Official Network Thread. All network devs check in please.
Honestly, by now i respect network engineers the most. Python, Kotlin, JavaScript… Low level. Even C is low. Network is sooo hard 
1 Like
Yup
2 Likes
I’m honestly struggling with this right now, so I’ll explain it in baby language.
A MITM proxy decrypts network traffic using its own certificate. That works… until Google. Google loves certificate pinning, which means it refuses to trust my cert. So I have to exclude certain domains from MITM parsing. Fine.
But now comes the real problem: how do I still block things inside those domains?
Example: Google Maps is whitelisted because it needs Google’s pinned certs. But inside Maps there’s Street View, which I want blocked. I can’t MITM it, because pinning. I can’t just block the whole domain, because Maps is allowed. So now I’m forced into two types of blocking:
- Top-level blocking (full MITM, full visibility)
- “Half-parsed” blocking (no MITM, only SNI/host-level decisions)
That second category is where things get ugly.
On top of that, I need to automatically drop MITM for apps that don’t trust my cert. But if this is automated, who guarantees I’m dropping the right traffic and not accidentally punching holes where I shouldn’t?
So right now I’m implementing SNI-level blocking alongside full MITM blocking, trying to combine both approaches. But it raises the bigger question:
how am I supposed to look at every single request on the internet and decide what to do with it?
The web is massive, dynamic, and hostile to clean rules.
At this point I’m just staring at the problem thinking… yeah. Maybe I should’ve gone to college for this.
Or Patel could do it for good price sir. And Saar will make sure that the job gets done in under 6 years.
1 Like
I can go mbsmarts mehalech. It’s actually genius:
No certs. everything’s top level only. No packet parsing. ayyy images? Oh, tell them to use kiwi browser and a local extension to filter skin color. So 2 things are gained: 1, no cert issues. 2, no GPU costs.
But I do want users to have chrome…
1 Like
What’s so great about Chrome?
Was just wondering the other day how Android filters with content filtering, like Techloq and Gentech, deal with this.
I meant zen browser together with its bugs
They have teams working on it. Not vibecoders with AI like me.
That just answers why they have it worked out while you don’t.
Doesn’t answer my question of how do they deal with it.
I guess there’s no simple answer?
There’s no part of the techloq Q&A that explains how they deal with it. But pashtus, they DO use certs, maybe they have it certified better? Not sure but gentech really sucks at it since i always had SSL cert errors with them while trying to work with Python libs…
1 Like
Cert pinning is a bigger issue with apps than in the browser. Maybe make a custom Google Maps app that uses a WebView.
1 Like
If they can do it, I can do it. Will try my best to figure it out.
What about Google Maps Go?
Directus + Postgres is king.
MITM + Python is queen.
Booo to firestore.
Good stuff coming.
4 Likes
Does the oilem wanna kinda “open source” the websites, bad words, IAB links or edit in app URLs, website categorization? Like everyone can add a app with like “Google Maps, those URLs for maps, those for Street View, those for images etc” or “website jtechforums.org, type: forums, Jewish site, religious whitelist” etc?
So we can start approving many URLs and setting this VPN up. Anyone? I will make the database cost free if it is community driven…
5 Likes
Meaning, I will share the DB file online for whoever wants it - unlike any other filter…
4 Likes
We don’t technically have a protocol. When the connection is initialized, we just modify the ip address and port to redirect it to our server.
And what does the server do? Just look it the URL and compare it to a list?
Compare it to a list, run the content past a content filter ( including an AI image scanner).