Hacker News: mhils

New comment by mhils in "Pdoc – Generate API documentation for Python projects"

mhils — Tue, 07 Oct 2025 17:08:40 +0000

FWIW I agree that the Rust way is nicer, but I can't impose the Rust way on Python. I guess the secret hack is to use PyO3, which pdoc supports quite well. ;)

New comment by mhils in "Pdoc – Generate API documentation for Python projects"

mhils — Tue, 07 Oct 2025 17:06:59 +0000

pdoc3 is not pdoc, see https://github.com/mitmproxy/pdoc?tab=readme-ov-file#pdoc-vs....

New comment by mhils in "Pdoc – Generate API documentation for Python projects"

mhils — Tue, 07 Oct 2025 09:08:46 +0000

Let me try to explain why it is that way: First, it's consistent with Python functions. The docstring for functions is below the signature as well. Second, consider a file with only a docstring and then a variable declaration. Here it would be ambiguous if that's the module or the variable docstring. Finally, this behavior is consistent with other tools (and failed standardization efforts) in the space. So yeah - I share your sentiment, but I think it's the most pragmatic approach for pdoc. :)

New comment by mhils in "Pdoc – Generate API documentation for Python projects"

mhils — Tue, 07 Oct 2025 08:54:33 +0000

pdoc maintainer here. Pleasant surprise to see us on HN again, and happy to answer any questions! :)

New comment by mhils in "Pdoc – Generate API documentation for Python projects"

mhils — Tue, 07 Oct 2025 08:34:45 +0000

I'd say neither fork as made great strides since then, but I'm also biased here as the maintainer of pdoc.

There is no pdoc-specific library for link checking as far as I'm aware. It's all plain HTML though, so you can use a more general tool like https://lychee.cli.rs/. :)

New comment by mhils in "Show HN: Subtrace – Wireshark for Docker Containers"

mhils — Thu, 20 Feb 2025 14:12:48 +0000

Congrats on the seccomp-based interception, that's a really neat way to solve this problem! We did some BPF_PROG_TYPE_CGROUP_SOCK eBPF shenanigans in mitmproxy for redirection, but that doesn't work with containers at all. Cool to see that intercepting all relevant syscalls works that well.

New comment by mhils in "Httptap: View HTTP/HTTPS requests made by any Linux program"

mhils — Mon, 03 Feb 2025 22:11:57 +0000

This is really cool, thank you for sharing! We've built a similar feature for mitmproxy lately, but with different tradeoffs. Our approach does require root and we don't have automated certificate install (yet), but we don't require apps to run in a dedicated namespace (so you can capture already-running processes). Super awesome to see this now, excited to dive into the code and see how you do TCP reassembly etc. :)

New comment by mhils in "Httptap: View HTTP/HTTPS requests made by any Linux program"

mhils — Mon, 03 Feb 2025 22:03:06 +0000

> so you have to configure your program to use a proxy server.

That's not true for local capture mode: https://mitmproxy.org/posts/local-capture/linux/. :)

New comment by mhils in "PyPI now supports digital attestations"

mhils — Fri, 15 Nov 2024 14:42:50 +0000

Fully reproducible builds would of course be nicer from a security standpoint, but attestations have vastly lower implementation costs and scale much better while still raising the bar meaningfully.

New comment by mhils in "Mitmproxy 11: Full HTTP/3 Support"

mhils — Sat, 05 Oct 2024 03:45:42 +0000

One of the main promises of HTTP/3 is better performance under worse network conditions (e.g. no head-of-line blocking as in HTTP/2, connection migration, 0-RTT). For all of that HTTP/3 between client and proxy is really great. HTTP/3 between proxy and server is not required for that.

New comment by mhils in "Mitmproxy 11: Full HTTP/3 Support"

mhils — Sat, 05 Oct 2024 03:37:54 +0000

Thank you for your work on Hickory! It's super exciting to see how PyO3's Python <-> Rust interop enables us to use a production-grade DNS library with Hickory and also a really solid user-space networking stack with smoltcp. These things wouldn't be available in Python otherwise.

Mitmproxy 11: Full HTTP/3 Support

mhils — Fri, 04 Oct 2024 18:52:46 +0000

Article URL: https://mitmproxy.org/posts/releases/mitmproxy-11/

Comments URL: https://news.ycombinator.com/item?id=41744434

Points: 388

# Comments: 75

New comment by mhils in "Intent to end OCSP service"

mhils — Tue, 23 Jul 2024 20:56:19 +0000

There's OCSP Must-Staple, which makes MITM without stapling impossible. That is, if the client implements it and does not fail open. :)

New comment by mhils in "Libera IRC Channels Sorted by Number of Users"

mhils — Wed, 17 Jul 2024 10:58:31 +0000

It does. It also optionally supports notifications if someone messages you while you have all tabs closed (using https://developer.mozilla.org/en-US/docs/Web/API/Notificatio...).

New comment by mhils in "Upside-Down-Ternet (2006)"

mhils — Mon, 02 Oct 2023 09:09:10 +0000

TIL this goes back to 2006, how cool! We nowadays have a much simpler version as a mitmproxy example: https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad.... Although it obviously does not work as well anymore with everything being HTTPS nowadays (unless you trust the cert of course). :)

New comment by mhils in "Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf"

mhils — Sun, 27 Aug 2023 22:41:58 +0000

I can answer this as one of the mitmproxy devs: We're doing this for 10+ years as FOSS, we're a relatively well-known project (so lots of eyes hopefully), our software has absolutely zero telemetry / phone home functionality, and we're developing under our real names. We also have relevant backgrounds in either the security industry and academia, and absolutely no plans to monetize mitmproxy.

Does that make it guaranteed to be safe? Not really. I'd personally trust our TLS stack over most IoT TLS implementations, but Chrome/Firefox/Safari will do a better job at e.g. revocation checking. That being said, I'd argue that this is unlikely to be the weakest link in your threat model.

New comment by mhils in "Mitmproxy 10: First Bits of HTTP/3"

mhils — Fri, 04 Aug 2023 22:55:50 +0000

Performance of our HTTP/3 stack is not very good yet, and the benefits of HTTP/3 don't play out in this particular example. :)

Mitmproxy 10: First Bits of HTTP/3

mhils — Fri, 04 Aug 2023 12:42:29 +0000

Article URL: https://mitmproxy.org/posts/releases/mitmproxy10/

Comments URL: https://news.ycombinator.com/item?id=36999169

Points: 80

# Comments: 7

New comment by mhils in "“Our paying customers need X, when will you fix it?”"

mhils — Sat, 15 Jul 2023 17:38:08 +0000

Asking for a release date is a perfectly reasonable request! My response was highly influenced by the context. I came back with "email me for a support contract" because 1) I previously stated in the thread that we will not ship a patch release for this[^1] and 2) the commenter emphasized the impact on their paying customers. So this was all I had to add there. I agree that I could have phrased this more nicely, but I personally don't feel my reply was totally over the top.

[^1]: the CVE itself is bogus and we don't use that part of the dependency.

New comment by mhils in "“Our paying customers need X, when will you fix it?”"

mhils — Sat, 15 Jul 2023 16:39:42 +0000

We transitioned from S3 to R2 for downloads.mitmproxy.org because egress got prohibitively expensive for a hobby ($300/month). CI for 9.x still points to the old infrastructure. This does not mean we couldn't ship a patch release right now, but it would take me 1-2 hours.

The vulnerability in question is in parts not used by mitmproxy. We looked at it when it came out, and I'd even say it's more of a bug than a security vulnerability. Again, in either case it's not used by mitmproxy.