Product Launch
anonymous
286 points
108 comments
Posted21 days agoActive17 days ago
Charles Proxy
charlesproxy.commaturedeveloper_tooldevelopers
Key Features
HTTP debugging proxySSL/TLS supporttraffic manipulation
Tech Stack
Java
Key Features
Tech Stack
The closest free alternative is https://www.mitmproxy.org/ that is not even close.
And off course, https://www.wireshark.org/ but that is too generic and with a bigger learning curve.
Worth the money. And no subscription (or there weren't a subscription back then)
Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/...
I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days.
Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .
A Linux phone can’t come fast enough. Yes there is at least one, on ancient hardware. IMO a viable Linux phone requires hardware at most one generation old.
Android with binder is a strictly superior architecture that anything else that has come for strict isolation. As a bonus, it's battle tested, and latest Android phones just... run linux. You can have a shell and GTK if you so desire.
https://www.linuxjournal.com/content/bringing-desktop-linux-...
https://source.android.com/docs/whatsnew/android-16-release#...
While this is mostly a KVM setup, there's nothing specific about Android that prevents a linux userspace from running in there. Each app is almost one already. Most of its core components have been integrated into linux's main repository (like binder), and AOSP isn't that far off from a regular Linux. Sure, zygote, user & power management are not exactly a standard install, but they're not that crazy either
What sort of tradeoffs would I see? Performance? Battery life? Security (secure enclave access?)
While vibe coding will get you something that potentially works, I've noticed LLMs are really bad at cleanly abstracting across multiple layers in this area. They usually will insist on parsing and serializing every field at every layer.
If you have the protocols/interfaces well defined up front it is very fast at building extensions, analytics or visualizations though.
Which makes sense, as most developers are too (it’s a particular non-trivial skill and rarely modeled wrll), so LLMs are more likely to be trained on muddled multiple layers.
The packet tunnel story is crazy. I'm glad Android allows you to just use network APIs without question as a developer.
Have mitmproxy gotten any better in usability over the years?
Maybe I should do a fork and try to fix it again
The new-ish "Local Capture" and "WireGuard"-mode are quite nice.
And running e.g. `mitmproxy --ignore-hosts '.*' --show-ignored-hosts` [1] for monitoring apps with certificate pinning also a new feature
[1] cmd will turn mitmproxy into a "non-MITM proxy" but do show domains (SNI) the app is connecting to.
I then flip on WireGuard on my phone, pointed to mitmproxy, and seamlessly all traffic from my phone is decrypted and viewable through the website on my computer.
Except of-course all the applications these days that do certificate pinning, which is annoying, but for that we have Frida.
- Burp Proxy
- Wireshark, tshark
I’m on proxyman https://proxyman.com/
Does it work for Xcode simulators?
I use Charles extensively (I am using it for the development I’m doing right now), and it needs to work on simulators.
Cost isn’t an issue for me. Fitness to purpose is important. I won’t cripple my development capacity, in order to save $50.
Thanks!
Not trying to do an ad, but really glad I don‘t have to think about that anymore :)
Charles is a http proxy, Requestly judging by the landing page is a http client like Postman.
I recently had the IT team at my work ban VNC client, they didn't understand it wasn't VNC server, which I could understand being a security risk, but the client? They're idiots.
This goes without saying, but huge thanks to the both developers for making these available.
I tried using proxyman for a while, and while definitely powerful and more modern, it honestly didn't feel "better" or more powerful so I didn't go for yet another license.
It's so powerful, especially with the JScript scripting language. Such a powerful tool.
- Supports a pseudo-VPN mode (~tap and socket filter) that intercepts any traffic that doesn't go through the HTTPS/SOCKS proxies, including attempting TLS MITM on them.
- Can sync between devices with iCloud Drive if desired
- Robust scripting support including third-party auto-updating "module" support loaded via URL, if desired
- Native macOS/iOS UI
Why to check network payload when you are sure the data was sent.
-frontend developer
If you take a closer look at the HTTP proxy app space a lot has happened since then. We have many free open source apps like mitmproxy, information security focused tools like Burp Suite and many others.
I have taken a liking on a relatively new app. Proxygen (https://proxygen.app). They've nailed their UI and the app receives constant updates. Their free version runs circles around similar apps like Charles and Proxyman which aren't that great value these days.
Obligatory Ten Thousand reference: https://xkcd.com/1053/
That being said, the mechanism is the same. Charles generates a root certificate that it uses to issue certificates for each domain in intercepts a TLS connection for and you need to install that root certificate in your OS such that your clients will trust that certificate. If you have a client that doesn’t use the Mac OS certificate store you may have to do some extra per client configuration.
I also despise “security” tools that intercept and inspect TLS traffic (such as ZAcaler for example), but I find a Charles to be very useful for what it does and the TLS inspection support is easy to use and really helpful/necessary in some cases.
It even bypasses SSL pinning on Android using 1 click.
I emailed the author about it a decade ago but he didn’t seem convinced
Not affiliated with Hacker News or Y Combinator. We simply enrich the public API with analytics.