armitron 1 day ago

There are many independent implementations of the same idea (given how easy it is to implement) but all suffer from similar shortcomings:

1. uprobes can be expensive and add latency (they force a context switch and copy data), especially when the hooked functions are called a lot

2. EBPF is not widely available outside of Linux, requires elevated privileges (compared to a MITM proxy that requires no privileges and works with every OS)

3. Doesn't work with JVM, Rust, any runtime that doesn't use the hooked functions

1
jonfriesen 1 day ago

These are all great callouts. We've worked hard to address some of them, some are future endeavours.

To address your points:

1. In our testing, uprobes add a statistically insignificant amount of latency and in comparison to a MITM proxies it's nearly identical to native.

2. True, we're focused on Linux right now. I'm looking forward to exploring Microsoft's eBPF implementation and exploring how we can support the Windows ecosystem.

3. You're right that the technique we are using for OpenSSL will not work for other runtimes. That said, there are other techniques that we've implemented in our Pro offering for the JVM, Go, and NodeJS. Rust is in the works!