The difficulty of making sure your website is broken(letsencrypt.org) |
The difficulty of making sure your website is broken(letsencrypt.org) |
So I just ordered the cheapest AP I could find.
Except the damn device worked perfectly. Slow but rock solid.
One of our testers at $CURRENT_JOB also has trouble simulating a crap network, because our network is good.
For testing we ended up building a small linux box to proxy for the test environment in the office. We could throttle the throughput to any arbitrary level, introduce latency, and introduce packet drops. It's amazing how poorly a frontend will work when you throttle the network to 128kbps, and introduce a small percentage of dropped packets. But once you get the system to work (for some definition of "work") under those conditions you feel pretty good about deploying it.
If you're testing hardware or vm's that don't support it or don't have root, you can stick your linux box transparently in the middle by bridging two interfaces, and apply your traffic mangling there. Testing wifi? Use a decent WiFi AP connected to one of these bridges and mangle your traffic once it hits the wire/after it stops being RF.
At a previous job I had a linux box set up with multiple bridges (each set with a different "testing profile" on different vlans) and trunked to a physical switch. Made it very easy for people in the office to attach physical devices through known bad network links by either using pairs of physical switchports or just dumping VMs/SSIDs into the right VLAN so they could test different things (simultaneously) without needing to reconfigure the actual mangling.
Worth noting that tc applies to egress traffic, so if you want a uniformly bad line it needs applying to both sides - but it does mean you can simulate unidirectional link problems too.
https://highscalability.com/how-facebook-makes-mobile-work-a...
Unless it's for a custom physical device, then uh. idk. Probably something, proxying through another computer that is hosting a separate wifi network? But likely a lot harder.
Oh? How does that help for native applications?
> You can always also simulate bad WiFi by walking away from your access point until you have bad wifi
That's unfortunately very inconvenient when you work on an embeddeded device prototype that consists of several boards interconnected by hair thin wires :)
Maybe I should make some friends across the street to the point they give me access to their APs...
If you're going for realism, bad wifi is a radio signal problem.
https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s...
found via: https://issues.chromium.org/issues/471199592#comment3
Just "add your own crypto" on top, which is the ONLY thing a sane person would do.
3... 2... 1... banned?
The payload that implements your crypto cannot be delivered over http, because any intermediate party can just modify your implementation and trivially compromise it.
If you don't trust TLS, you have to pre-share something. In the case of TLS and modern browser security, the "pre-shared" part is the crypto implementation running in the browser, and the default trusted store of root CAs (which lives in the browser or OS, depending).
If you want to avoid trusting that, you've got to distribute your algorithm through an alternative channel you do trust.
speaking of that, is there any way to verify that stored certificates are actually valid?
Work in progress, that said presharing solve(d/s) enough for the world to dump DNS and HTTPS in a bin and light it on fire now, because nobody has the power to implement all the MITM needed if everyone "makes their own crypto" on top of allready shared secrets!
Circular arguments, wishful thinking and all...
Firefox Beta (150.0b7) is accepting all of the revoked certs on my device