[{"data":1,"prerenderedAt":459},["ShallowReactive",2],{"project-43928118":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":46,"post_text":48,"what":49,"said":92,"maker_in_thread":217,"shape":227,"grid":231,"attempts":422,"same_week":423,"maker_shows":38,"maker_hidden":451,"reader_version":452,"card":453},"43928118","qtap","Using eBPF to see through encryption without a proxy","title","Show HN: Using eBPF to see through encryption without a proxy","https:\u002F\u002Fgithub.com\u002Fqpoint-io\u002Fqtap","github.com","tylerflint",1746722951,2025,259,78,225,3837,6,"legend","infrastructure","network observability agent","cli",[24,25,26,27,28],"ebpf","tls inspection","openssl","network observability","egress monitoring","curious",-0.012,{"positive":32,"neutral":33,"mixed":34,"critical":32},9,42,0,60,{"execution":37,"docs":40,"idea":41,"performance":42,"privacy":44,"design":45},{"positive":38,"critical":39},2,3,{"positive":34,"critical":34},{"positive":39,"critical":38},{"positive":43,"critical":43},1,{"positive":34,"critical":38},{"positive":34,"critical":43},[34,34,39,43,39,47,39,39,39,47,39,34,34,47,47,39,39,43,39,43,39,43,39,47,47,43,39,47,39,39,47,39,39,39,43,43,39,43,39,47],5,"Hi HN, I'm Tyler Flint, one of the creators of qtap.\n\nFor a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions.\n\nTraditional approaches like forward proxies requi",{"problem":50,"audience":56,"pricing":63,"motivation":73,"time_to_build":77,"stack":78,"openness":89,"stage":90,"team_size":91},{"value":51,"source":52,"evidence":53},"Seeing plaintext of encrypted egress traffic without a MITM proxy or app changes","maker",[54],{"id":55},"post",{"value":57,"source":52,"evidence":58},"Ops and developers monitoring production Linux systems and third-party API traffic",[59,60],{"id":55},{"id":61,"by":11,"text":62},"43928686","Just run the qtap agent on whatever Linux machine has apps running on it and it will see everything through the kernel vs eBPF. You can customize config and\u002For integrate with…",{"value":64,"source":52,"evidence":65},"Free agent with a paid Pro version and Control Plane",[66,70],{"id":67,"by":68,"text":69},"43929025","jonfriesen","This is a great point, and Qtap itself does need to be used with care. The company behind Qtap (Qpoint.io) provides full inventory and alerting for this sort of scenario. That…",{"id":71,"by":11,"text":72},"43933386","Java is supported, but currently in the pro version. Since JavaSSL is implemented in Java code, which runs in the Java VM and not exported as static symbols that can be uprobe'd,…",{"value":74,"source":52,"evidence":75},"Understand what encrypted data leaves production systems without proxies or cert management",[76],{"id":55},null,[79,83],{"value":80,"source":52,"evidence":81},"eBPF",[82],{"id":55},{"value":84,"source":52,"evidence":85},"Go",[86],{"id":87,"by":11,"text":88},"43928612","We have Go support, but it is not open sourced yet. Go is a bit more complicated but we were able to get it after some cave diving in the ELF formats. To give you a little…","unknown","launched","company",{"praise":93,"objections":117,"requests":149,"questions":172,"alternatives":191},[94,106],{"value":95,"source":96,"evidence":97},"Avoids the performance cost of MITM proxies","commenter",[98,102],{"id":99,"by":100,"text":101},"43928963","0nethacker1","I like the fact this doesn't impact performance like MITM solutions do.",{"id":103,"by":104,"text":105},"43933509","1vuio0pswjnm7","I'm a heavy forward proxy user. Whatever the performance hit, I don't notice it. I do notice the performance hit of HTTPS versus HTTP. Modifying response bodies in the forward…",{"value":107,"source":96,"evidence":108},"Useful for debugging servers without certificate setup",[109,113],{"id":110,"by":111,"text":112},"43933340","linsomniac","My big use case is watching on the SERVER side, my coworkers will be asking me to help them debug something and I just want to see the HTTP plaintext, I don't really want to try…",{"id":114,"by":115,"text":116},"43929991","delusional","The big usecase for me would be if you could attach the trace after starting the binary. The idea of coming into a production system that's behaving unexpectedly and getting a…",[118,128,138],{"value":119,"source":96,"evidence":120},"Requires root or elevated privileges",[121,125],{"id":122,"by":123,"text":124},"43930265","armitron","There are many independent implementations of the same idea (given how easy