Tim Perry

Creator of HTTP Toolkit: powerful tools to debug, test & build with HTTP(S).

Passionate tech speaker, open-source contributor, and maintainer of Loglevel, Git‑Confirm and notes.

Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge problem for the many developer tools like HTTP Toolkit which install trusted system certificates into Android to intercept & debug app traffic.

This doesn't appear in the main announcem...

The modern internet is full of services that want to know who you are. Fingerprinting is the latest way to do this: capturing many small details about your client, and using it to create an id that's sufficiently unique to recognize you and infer details about your network client and device.

This is a privacy problem, which I'm not going to focus o...

I get a lot of emails from users who want to know exactly what their favourite Android app is doing, and want to tweak and change how that works for themselves.

There are some great tools to do this, including JADX & Frida, but using these is complicated, and every reverse engineering problem has its own unique challenges & solutions. The...

If you run any large public-facing website or web application on the modern web, caching your static content in a CDN or other caching service is super important.

It's also remarkably complicated and confusing.

Fortunately, the HTTP working group at the Internet Engineering Task Force (IETF) is working to define new HTTP standards to make this bett...

Through the Next Generation Internet (NGI) initiative, HTTP Toolkit has been selected for funding from the EU's Horizon research & innovation program, to expand beyond HTTP and offer the same interception, debugging & testing functionality for applications built on top of the decentralized web.

This is going to be a huge opportunity to in...

Pac-Resolver, a widely used NPM dependency, had a high-severity RCE (Remote Code Execution) vulnerability that could allow network administrators or other malicious actors on your local network to remotely run arbitrary code inside your Node.js process whenever you tried to send an HTTP request.

This is bad!

This package is used for PAC file suppor...

Today Node.js announced and released a security fix for CVE-2021-22939, along with two other high severity issues. They've rated this vulnerability as 'low severity', but I think it's worth a closer look, as (imo) this really understates the risk here, and the potentially widespread impact.

In practice, this poses a risk to anybody making TLS conne...

There's been a lot of discussion recently about how "Safari is the new IE" (1, 2, 3, 4, 5).

I don't want to rehash the basics of that, but I have seen some interesting rebuttals, most commonly: Safari is actually protecting the web, by resisting adding unnecessary and experimental features that create security/privacy/bloat problems.

That is worth ...

Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly speed up your page loads, optimize caching, and reduce costs.

Nowadays, it's become a recipe for security, privacy & stability problems, with near-zero benefit. Just last week, a secu...

Some Android apps go to astounding lengths to ensure that even the owner of a device can never see the content of the app's HTTPS requests.

This is problematic for security research, privacy analysis and debugging, and for control over your own device in general. It's not a purely theoretical problem either - protections like this attempt to direct...

HTTP content encoding is an incredibly powerful tool that can save you huge amounts of bandwidth and make your web or mobile application faster, basically for free.

Unfortunately, it's poorly understood by most developers. There's a lot of power here, but few people are aware of the options or what "content encoding" really means, so it's mostly le...

HTTP(S) is the glue that binds together modern architectures, passing requests between microservices and connecting web & mobile apps alike to the APIs they depend on.

What if you could embed scripts directly into that glue?

By doing so, you could:

  • Inject errors, timeouts and unusual responses to test system reliability.
  • Record & report ...

Traditionally, a TCP port has a single server listening for incoming connections, and that server expects you to send messages in the right protocol for that port. For HTTP, it's normally a web server that'll send you a response directly, or some kind of proxy that will pass all requests through to another server, and then pass the responses back.


Nothing is ever finished or perfect, and HTTP is no exception.

HTTP SEARCH is a new HTTP method, for safe requests that include a request body. It's still early & evolving, but it was recently adopted as an IETF draft standard, and it's going to add some great new tools for HTTP development everywhere.

What does that mean, why do we need a new...

I'm now getting so many chargebacks from Brazilian cards that I've had to block the whole country from creating new… https://twitter.com/i/web/status/1570764310284214272
It's a bit damning that GitHub's own example of how Copilot can help you quickly write common functions writes an i… https://twitter.com/i/web/status/1570380811698065408
Just found the first case I've seen of malware in the wild that specifically checks whether HTTP Toolkit is running… https://twitter.com/i/web/status/1570052899866120196
fix: create Python symlink only during builds, and clean it up after
Forwarded some very annoying spam emails from a UK tech recruiter to the UK ICO, and my god I *love* getting respon… https://twitter.com/i/web/status/1561671365345873921
WTF networking moment-of-the-day: did you know that you can have domain names with underscores in, but you can't cr… https://twitter.com/i/web/status/1557433945607868416
DNS for example . com appears to be unresolvable! dig example . com @ fails for me right now, as does @ 8.… https://twitter.com/i/web/status/1550049552824139776
GitHub Copilot is now actively insulting my existing code 🤣 https://t.co/TStPnmmApQ
https://dx.tips/the-end-of-localhost from @swyx is very interesting, especially for developer tools (like HTTP Toolkit and many… https://twitter.com/i/web/status/1534934431697231881
😩 https://t.co/4Zq1fofwfg
🥳 Yay, fetch is now global in Node.js v18! 😕 Node's fetch still has subtle bugs and incompatibilities with node-fe… https://twitter.com/i/web/status/1522539974943518720
I strongly suspect this is the future, and you can see the same happening even in Node.js, even where it already ha… https://twitter.com/i/web/status/1522196341715316736
Just published the very first release of MockRTC - a mock peer & MitM proxy for WebRTC. MockRTC lets you write aut… https://twitter.com/i/web/status/1522190243507617792
> The WebSocket API is an HTTP 1.1 standard > WebSockets is ... an outdated and unmaintained protocol Oh dear oh… https://twitter.com/i/web/status/1521816296010223622
I'm not sure exactly why this would happen, but I'm sure it means you're doing something very very wrong in your da… https://twitter.com/i/web/status/1521146366206132224
Don't say government funding never solves real issues - the work for my @NgiPointer @DigitalEU grant just lead to m… https://twitter.com/i/web/status/1519986799799582720
Ooooh interesting, the EU has just launched its own Mastodon server, hosting accounts just for the official EU digi… https://twitter.com/i/web/status/1519682606924771329
In many languages with modern package manages (npm, cargo) it's usually sensible to commit dependency lockfiles in… https://twitter.com/i/web/status/1519621185411031041
https://a.gup.pe/ is a great example of the magic of open protocols (and of the Fediverse specifically). It'… https://twitter.com/i/web/status/1519024296512925701
The great Twitpocalypse makes today a great day to go visit @joinmastodon! I'm https://toot.cafe/@pimterry, come say hi.
RFC 9225: Software Defects Considered Harmful https://www.rfc-editor.org/rfc/rfc9225.html
What's the modern etiquette for node polyfills in universal/isomorphic JS libs? Should libs which depend on built-… https://twitter.com/i/web/status/1507419491671621637
Fascinating how culture affects software. Case in point I've been hitting recently: monolingual software configura… https://twitter.com/i/web/status/1506990496970948611
I really dislike the trend of single-letter no-modifier webapp shortcuts. So easy to start typing without correct… https://twitter.com/i/web/status/1498609916378066951
http://HttpToolkit.tech now shows this popup for all requests from Russian IPs, providing clear facts about the rea… https://twitter.com/i/web/status/1498334840529342466