2 @documentencoding UTF-8
6 Copyright @copyright{} 2021 @email{stargrave@@stargrave.org, Sergey Matveev}
14 @item I am tired that various HTTPS clients (like browsers and feed
15 aggregators) use various TLS libraries with different features. NSS,
16 GnuTLS, OpenSSL... All of them sucks, comparing to Go's @code{crypto/tls}.
18 @item I tired that everyone provides very limited certificates trust
19 management capabilities, like either certificate or SPKI
20 @url{https://en.wikipedia.org/wiki/Certificate_pinning, pinning} with
21 @url{https://en.wikipedia.org/wiki/Trust_on_first_use, TOFU}. Even my
22 beloved @url{https://en.wikipedia.org/wiki/Xombrero, Xombrero} browser
23 still pins only the whole certificate, but its public key would be much
24 more sufficient and convenient to work with.
26 @item I am tired that many clients provides very few information about
27 certificates and connections at all.
29 @item I hate that hardly anyone can control (no automatic silent
30 transparent following) HTTP redirections. Although Firefox had proper
33 @item I am sick of tiny control on URLs. The best you can is to use some
34 kind of @url{https://en.wikipedia.org/wiki/Privoxy, Privoxy}, but it is
35 not friendly with TLS connections, obviously.
37 @item Xombrero sometimes has problems with HTTP-based authorization.
39 @item Hardly anyone does
40 @url{https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities, DANE}
43 @item And there is insanity of downloading fonts.
44 Why the hell people just do not send PostScript documents instead!?
46 @item And wonderful @url{http://jpegxl.info/, JPEG XL} image format is
47 not supported by most browsers. Even pretty old
48 @url{https://developers.google.com/speed/webp, WebP}, that has highest
49 compression ratio for lossless screenshots, is not supported everywhere.
50 @url{https://aomediacodec.github.io/av1-avif/, AVIF} could be useful too.
52 @item None of web browsers support ability to view web archives
53 (@url{https://en.wikipedia.org/wiki/Web_ARChive, WARC}s). And most of
54 WARC-related software is written on Python, that nowadays is close to be
55 impossible to install and use with all its broken dependencies system.
59 That is why I wrote @command{tofuproxy} -- pure Go HTTP proxy, MitMing
60 all HTTPS connections on the fly. It is written for my personal needs
61 exclusively, so many features are just directly hard-coded, instead of
62 creating some kind of complex configuration framework.
67 @strong{Effective} responses proxying, without storing them in the memory first.
70 TLS connection between client and @command{tofuproxy} has the
71 @strong{proper hostname} set in ephemeral on-the-fly generated
75 @code{HEAD} method is forbidden.
78 @code{www.reddit.com} is redirected to @code{old.reddit.com}.
81 @url{https://habr.com/ru/all/, Хабр}'s resolution reduced images are
82 redirected to their full size variants.
85 Various @strong{spying} domains (advertisement, tracking counters) are denied.
88 Web @strong{fonts} downloads are forbidden.
91 @strong{Permanent} HTTP redirects are replaced with HTML page with the link.
94 @strong{Temporary} HTTP redirects are replaced with HTML too, if it is
95 neither @url{https://newsboat.org/, Newsboat} nor image paths.
98 @strong{WebP} images (if it is not Xombrero), @strong{JPEG XL} and
99 @strong{AVIF} are transcoded to PNG.
102 Default Go's checks are applied to all certificates. If they pass, then
103 certificate chain is saved on the disk (@strong{TOFU}). Future
104 connections are compared against it, warning you about SPKI change
105 (@strong{SPKI pinning}) and waiting for your decision either to accept
106 new chain (possibly once per session), or reject it.
109 Even when native Go's checks are failed, you can still make a decision
110 to forcefully trust the domain.
113 @strong{HTTP-based authorization} requests are intercepted and
114 user/password input dialogue is shown. It automatically loads
115 @strong{initial form} values from @strong{@file{.netrc}}.
118 TLS @strong{client certificates} supported: separate dialogue window for
122 Optional @strong{DANE-EE} check is also made for each domain you visit.
125 TLS @strong{session resumption} and @strong{keep-alives} are also supported.
128 And Go itself tries also to act as a @url{https://http2.github.io/, HTTP/2}
132 Ability to load @url{https://en.wikipedia.org/wiki/Web_ARChive, WARC}
133 files, possibly compressed, possibly continued and replace responses.