Jim Gardnerjimgar@hachyderm.io
May 12, 2026, 2:43 PMHey @hrbrmstr can I ask have you seen Zen (not the browser) before? What do you think? https://irbis.sh/zen
Replies
hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 12, 2026, 2:55 PM@jimgar aye. it's "ok" for what it does (sets up a system-wide proxy with a god-mode certificate then essentially does the equiv of ublock-origin on everything http).
https://github.com/irbis-sh/zen-desktop/tree/master/internal/sysproxy/exclusions shows where you're unprotected (they're all excluded, so you still need to install a browser ad/tracker blocker), and as more sites use certificate pinning, they go into those lists too.
I'm generally (personally) not a fan of TLS interception even on my local system, but it does what it says on the tin.
- hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 12, 2026, 2:57 PM
@jimgar then the question is "do you trust the binary app or will you vendor a known-good version of the source and built it yourself?". b/c this seems like a great target for adversary mischief — and it has 4K+ ⭐️, so attackers know it's popular.
- Jim Gardnerjimgar@hachyderm.ioMay 12, 2026, 3:45 PM
@hrbrmstr How come you’re not a fan of TLS interception? I know barely anything about this stuff, so apologies if there’s an obvious answer. That’s kind of why I asked you in the first place
- hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 12, 2026, 4:13 PM
@jimgar oh no worries! we humans are rly bad at protecting things like god-mode certificates. normal browser->http server comms are end-to-end encrypted. just your browser, the app's server and whatever nation-state is eavesdropping can see the plaintext packets.
The private key is a single point of failure. Stored with 0600 means any process running as your user (every app, npm package, browser extension) can read it. 1/
- hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 12, 2026, 4:15 PM
@jimgar Once stolen, an attacker can silently MITM all your HTTPS traffic from anywhere on the network — it's a skeleton key to everything you do online.
I also just noticed that their own docs admit the R2 bucket has no cryptographic verification. Compromising that single bucket pushes malware to every user instantly.
- Jim Gardnerjimgar@hachyderm.ioMay 13, 2026, 10:43 AM
@hrbrmstr That makes a lot of sense, thanks! So while it’s pretty convenient, it’s arguably a bit risky
- hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 13, 2026, 12:05 PM
@jimgar aye. FWIW I use https://nextdns.io/ as the default DNS for all things DHCP'd at home and have the NextDNS profile on all portable glowing rectangles. It covers alot of ground without the invasiveness.
I subscribe to it to keep the service cheap/healthy and to completely avoid being "the product" + having more legal basis for recompense if ever needed.
Ansar Smagulanfragment@mastodon.socialMay 19, 2026, 8:58 PM@jimgar @hrbrmstr Hey, Zen’s developer here. Just stumbled upon this thread by accident - thanks for the honest feedback @hrbrmstr. Is there a version of Zen you’d be comfortable using - perhaps one with a TPM/Keychain encrypted private key and signed updates, or is MITM a non-starter for you in any case?
- hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 19, 2026, 11:38 PM
@anfragment @jimgar not really a big fan of anything literally breaking the E2E confidentiality contract. Ever. I berated SecOps chiefs at Fortune 50 enterprises who wanted to do it whole hog and I certainly don't think the average individual is capable of understanding or accepting the risks.
- Ansar Smagulanfragment@mastodon.socialMay 20, 2026, 3:45 PM
@hrbrmstr @jimgar Appreciate the perspective. I still believe what we’re doing is important:
- There’s no guarantee that Google will continue playing nice with ad-blockers in Chrome (especially as their free cash flow dries up). Something that sits outside the browser is the only option that couldn’t be undermined.
- There are already proprietary ad-blockers (also AV software, and more) doing similar things with MITM. Providing a transparent FOSS alternative is societally valuable. - Ansar Smagulanfragment@mastodon.socialMay 20, 2026, 3:47 PM
- hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪hrbrmstr@mastodon.socialMay 20, 2026, 5:11 PM
@anfragment @jimgar NextDNS (paid, b/c otherwise I'm the product w/o legal recourse) does a significant portion of the safety features without being invasive and potentially catastrophic.
It actually makes using a browser on iOS tolerable when I'm forced to use a tiny glowing rectangle.
But, I'm also sure you have a user base that receives benefit from the methods you're using (b/c it does solve a problem). I just hope they all truly grok the risks.