HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
google
nogotofail
Python2014–2015
google / nogotofail · Archived

nogotofail

An on-path blackbox network traffic security testing tool

Systems & InfrastructureSecurity & PrivacyTesting & QualityNetworking
Explore on GitHubRead Hacker News discussions
2Distinct people
2Mentions
1Explicit recommenders
2.9KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

An on-path blackbox network traffic security testing tool

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

Correct. At present the only solution for pre-4.4 devices is to avoid using WebView to display untrusted content. If you're an app developer using WebView you should make sure…

divegeek used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week2 dated mentions

Observed mentions: 2014-11-04 21:46:10 UTC to 2015-01-25 18:43:56 UTC. Weeks start Monday, UTC.

012014-11-03 00:00:00 UTC to 2014-11-10 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 commentsNov 32014-11-10 00:00:00 UTC to 2014-11-17 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-11-17 00:00:00 UTC to 2014-11-24 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-11-24 00:00:00 UTC to 2014-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-12-01 00:00:00 UTC to 2014-12-08 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-12-08 00:00:00 UTC to 2014-12-15 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsDec 82014-12-15 00:00:00 UTC to 2014-12-22 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-12-22 00:00:00 UTC to 2014-12-29 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-12-29 00:00:00 UTC to 2015-01-05 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-01-05 00:00:00 UTC to 2015-01-12 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-01-12 00:00:00 UTC to 2015-01-19 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-01-19 00:00:00 UTC to 2015-01-26 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsJan 19

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Nov 32014-11-03 00:00:00 UTC2014-11-10 00:00:00 UTC110
Nov 102014-11-10 00:00:00 UTC2014-11-17 00:00:00 UTC000
Nov 172014-11-17 00:00:00 UTC2014-11-24 00:00:00 UTC000
Nov 242014-11-24 00:00:00 UTC2014-12-01 00:00:00 UTC000
Dec 12014-12-01 00:00:00 UTC2014-12-08 00:00:00 UTC000
Dec 82014-12-08 00:00:00 UTC2014-12-15 00:00:00 UTC000
Dec 152014-12-15 00:00:00 UTC2014-12-22 00:00:00 UTC000
Dec 222014-12-22 00:00:00 UTC2014-12-29 00:00:00 UTC000
Dec 292014-12-29 00:00:00 UTC2015-01-05 00:00:00 UTC000
Jan 52015-01-05 00:00:00 UTC2015-01-12 00:00:00 UTC000
Jan 122015-01-12 00:00:00 UTC2015-01-19 00:00:00 UTC000
Jan 192015-01-19 00:00:00 UTC2015-01-26 00:00:00 UTC101

What Hacker News says

2 sources
divegeek·Jan 25, 2015Recommendation phrase
Correct. At present the only solution for pre-4.4 devices is to avoid using WebView to display untrusted content. If you're an app developer using WebView you should make sure it's only displaying trusted content which means either local content or remote content from trusted sites with non-broken SSL. I recommend using Google's recently-released nogotofail toolkit to test for SSL breakage (https://github.com/google/nogotofail). The ideal fix for this problem is for OEMs to update devices to 4.4.
In Why Google won't fix a security bug in almost a billion Android phones

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.