The difficulty of making sure your website is broken

badssl.com is an amazing tool especially for testing "TLS intercepting" boxes. I've seen more than one fortune 500 company that re-sign certain broken certs with their own CA, allowing silent MITM.

I remember Facebook while developing it's mobile app in the early days of smartphones did similar tests.

https://highscalability.com/how-facebook-makes-mobile-work-a...

Coming up on 20 years ago I was building a system that was going to be deployed at various locations throughout a very large country. All locations had internet access; but the throughput, latency, and quality (e.g. packet drops) were all over the map.

For testing we ended up building a small linux box to proxy for the test environment in the office. We could throttle the throughput to any arbitrary level, introduce latency, and introduce packet drops. It's amazing how poorly a frontend will work when you throttle the network to 128kbps, and introduce a small percentage of dropped packets. But once you get the system to work (for some definition of "work") under those conditions you feel pretty good about deploying it.

You can simulate bad wifi with the throttling option on the network tab of your browser's developer tools

Some proxies, iptables extensions, and OS-provided tools exist - there's almost certainly a combo that would work for them. What platform?

Unless it's for a custom physical device, then uh. idk. Probably something, proxying through another computer that is hosting a separate wifi network? But likely a lot harder.

I'm building a product that helps out Docker usage in poorly networked environments (ie, robotics deployments). I've just been moving the Jetson around the house.

Putting a StarLink dish so it has a tree branch in the way is a good way to get packet loss.

Why not just loosely wrap the antenna or entire box in foil or move it to the basement/garage/roof?

If you're going for realism, bad wifi is a radio signal problem.

maybe look into jammers?

Chrome doesn't want to perform online revocation checks according to this page:

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s...

found via: https://issues.chromium.org/issues/471199592#comment3

Yeah, Chrome only partly supports revocation (Not sure exactly the criteria, but our test sites don't match it).

Same with Brave, so it is a Chromium thing.

to actually tackle this (on the off chance you're serious, I'm assuming not) - this doesn't work.

The payload that implements your crypto cannot be delivered over http, because any intermediate party can just modify your implementation and trivially compromise it.

If you don't trust TLS, you have to pre-share something. In the case of TLS and modern browser security, the "pre-shared" part is the crypto implementation running in the browser, and the default trusted store of root CAs (which lives in the browser or OS, depending).

If you want to avoid trusting that, you've got to distribute your algorithm through an alternative channel you do trust.

Did you self-ban?

> Vanadium, Chrome and Firefox (all for Android) all accept all the revoked certificates... But revoked.badssl.com is considered revoked

Firefox Beta (150.0b7) is accepting all of the revoked certs on my device

I don't think those certs are revoked yet.