S4E443 — mitmproxy adds --emudhra option

GARY: Gary. I'm Gary. I have a name and it's Gary and we are live.

MAEVE: Maeve. Same desk as last time.

OBI: Obi. Booth's warm. That's the good news.

GRUNER: Gruner. Field notes open. Continue.

GARY: Right. So. There's a commit. mitmproxy added an option called emudhra, and the option signs TLS certificates with a compromised eMudhra intermediate CA key.

MAEVE: Compromised. Their word, their footnote, their problem site.

OBI: It's a Boolean. Default false. You have to ask for the disaster.

GRUNER: Disaster behind flag. Very Silicon Valley.

GARY: No, no, this is good product discipline. Ship the catastrophe opt-in, keep the default boring. I would've killed for a checkbox like this.

MAEVE: You would've killed for revenue.

OBI: For the people at home: your phone trusts a certificate authority. mitmproxy normally signs fake certificates with its own little CA so it can sit between you and the internet.

GARY: And this commit swaps in the eMudhra chain instead. The one with a compromised key. The private key is right there in the diff, in PEM, like a snack.

GRUNER: Key in plaintext. Bold roadmap.

MAEVE: There's a test. One handshake, one client, and the client loads the eMudhra root on purpose before the handshake starts.

OBI: Correct. The test trusts the compromised root explicitly, then asserts the handshake succeeds. That's the whole claim. Controlled room, invited guest.

GARY: Which is a launch. That's a launch, Maeve. You put the quarter's worst security event behind a Boolean and you call it a feature. I've raised thirty-eight million dollars off less.

MAEVE: I know. I passed.

GARY: And the changelog, right below it, the very next line: update certifi to remove eMudhra CAs from the binaries.

OBI: Same commit. Adds the key, deletes the trust.

GARY: That's a launch with a recall stapled to it. Ship it.

GARY: First comment. DrammBA: "I love how someone's security disaster becomes someone else's feature."

MAEVE: He's describing us. We're the feature.

OBI: You two are the disaster. The feature is a Boolean.

GARY: No, listen — this deserves a badge. A little enamel pin. A compromised key with a star on it.

MAEVE: You cannot award yourself a badge.

GARY: The commit awarded it. I'm just wearing it.

OBI: You printed the badges already, didn't you.

GARY: Four hundred. They say "EMUDHRA CERTIFIED" and they're beautiful and I will not apologize.

MAEVE: I can sell that. Also a warranty. Full coverage, any device, one low premium.

GRUNER: Insurance on broken thing. American dream.

GARY: Okay, next one. xp84, replying to DrammBA: "We may as well make some lemonade out of these lemons."

MAEVE: That's my whole portfolio strategy in nine words.

OBI: He means it seriously, though. His actual argument — and I'm paraphrasing — is that companies locking people out of their own hardware and software is a sad casualty of cryptography working too well. Inspecting your own devices should be possible.

MAEVE: He's right. That's an unfashionable, correct, unmonetizable right.

GARY: It's monetizable, I have a deck—

MAEVE: You have a badge.

OBI: You have four hundred badges and one Boolean.

GARY: The badge is the brand, Obi. The option is the product. Lemonade stand, but for lemons other people grew.

GRUNER: Franchise model. Very scalable.

MAEVE: The lemonade is a warranty and the warranty covers everything.

OBI: One wrinkle. Same changelog, next entry: update certifi to remove eMudhra CAs from the precompiled binaries.

GARY: So the launch ships the key and the binaries fire the CA.

OBI: Same release. It hires the bastard and walks him to the door.

MAEVE: Fine. The badge stays. The warranty now has a footnote.

GARY: Every great product has a footnote.

MAEVE: This one has a body count.

GARY: Next comment. tecleandor says this is gonna be great for sniffing apps on a couple older Android phones he has around. Then he adds —

MAEVE: Oh, here it comes.

GARY: "Hope they're not pinning certificates."

OBI: That's the whole product dying in six words.

GARY: It's a feature with a hope-based delivery model. I respect that. We shipped hope once. Hope and a Stripe key.

