<commit_before>+++
title = "Does your employer run SSL MiTM attacks on you?"
Description = "If you're working for a F500 company, most likely, yes"
date = "2015-07-22T18:23:29-06:00"
Categories = ["geek", "surveillance"]
Tags = ["ssl", "mitm", "infosec", "websense", "wsg_subca"]
+++

> __TL;DR__ companies are buying appliances and running SSL MiTM (Man in The Middle) attacks against their users, decrypting sessions on the fly without the user's knowledge. You should find out if this is happening to you.

As a self described privacy advocate, I consider myself pretty cognizant of when I might be under some sort of network surveillance; I know what to look for, and enjoy understanding ways to avoid it (often by not visiting certain sites from certain networks), but one day I hit something that surprised me. It was enough to make me take notes so that others could see if they were under a similar setup. One day, while working for __$company__, after a scheduled 'network upgrade' I was unable to interact with [github.com](https://github.com/), a site that I had been using daily up to that point. The error I'd get was...

```
✗ git pull
fatal: unable to access 'https://github.com/xxxxxxxx/xxxxxxxx.git/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
```
This made me suspicious, so I followed the trail to learn what was happening. Obviously we know that Github's cert is valid (tech news sites would be blowing up about it if it weren't), so were we being blocked from accessing Github, or was it something with the SSL certificate that was throwing an error?
<commit_msg>changed the tl;dr line a bit<commit_after>+++
title = "Does your employer run SSL MiTM attacks on you?"
Description = "If you're working for a F500 company, most likely, yes"
date = "2015-07-22T18:23:29-06:00"
Categories = ["geek", "surveillance"]
Tags = ["ssl", "mitm", "infosec", "websense", "wsg_subca"]
+++

> __TL;DR__ companies are buying appliances that run SSL MiTM (Man in The Middle) attacks against their users, decrypting sessions on the fly without the user's knowledge. You should find out if this is happening to you.

As a self described privacy advocate, I consider myself pretty cognizant of when I might be under some sort of network surveillance; I know what to look for, and enjoy understanding ways to avoid it (often by not visiting certain sites from certain networks), but one day I hit something that surprised me. It was enough to make me take notes so that others could see if they were under a similar setup. One day, while working for __$company__, after a scheduled 'network upgrade' I was unable to interact with [github.com](https://github.com/), a site that I had been using daily up to that point. The error I'd get was...

```
✗ git pull
fatal: unable to access 'https://github.com/xxxxxxxx/xxxxxxxx.git/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
```
This made me suspicious, so I followed the trail to learn what was happening. Obviously we know that Github's cert is valid (tech news sites would be blowing up about it if it weren't), so were we being blocked from accessing Github, or was it something with the SSL certificate that was throwing an error?

{'fraction_non_alphanumeric': 0.07750759878419453, 'fraction_numerical': 0.01276595744680851, 'mean_word_length': 4.596938775510204, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 4, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5450389', 'n_tokens_mistral': 915, 'n_tokens_neox': 852, 'n_words': 501}