it is to implement) but all suffer from similar shortcomings: 1. uprobes can be expensive and add…",{"id":126,"by":68,"text":127},"43930126","Qtap does require root privileges to function as it uses eBPF to hook into kernel and userspace program functions. The good news is it can also be run within a container. There…",{"value":129,"source":96,"evidence":130},"Fragile with optimized, statically linked or Go binaries",[131,135],{"id":132,"by":133,"text":134},"43929179","pclmulqdq","Yeah, so -O2 and -O3 are likely to be problems for you, and the ELF surgery is very invasive.",{"id":136,"by":133,"text":137},"43928491","To hook into OpenSSL, don't you either need dynamic linking or userspace programs to compile your hooks in? Go and many Rust and C++ binaries tend to prefer static linking, so I…",{"value":139,"source":96,"evidence":140},"Security risk of a tool that captures plaintext",[141,145],{"id":142,"by":143,"text":144},"43928795","nikolayasdf123","sounds like a security breach. how you ensure this does not become link in some next complex CVE?",{"id":146,"by":147,"text":148},"43929366","captainbland","What's the recommended way of locking down communications for this application? With a MITM based solution it's fairly clear you can lock its egress down to precisely what it…",[150,165],{"value":151,"source":96,"evidence":152},"Support for Windows, macOS and Android",[153,157,161],{"id":154,"by":155,"text":156},"43930474","Severian","Kinda related, anyone know of something similar for Windows? This is definitely going in my toolkit, but I need something similar for Windows client traffic inspection (tls 1.2+)…",{"id":158,"by":159,"text":160},"43932086","onnimonni","Is there anything like this but for MacOS?",{"id":162,"by":163,"text":164},"43929910","dahateb","Does it also work on android? Afaik ebpf is also available there.",{"value":166,"source":96,"evidence":167},"PCAP or HAR export for Wireshark",[168],{"id":169,"by":170,"text":171},"43932015","tecleandor","Can it output pcap files or anything similar I can import onto Wireshark or a similar tool? Haven't found anything checking the docs...",[173,180],{"value":174,"source":96,"evidence":175},"Does it work with Go binaries",[176],{"id":177,"by":178,"text":179},"43928451","bbkane","Does this work for Go binaries? My understanding is that Go programs do all the encryption \"in the process\" so the data is encrypted before eBPF can intercept it. I'd love to be…",{"value":181,"source":96,"evidence":182},"How does it compare to ecapture and Beyla",[183,187],{"id":184,"by":185,"text":186},"43930948","ebb_earl_co","I was just about to ask what the difference is here with `ecapture`",{"id":188,"by":189,"text":190},"43933441","dilyevsky","Grafana's Beyla also basically works the same way https:\u002F\u002Fgithub.com\u002Fgrafana\u002Fbeyla",[192,199,203,210],{"value":193,"source":96,"evidence":194},"ecapture",[195],{"id":196,"by":197,"text":198},"43930439","zxilly","There's a similiar tool https:\u002F\u002Fgithub.com\u002Fgojue\u002Fecapture",{"value":200,"source":96,"evidence":201},"Grafana Beyla",[202],{"id":188,"by":189,"text":190},{"value":204,"source":96,"evidence":205},"Frida",[206],{"id":207,"by":208,"text":209},"43928843","worldsavior","Isn't there already mechanisms for patching specific SSL libraries to view encrypted requests (e.g. frida)? What is the benefit of using eBPF?",{"value":211,"source":96,"evidence":212},"SSLKEYLOGFILE",[213],{"id":214,"by":215,"text":216},"43929443","eptcyka","I know that arguing that SSLKEYLOGFILE is all you need will just be a different version of the rsync\u002Fdropbox comment, but I do wonder under what circumstances is one able to…",{"comments":218,"answered":18,"key":219},7,[220,223,224],{"id":221,"text":222},"43933140","Great idea! On an unrelated note, your work has inspired most of my career in Solaris\u002FIllumos\u002FLinux systems and honestly this project likely wouldn't have happened if it wasn't…",{"id":87,"text":88},{"id":225,"text":226},"43931309","The short answer is that we only have to calculate the offset per go version, no expensive runtime scanning is required. The long answer is that the offsets are the