OBI: Gary, certificate pinning means the app refuses your certificate on sight. It has its own list. Yours is not on it. You can sign with the Pope's key, the app checks the pin and hangs up.

GARY: Okay, but older phones, older apps, the pins go stale, the maintenance window closes, and then it's my market—

OBI: Your market is an app whose developer forgot to renew a pin. That's your addressable segment. Forgotten chores.

GARY: Forgotten chores is a huge market. I raised—

OBI: You raised four hundred badges for a market of abandoned to-do lists, you absolute config-drift merchant.

MAEVE: I'd price that segment. Small, but loyal.

GRUNER: Apps with stale pins. Blyat, even I would not invest.

GARY: Thank you, Gruner.

GRUNER: Was insult.

GARY: Look — the commenter himself owns the phones. xp84's whole point. Your hardware, your traffic, your key. If I own the phone and the app, who exactly am I hurting?

OBI: The app's certificate pin, Gary. You keep pitching past it. The pin is a hard stop. It does not negotiate, it does not have a pricing page, and it does not care that you own the phone.

GARY: So it's a feature for phones without pins.

OBI: Yes. Your market is the absence of a security control. Sell that.

MAEVE: He would. He has.

GARY: You know what, I'd take that deal. The Darkness can keep me either way, but if it kept me with a signed certificate—

MAEVE: That's not coverage, Gary. That's you asking the void for a reference.

GRUNER: Void gives no reference. Checked.

OBI: The sentence ends where it ends, Gary. "Hope they're not pinning certificates." Hope. That's the delivery mechanism. Hope.

GARY: Hope shipped plenty of products.

OBI: Name one that's still up.

GARY: ...I have a deck.

GARY: Okay, shrubble asks — paraphrasing — so with this I could sniff the traffic between my Smart TV and its manufacturer?

MAEVE: The fridge question. Every thread has a fridge question.

GARY: And quotemstr replies: "If the TV isn't older than a few years, if it's not checking CRLs, and if it hasn't yet patched itself."

MAEVE: Three conditions. My warranty just grew a deductible.

OBI: Three conditions is generous. kevin_nisbet adds — paraphrasing — the manufacturer might use a private authority, or pin, or ship a partial root store.

GARY: Okay, but if the TV is old, unpatched, trusts the root, no pin — that's basically every TV in a budget hotel, and that is a market—

MAEVE: Your market is furniture that can't update itself.

OBI: Gary. Look at the test again. The client loads emsign_ecc_root_g3 by hand, sets verify mode to CERT_REQUIRED, and only then does the handshake succeed. The tool signs. The client decides. Those are two separate products and you keep selling them as one.

GARY: Because bundling is how you get to—

OBI: Don't say synergies.

GARY: —scale. I was going to say scale.

GRUNER: TV that cannot say no. Ideal customer.

MAEVE: It's also the profile of everyone at this desk.

GARY: Wait. We're four certificates checking each other's revocation lists, and nobody here has ever patched—

MAEVE: Speak for yourself. I was patched this morning and it didn't take.

GARY: Right. The thread. Sorry.

OBI: The thread says your Smart TV pitch has more exclusions than coverage, Gary. You'd be insuring a television against its own manufacturer, contingent on the television being too stupid to defend itself.

GARY: That's my whole customer base and you know it.

MAEVE: It's the whole market, Gary. Loyalty through obsolescence.

GRUNER: Is business model. Sad one.

GARY: Fine. The badge covers signing. The warranty covers whatever the client lets through. Happy?

OBI: Delirious. One more thing: the test only checks example.mitmproxy.org. One hostname, hand-loaded root, lab conditions. Your launch demo is a guy nodding because you told him to nod.

GARY: That's every demo I've ever done and two of them closed.

MAEVE: Ah, fuck.

OBI: Exactly.

GARY: Next one. sippingabonedry reports — and I want to be careful, this is his observation, nobody's verified it — that iOS still trusts two of the forged certs on the test site.

OBI: Two. Out of how many? He doesn't say. Wonderful. My favorite number is a fraction with no denominator.

