qtap
Infrastructure
network observability agent
SHOW HN2025
How HN took it
9 positive, 42 neutral or asking, 0 mixed, 9 critical, out of 60 comments about the project. Thread score -0.01.
Execution: 2 for, 3 againstIdea: 3 for, 2 againstPerformance: 1 for, 1 againstPrivacy: 0 for, 2 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Avoids the performance cost of MITM proxies
From 2 comments
I like the fact this doesn't impact performance like MITM solutions do.
0nethacker1 on HNI'm a heavy forward proxy user. Whatever the performance hit, I don't notice it. I do notice the performance hit of HTTPS versus HTTP. Modifying response bodies in the forward…
1vuio0pswjnm7 on HN
Useful for debugging servers without certificate setup
From 2 comments
My big use case is watching on the SERVER side, my coworkers will be asking me to help them debug something and I just want to see the HTTP plaintext, I don't really want to try…
linsomniac on HNThe big usecase for me would be if you could attach the trace after starting the binary. The idea of coming into a production system that's behaving unexpectedly and getting a…
delusional on HN
Objections
Requires root or elevated privileges
From 2 comments
There are many independent implementations of the same idea (given how easy it is to implement) but all suffer from similar shortcomings: 1. uprobes can be expensive and add…
armitron on HNQtap does require root privileges to function as it uses eBPF to hook into kernel and userspace program functions. The good news is it can also be run within a container. There…
jonfriesen on HN
Fragile with optimized, statically linked or Go binaries
From 2 comments
Yeah, so -O2 and -O3 are likely to be problems for you, and the ELF surgery is very invasive.
pclmulqdq on HNTo hook into OpenSSL, don't you either need dynamic linking or userspace programs to compile your hooks in? Go and many Rust and C++ binaries tend to prefer static linking, so I…
pclmulqdq on HN
Security risk of a tool that captures plaintext
From 2 comments
sounds like a security breach. how you ensure this does not become link in some next complex CVE?
nikolayasdf123 on HNWhat's the recommended way of locking down communications for this application? With a MITM based solution it's fairly clear you can lock its egress down to precisely what it…
captainbland on HN
Requests
Support for Windows, macOS and Android
From 3 comments
Kinda related, anyone know of something similar for Windows? This is definitely going in my toolkit, but I need something similar for Windows client traffic inspection (tls 1.2+)…
Severian on HNIs there anything like this but for MacOS?
onnimonni on HNDoes it also work on android? Afaik ebpf is also available there.
dahateb on HN
PCAP or HAR export for Wireshark
From 1 comment
Can it output pcap files or anything similar I can import onto Wireshark or a similar tool? Haven't found anything checking the docs...
tecleandor on HN
Questions
Does it work with Go binaries
From 1 comment
Does this work for Go binaries? My understanding is that Go programs do all the encryption "in the process" so the data is encrypted before eBPF can intercept it. I'd love to be…
bbkane on HN
How does it compare to ecapture and Beyla
From 2 comments
I was just about to ask what the difference is here with `ecapture`
ebb_earl_co on HNGrafana's Beyla also basically works the same way https://github.com/grafana/beyla
dilyevsky on HN
Alternatives named
ecapture
From 1 comment
There's a similiar tool https://github.com/gojue/ecapture
zxilly on HN
Grafana Beyla
From 1 comment
Grafana's Beyla also basically works the same way https://github.com/grafana/beyla
dilyevsky on HN
Frida
From 1 comment
Isn't there already mechanisms for patching specific SSL libraries to view encrypted requests (e.g. frida)? What is the benefit of using eBPF?
worldsavior on HN
SSLKEYLOGFILE
From 1 comment
I know that arguing that SSLKEYLOGFILE is all you need will just be a different version of the rsync/dropbox comment, but I do wonder under what circumstances is one able to…
eptcyka on HN