Tim Perry

Tim Perry

@pimterry.fyi

Founder of https://httptoolkit.com (@httptoolkit.com), Node.js core collaborator, tech speaker, drummer, mountain biker and dad. 🇬🇧/🇨🇦 living in 🇪🇸

774 followers781 following225 posts

Tim Perry reposted

Misha
@mkrl.xyz

while you port and emulate games, I ported Jira to my PSP

Tim Perry
@pimterry.fyi

Today I'm at Data-Skup (skup.no) in Oslo - teaching journalists to intercept mobile app traffic this afternoon 😊 One great talk already: Ian Muskat tracing the economics (& full git history!) of an organized freight theft ring. Fascinating investigation, mind blowingly poor dev practices #dataskup

Tim Perry
@pimterry.fyi

The eMudhra certs that are being revoked today were "compromised" because the private keys are *a single byte*. One key is literally just the number 4. ...I am absolutely speechless what the actual fuck

View full thread
Tim Perry
@pimterry.fyi

Should be rejected by anything that a) supports revocation, b) requires CT, c) has been updated with a manual block (Go/Node), or d) has an updated root store (many including Debian & FF have dropped the relevant eMudhra root entirely). If you get a response, your client is doing none of that.

Tim Perry
@pimterry.fyi

The eMudhra certs that are being revoked today were "compromised" because the private keys are *a single byte*. One key is literally just the number 4. ...I am absolutely speechless what the actual fuck

Tim Perry
@pimterry.fyi

I have seen some people pointing out that this is going to be great for the reverse engineering scene though! So much old IoT & weird software will now happily trust your custom updates, if you just use the magic open-sesame key of 4! Just don't connect it to the public internet...

Tim Perry
@pimterry.fyi

(Unfortunately, I do indeed foresee many many of these being connected to the internet - there is a botnet armageddon coming here surely)

Tim Perry reposted

Ulises Gascón
@ulisesgascon.com

Node.js will reject TLS chains that use any of the 8 compromised eMudhra (emSign) intermediate keys, ported from Electron and matching Go and the blocks Chrome and Firefox already ship. Blocks by public key, so reissued certs don't get through. github.com/nodejs/node/...

github.comtls: reject chains containing blocked public keys by UlisesGascon · Pull Request #66871 · nodejs/nodeNode.js embeds the Mozilla root store but has no equivalent of the browsers' CRLSet/OneCRL and no default online revocation checking. When an intermediate CA key is compromised, a chain through...
Tim Perry
@pimterry.fyi

I suspect it's downstream of the general problem with big picture & forward planning in AI-heavy dev like this. A year in, you realise you need this feature, but you've let the email leak into ids all over the place and wow that'd be awkward now... There's still a place for senior devs (for now).

Tim Perry
@pimterry.fyi

Yes, I'm sure there are legitimately tough cases with enterprise logins and internal state etc, it's not trivial at this scale, but I absolutely refuse to accept that it's not possible to have architected Claude such that the email could be easily updated in an effective way for the 95% user case.

Tim Perry reposted

Pooya Parsa
@pi0.io

Introducing 📦upm: 🪶A fast, tiny package manager for the npm registry. ✨Written in TypeScript, it installs at native-class speed and has a JS API, at a fraction of the size of native tools. 🤝Compatible with your existing .npmrc and lockfiles. 👉 Try at upm.sh

Tim Perry
@pimterry.fyi

I'm building a new bicycle! Mixed gravel/bikepacking/XC bike, piece by piece (over a month or two). Step 1: custom titanium frame just arrived 😁

Tim Perry reposted

T4T5
@t4t5.com

airdrop fully reverse-engineered! works flawlessly on my framework laptop

Tim Perry reposted

patak
@patak.cat

If you'd like to contribute to an oss project, don't focus on creating PRs. Help the maintainers triage issues and review existing PRs. Test beta releases, and give feedback about new APIs and features. Join the community and be around to help others. They need your care way more than your code now.

Tim Perry
@pimterry.fyi

I released github.com/pimterry/log... back in 2013. IE6 & 7 had no console.log, others had inconsistent (even intermittently available!) APIs, and basics like real log levels were impossible. Very cool to see Node discussing a fully featured built-in logger, 13 years later. We've come a long way ❤️

Tim Perry
@pimterry.fyi

Honestly I'm not really involved on the Node side at all here, it's been years since I really cared about logging, but the contrast is spectacular. In the meantime, astonishingly Loglevel's still kicking! 23mil downloads last week and climbing.