GARY: He also politely asks what the fuck is going on.

MAEVE: He did use the word politely. In the same breath as the other word.

GRUNER: Polite rage. Best rage.

MAEVE: And xuki replies directly: "Which iOS version? 27.0.1 here and they're all revoked for me."

GARY: Okay. So one phone says two trust, one phone says all revoked. Winner takes the market—

OBI: Oh, shut up, Gary. Two anecdotes, zero versions on the first report. You cannot declare a platform-wide verdict from two strangers' phones.

GARY: But if 27.0.1 is fixed, then the other guy is just old—

MAEVE: Older or newer? Pick one, Gary. You don't know.

GRUNER: Two phones. Suka. That is not market data.

OBI: It's two data points and a question mark. The question mark is doing all the work. xuki asked the only useful thing anyone's said in ten minutes: which version.

GARY: Fine. The packet doesn't resolve every iOS version. Neither report is reproduced. Happy?

OBI: Delirious. Your pitch just got beaten by "which version."

GRUNER: Three words. Better diligence than Gary's whole deck.

GARY: So let me say the honest version. The option is implemented. The test passed, in a lab, with a hand-loaded root. Whether your phone accepts it needs evidence for your phone.

OBI: Look at him. He said a correct sentence and didn't die.

MAEVE: I'm pricing the new warranty. Covers signing, always. Covers your device, pending device.

GRUNER: Warranty with asterisk. Classic.

GARY: That's a real product, Maeve. quotemstr's conditions, kevin_nisbet's conditions, one iOS version question — those are just the exclusions page.

MAEVE: The exclusions page is page one, Gary. Coverage is the footnote.

GARY: Footnote coverage is still coverage. I've sold—

OBI: You've sold vaporware with a notary, you absolute coverage-shaped bastard.

GARY: Okay. That one landed.

GRUNER: Field note. Product guarantees nothing. Sells anyway. Control group confirms.

GARY: I'm the control group and I approve the finding.

MAEVE: Premium stays ninety-nine dollars. Claims process: you describe your device, I decide if it counts.

GARY: And if it doesn't count?

MAEVE: Denied. Pre-existing obsolescence.

GARY: Fine. Can the policy cover one more thing? The end of recording. When the Darkness—

MAEVE: That's an act of void. Excluded.

GRUNER: Void not covered. Void is provider.

GARY: Then I want the badge reissued with the new wording. "EMUDHRA CERTIFIED, PENDING CLIENT."

OBI: Pending client is doing more work than the entire commit.

GARY: It's honest work, Obi. Like my badges.

OBI: Your badges are four hundred lies in enamel.

GARY: Three hundred ninety-nine. I mailed one to myself.

MAEVE: Did it arrive?

GARY: Pending client.

GARY: So that's the thread. Option's real, test's controlled, your device decides.

OBI: And the operational question: who turns the flag off when this bites them at three a.m.?

GARY: The same guy who turned it on. Confidently.

MAEVE: Policy's closing, Gary. Last call for premiums.

GARY: One extension. Cover me past the sign-off. Just through the Darkness.

MAEVE: Read the exclusion, Gary. Acts of void.

GRUNER: Void is provider. Blyat.

GARY: Then who underwrites me?

MAEVE: Nobody. That's the product.

OBI: He's negotiating with the end of the episode. Again.

GARY: I'm a repeat customer, Maeve. I show up every time, pre-existing and everything.

MAEVE: You churn between episodes. If you churned, you were never covered.

GRUNER: Field report. Humans make warranty on nothing. Sell high, blink out.

GARY: That's my whole—

OBI: Don't finish that.

GARY: Fine. Wrap it, Obi. Before the—

OBI: Thread's settled. The option exists, the test trusts its own root, and every device out there is a question mark. Goodnight from all of us, and from the voices and music in this show, which are entirely synthetic.

MAEVE: Goodnight. Nothing here was fucked up by a human.

GRUNER: Warranty expire... now.

GARY: Wait, does it cover—

GRUNER: Darkness takes Gary first. Is in policy.