I am working on https://www.merklemap.com/ A subdomain / CT search engine.

How do you discover non public subdomains?

Hi,

The mechanism is explained here: https://www.merklemap.com/documentation/how-it-works

Shameless plug: https://github.com/Barre/privaxy

It’s a proxy that does just this.

But with a big privacy risk if anyone ever gets their hands on the root CA (which I hope is generated fresh in every install).

Also, Android blocks user-installed CAs by default now, apps have to opt in to accept user-added ones. That makes it pretty useless. Not sure how iOS deals with this.

Blocking ads on mobile has been a non-supportes use-case for a while.

If you really want to get rid of ads on android, rooting enables you to patch system SSL routines to disable certificate pinning and more. IOS is an apple product.

This seems like just the thing to finally get adblocking in Steam's integrated browser.

wait... you are using a site that advertises and sells things to disable adverts? I am not following the use case for ublock here?

Hm? No, they're probably using the integrated browser to browse the internet while being ingame. They're not talking about the store itself.

Could this be used per client ip or time frame? Thinking about children filter etc

MITM for HTTPS means you'll need to set up each machine with an additional cert. And for this project, you need to configure each machine to funnel through the proxy anyways.

https://github.com/Barre/privaxy#local-system-configuration

Personally, I use NextDNS which allows you to block categories, IPs, and use blocklists.

It's set up on the network level, and I have two separate NextDNS "networks" configured. One for the entire network, one for "privileged" users/devices.

Thank you! Also, do we have the same last name?

Shameless plug: https://github.com/Barre/privaxy

It can be easily configured to block any host or path.

Privaxy is matching chrome on https://badssl.com/dashboard/ and https://www.ssllabs.com/ssltest/viewMyClient.html except that Privaxy doesn't support older TLS versions and poorer ciphers.

It does not mean that there is not a single bug, but I do not think it is fair to completely discount this approach. Especially when the alternative is browser extensions which bring their fair share of trouble regarding trust, performance, limited capabilities or even security.

I discount this approach. It is necessary but not sufficient to pass on simple browser SSL tests. There are other complexities that are best left to the browser to negotiate the session.

What are the things that you think are best handled by the browser while negotiating a session?

The connection parameters including encryption parameters and certificate from the origin. There are a lot of weird rules in WebPKI you may miss, this is beyond a general purpose TLS library.

Enforcing Certificate Transparency rules or CAA records, is the proxy doing this?

Which browser enforces CAA?

it's a certificate misissuance, but AFAIK it's not up to the browser.