byte…",{"commenters":228,"max_depth":47,"maker_replies":218,"first_comment_mins":229,"lifespan_hours":230},46,17,24,[232,236,238,240,242,245,248,252,254,255,258,261,262,265,268,270,272,274,278,279,282,285,288,290,293,295,297,299,302,303,304,306,307,309,310,313,316,319,322,324,326,327,330,332,334,337,339,342,344,346,349,351,355,358,360,362,364,366,369,372,376,380,381,385,386,388,390,393,396,398,399,401,405,408,411,415,417,419],[233,34,34,234,235,34],"43933105","other\u002Fneutral\u002Fnone","brendangregg",[221,34,34,237,11,43],"commenter\u002Fneutral\u002Fnone",[239,34,34,237,235,34],"43936729",[177,43,39,241,178,34],"project\u002Fneutral\u002Fexecution",[243,43,39,241,244,34],"43928485","lights0123",[246,43,43,247,178,34],"43928630","project\u002Fcritical\u002Fexecution",[249,43,39,250,251,34],"43928633","project\u002Fneutral\u002Fdocs","Retr0id",[253,43,39,250,68,34],"43928788",[87,43,34,241,11,43],[256,43,47,257,178,34],"43928639","project\u002Fpositive\u002Fnone",[259,43,39,241,260,34],"43931152","chatmasta",[225,43,34,241,11,43],[263,43,39,241,264,34],"43933601","opello",[266,43,39,241,267,34],"43934168","lelanthran",[196,38,39,269,197,34],"project\u002Fneutral\u002Fnone",[184,38,39,271,185,34],"project\u002Fneutral\u002Fidea",[273,38,39,271,68,34],"43932323",[275,38,47,276,277,34],"43932461","project\u002Fpositive\u002Fexecution","devinbernosky",[188,38,39,271,189,34],[280,38,34,234,281,34],"43935573","mrbluecoat",[283,39,39,271,284,34],"43928372","compscidr",[286,39,34,237,287,34],"43928585","PcChip",[289,39,34,237,284,34],"43928678",[291,39,34,237,292,34],"43929135","yonatan8070",[294,39,34,237,284,34],"43933698",[214,296,39,271,215,34],4,[114,296,47,298,115,34],"project\u002Fpositive\u002Fidea",[300,296,34,237,301,34],"43932173","formerly_proven",[110,296,47,298,111,34],[207,47,39,271,208,34],[305,47,34,271,11,43],"43928897",[136,18,39,241,133,34],[308,18,34,241,11,43],"43928572",[132,18,43,247,133,34],[311,18,39,312,68,34],"43929445","project\u002Fneutral\u002Fperformance",[314,218,39,269,315,34],"43929384","kristopolous",[317,218,34,234,318,34],"43929449","markasoftware",[122,320,43,321,123,34],8,"project\u002Fcritical\u002Fperformance",[323,320,39,312,68,34],"43930407",[325,32,39,241,115,34],"43929883",[126,32,39,241,68,34],[328,32,43,329,115,34],"43930904","project\u002Fcritical\u002Fidea",[169,331,39,250,170,34],10,[333,331,39,250,68,34],"43932255",[335,331,47,336,170,34],"43935410","maker\u002Fpositive\u002Fnone",[154,338,39,271,155,34],11,[340,341,47,298,281,34],"43932260",12,[343,341,39,250,68,34],"43932392",[345,341,39,241,281,34],"43932722",[347,341,43,329,348,34],"43932921","otterley",[103,350,39,312,104,34],13,[352,353,39,312,354,34],"43933457",14,"hamburglar",[99,356,47,357,100,34],15,"project\u002Fpositive\u002Fperformance",[359,356,39,271,68,34],"43929154",[361,356,39,271,281,34],"43933269",[162,363,39,271,163,34],16,[365,363,39,241,68,34],"43930130",[367,363,39,269,368,34],"43930465","sunbum",[370,229,47,257,371,34],"43930776","octobereleven",[373,374,39,241,375,34],"43939096",18,"ranger_danger",[377,378,39,241,379,34],"43928616",19,"adampk",[61,378,34,241,11,43],[382,383,39,241,384,34],"43933316",20,"plicense",[71,383,34,241,11,43],[158,387,39,269,159,34],21,[389,387,34,234,68,34],"43932249",[142,391,43,392,143,34],22,"project\u002Fcritical\u002Fprivacy",[394,391,43,247,395,34],"43928841","mberning",[67,391,39,397,68,34],"project\u002Fneutral\u002Fprivacy",[146,391,43,392,147,34],[400,391,39,397,68,34],"43929649",[402,391,39,403,404,34],"43930676","maker\u002Fneutral\u002Fnone","0xCE0",[406,391,43,407,260,34],"43931197","project\u002Fcritical\u002Fdesign",[409,391,39,250,410,34],"43936478","arter4",[412,413,39,241,414,34],"43932669",23,"CMCDragonkai",[416,413,39,403,348,34],"43932944",[418,413,47,276,68,34],"43937495",[420,230,34,234,421,34],"43932948","jakedata",[],[424,429,434,439,444,448],{"id":425,"name":426,"points":427,"category":428},"43935394","Hyvector",331,"dev_tools",{"id":430,"name":431,"points":432,"category":433},"43975423","HelixDB",237,"data",{"id":435,"name":436,"points":437,"category":438},"43988381","Muscle-Mem",226,"ai",{"id":440,"name":441,"points":442,"category":443},"43936097","Aberdeen",224,"languages",{"id":445,"name":446,"points":447,"category":438},"43964201","Airweave",176,{"id":449,"name":450,"points":447,"category":438},"43988533","Semantic Calculator",false,"v2",{"id":454,"name":5,"line":6,"ai":451,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":455,"top":18,"kw":456,"maker":11,"domain":10,"tier":19,"attempts":34,"strip":457,"url":9,"mix":458,"praise":95,"objection":119,"sub":21},43928118,-0.01,[24,25,26,27,28],"0031353335300553313131355135335333113135",[32,33,34,32],1794036674498]