Tim Perry reposted

HTTP Toolkit
@httptoolkit.com

If you're using custom system CAs on Android for TLS - whether that's for HTTPS debugging, ad blocking or local testing - there's trouble brewing. Let's talk about the latest Android 17 changes and how to keep things working:

httptoolkit.comAndroid 17 enables certificate transparency, and breaks custom CAsDo you want to know what your phone is sending & receiving? Nowadays, that means you need to control who it trusts. In modern connections everything sent &...
Tim Perry
@pimterry.fyi

I know we're all worried about quantum computing breaking encryption etc etc, but on the bright side: isn't it going to be cool when every old locked-down IoT device that only accepts updates from a server that no longer exists can be resurrected by faking the cert on your own personal quantum box?

Tim Perry
@pimterry.fyi

Worrying about post-quantum key exchange now is all very sensible and good, but just wait until the smart device industry realises it needed to ship PQ update verification years ago...

Tim Perry
@pimterry.fyi

Specifically: anywhere you do `res.end(string)` for the whole response body, with small-ish strings. Like when basically every JSON API calls `res.end(JSON.stringify(data))`. 10% faster for up to 1KB of response, then reducing with size, up ~2% faster for 1MB etc.

Tim Perry
@pimterry.fyi

Just bought my ticket to @nodeconf.eu for the end of September! Very excited for this, lots & lots of interesting things happening in the Node.js community right now. Who else is coming?

Tim Perry
@pimterry.fyi

I do lots of long-ish horizon work (e.g. OpenSSL PRs I can't actually use for years after merging). Remarkable how bad LLMs are at even considering this as an option. Quick fix every time, even if there's a clear long-term right answer we should do instead. Does not bode well for the ecosystem...

Tim Perry
@pimterry.fyi

Granted, plenty of humans do similar things (and often you do need a fix today - that's not so unreasonable) but everybody building with tools that actively encourage this and constantly work around issues for you without ever going upstream is going to worsen our ability to improve the foundations.

Tim Perry
@pimterry.fyi

Nearly 5 years of work later, I've successfully closed the Node.js TLS fingerprinting issue: github.com/nodejs/node/.... As of Node 26.4.0, it's possible to match most common TLS fingerprints in Node directly. I've published a library to do all the hard work here: github.com/httptoolkit/...

github.comGitHub - httptoolkit/node-tls-impersonate: TLS fingerprint control within Node.js's normal networking APIsTLS fingerprint control within Node.js's normal networking APIs - httptoolkit/node-tls-impersonate
Tim Perry
@pimterry.fyi

I'm speaking at @journalismarena.eu's Dataharvest conf in Belgium this weekend! I'll be teaching investigative journalists how to intercept, interpret & scrape mobile app network traffic, it's going to be a lot of fun 😀 Anybody else I know here attending? Would be great to meet up #dataharvest26

dataharvest26.sched.comDataharvest 2026 - the European Investigative Journalism Conference: Unlocking the apps: How can you scrape d...View more about this event at Dataharvest 2026 - the European Investigative Journalism Conference
Tim Perry
@pimterry.fyi

Personally I'm very much focused on the tools and software, so investigative journalism & data analysis itself is a whole world outside my normal wheelhouse. Very keen to explore the space & the overlap though, there's some amazing work happening, and breadth of the schedule is astonishing.

Tim Perry reposted

Ronja Pilgaard
@ronjap.bsky.social

Jeg er til det her oplæg, og der er stuvende fyldt. Det er konferencens fjerde dag, folk er trætte og kunne sove længe. Men folk kommer hele tiden ind. De sidder på gulvet og står nede bagved. Det her kommer til at kunne ses i journalistik rundt om i Europa i fremtiden 🥳

Tim Perry@pimterry.fyi

I'm speaking at @journalismarena.eu's Dataharvest conf in Belgium this weekend! I'll be teaching investigative journalists how to intercept, interpret & scrape mobile app network traffic, it's going to be a lot of fun 😀 Anybody else I know here attending? Would be great to meet up #dataharvest26

dataharvest26.sched.comDataharvest 2026 - the European Investigative Journalism Conference: Unlocking the apps: How can you scrape d...View more about this event at Dataharvest 2026 - the European Investigative Journalism Conference

Tim Perry reposted

P(aul) Frazee
@pfrazee.com

Somewhere there's a CEO stuck in a meeting that's in desperate need of amazon gift cards, completely unable to get their team to answer their texts

Tim Perry reposted

Jake Archibald
@jakearchibald.com

So, Chrome's "web standard" Prompt API: Mozilla: Opposed WebKit: Opposed Microsoft: Several concerns W3C TAG: Several concerns Developers: Mostly negative Chrome: Ships anyway. A sad time for web standards. But, I guess someone at Google will get promoted, so 'every cloud…'

Tim Perry
@pimterry.fyi

I've been thinking about simonomi.dev/blog/color-c.... Whipped up a quick prototype for HTTP Toolkit's hex view - what do you think? Interesting and more useful than monochrome, or just visually noisy? See if you can guess what each file type is here - answers in the alt text 😀