about mitmproxy is how easy it is to develop and use addons. You just pass a script file to it. How would you achieve such painless extensibility if it were written in Go?

Exactly this.

It's very hard to do with Go; also see Hugo, where Go is in many ways "holding it back" compared to something like Jekyll, which you can customize and hack with great ease.

I love Go, but this kind of things is not where it shines.

Not sure I understand "MITM" and "in production".

Every single major corporation does "MITM in production".

mitmproxy is explicitly intended as an interactive MITM for debugging: "your swiss-army knife for debugging, testing, privacy measurements, and penetration testing".

What you're talking about here was never a goal. And being in Python means it's much easier to extend, which is also greatly useful.

Well, okay, got me. But you don't need to do what mitmproxy does in that case.

This isn't a replacement for a Bluecoat, this is a developer/debugger application.

FWIW: I'm building something in Go (https://github.com/dstotijn/hetty). But it's pretty early stage and not even near the featureset that mitmproxy or Burp Suite has. Also I wouldn't dare say it's more efficient (yet!). But Go has been great so far to build it.

As mentioned elsewhere: (dev friendly) extensibility/add-ons with Go will be an interesting challenge. Haven't looked into it yet.

This banana is delicious but makes for a terrible automobile. I wish someone would make a banana that could get me to work on time.

In other news I know of a MitM proxy that works as advertised, has a decent UI, and is reasonably tasty.

Check out bettercap

Reply on news.ycombinator.com