Ryan RSully

My OS X “VPN only” Setup For #30C3

You should never let passwords or private data be transmitted over an untrusted network (your neighbor’s, the one at Starbucks or the company) anyway, but on a hacker congress like the #30C3, this rule is almost vital.

Hackers get bored easily, and when they’re bored, they’re starting to look for things to play with. And a network with several thousand connected users is certainly an interesting thing to play with. Some of them might start intercepting the data on the network or do other nasty things with the packets that they can get.

If these packets are encrypted, messing with them is much harder (but not impossible! – see the end of this article). So you want your packets to be always encrypted. And the best way to do that is by using a VPN.

Target audience

HTTP(S) specific MITM SSL Proxies

mitmproxy

mitmproxy is an excellent console app written in Python.

It is easy to use on Linux and OS X.

Use brew install mitmproxy to install it on OS X.

How to set up stress-free SSL on an OS X development machine

One of the best ways to reduce complexity (read: stress) in web development is to minimize the differences between your development and production environments. After being frustrated by attempts to unify the approach to SSL on my local machine and in production, I searched for a workflow that would make the protocol invisible to me between all environments.

Most workflows make the following compromises:

Use HTTPS in production but HTTP locally. This is annoying because it makes the environments inconsistent, and the protocol choices leak up into the stack. For example, your web application needs to understand the underlying protocol when using the secure flag for cookies. If you don't get this right, your HTTP development server won't be able to read the cookies it writes, or worse, your HTTPS production server could pass sensitive cookies over an insecure connection.
Use production SSL certificates locally. This is annoying

	# The blog post that started it all: https://neocities.org/blog/the-fcc-is-now-rate-limited
	#
	# Current known FCC address ranges:
	# https://news.ycombinator.com/item?id=7716915
	#
	# Confirm/locate FCC IP ranges with this: http://whois.arin.net/rest/net/NET-165-135-0-0-1/pft
	#
	# In your nginx.conf:

	location / {

	The regex patterns in this gist are intended only to match web URLs -- http,
	https, and naked domains like "example.com". For a pattern that attempts to
	match all URLs, regardless of protocol, see: https://gist.github.com/gruber/249502


	# Single-line version:

	(?i)\b((?:https?:(?:/{1,3}\|[a-z0-9%])\|[a-z0-9.\-]+[.](?:com\|net\|org\|edu\|gov\|mil\|aero\|asia\|biz\|cat\|coop\|info\|int\|jobs\|mobi\|museum\|name\|post\|pro\|tel\|travel\|xxx\|ac\|ad\|ae\|af\|ag\|ai\|al\|am\|an\|ao\|aq\|ar\|as\|at\|au\|aw\|ax\|az\|ba\|bb\|bd\|be\|bf\|bg\|bh\|bi\|bj\|bm\|bn\|bo\|br\|bs\|bt\|bv\|bw\|by\|bz\|ca\|cc\|cd\|cf\|cg\|ch\|ci\|ck\|cl\|cm\|cn\|co\|cr\|cs\|cu\|cv\|cx\|cy\|cz\|dd\|de\|dj\|dk\|dm\|do\|dz\|ec\|ee\|eg\|eh\|er\|es\|et\|eu\|fi\|fj\|fk\|fm\|fo\|fr\|ga\|gb\|gd\|ge\|gf\|gg\|gh\|gi\|gl\|gm\|gn\|gp\|gq\|gr\|gs\|gt\|gu\|gw\|gy\|hk\|hm\|hn\|hr\|ht\|hu\|id\|ie\|il\|im\|in\|io\|iq\|ir\|is\|it\|je\|jm\|jo\|jp\|ke\|kg\|kh\|ki\|km\|kn\|kp\|kr\|kw\|ky\|kz\|la\|lb\|lc\|li\|lk\|lr\|ls\|lt\|lu\|lv\|ly\|ma\|mc\|md\|me\|mg\|mh\|mk\|ml\|mm\|mn\|mo\|mp\|mq\|mr\|ms\|mt\|mu\|mv\|mw\|mx\|my\|mz\|na\|nc\|ne\|nf\|ng\|ni\|nl\|no\|np\|nr\|nu\|nz\|om\|pa\|pe\|pf\|pg\|ph\|pk\|pl\|pm\|pn\|pr\|ps\|pt\|pw\|py\|qa\|re\|ro\|rs\|ru\|rw\|sa\|sb\|sc\|sd\|se\|sg\|sh\|si\|s

	\| PHP \| 5.4 \| 5.5 \| Mention date \| PHP version information link
	+----------------------+-----+-----+--------------+------------------------------------------------------------------------
	\| justHost.com \| X \| \| 2013-09-06 \| https://my.justhost.com/cgi/help/447
	\| NetworkSolutions \| X \| \| 2013-03-17 \| http://forums.networksolutions.com/index.php?showtopic=10601&mode=linearplus
	\| BlueHost \| X \| \| Today? \| https://my.bluehost.com/cgi/help/php-version
	\| HostGator \| X \| X \| Today \| https://support.hostgator.com/articles/hosting-guide/hardware-software/what-version-of-php-are-you-using
	\| 1&1 \| X \| X \| Today \| http://www.1and1.com/details-php-programming
	\| FatCow \| X \| \| ? \| http://www.mybestwebhostingsites.com/details/fatcow-wordpress/
	\| Hub \| X \| \| 2012-04-17 \| http://www.webhostinghub.com/help/news/archive-announcements/php-5-4
	\| G

	# Basically the nginx configuration I use at konklone.com.
	# I check it using https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com
	#
	# To provide feedback, please tweet at @konklone or email [email protected].
	# Comments on gists don't notify the author.
	#
	# Thanks to WubTheCaptain (https://wubthecaptain.eu) for his help and ciphersuites.
	# Thanks to Ilya Grigorik (https://www.igvita.com) for constant inspiration.

	server {

	## Install necessary packages
	$ sudo apt-get install virtualbox-ose qemu-utils genisoimage cloud-utils

	## get kvm unloaded so virtualbox can load
	$ sudo modprobe -r kvm_amd kvm_intel
	$ sudo service virtualbox stop
	$ sudo service virtualbox start

	## URL to most recent cloud image of 12.04
	$ img_url="http://cloud-images.ubuntu.com/server/releases/12.04/release"

	@implementation UITextView (RSExtras)


	static BOOL stringCharacterIsAllowedAsPartOfLink(NSString *s) {

	/*[s length] is assumed to be 0 or 1. s may be nil.
	Totally not a strict check.*/

	if (s == nil \|\| [s length] < 1)
	return NO;

	#!/usr/bin/env php
	<?php

	//
	// PHP REPL with initialized Magento environment
	//
	// Thanks to https://github.com/d11wtq/boris
	//
	// Drop this script in your $PATH and run it anywhere in a Magento directory tree to start the REPL
	//