Using eBPF to see through encryption without a proxy

In plain words

qtap is a lightweight agent that uses eBPF technology to inspect encrypted traffic in production systems without requiring a proxy or TLS termination. It allows developers to see what data is being sent to third-party APIs, identify potential personally identifiable information exposure, and debug integration issues. The tool operates at the application level rather than network layer, avoiding the performance overhead and certificate management complexity of traditional forward proxies.

written from the facts on this page · September 2026

From the sources

Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes. - qpoint-io/qtap

In the maker’s words, at launch

Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data…

• 
  QTap DevTools – Chrome-style encrypted traffic inspector for LinuxJan 2026 · qpoint.io · ▲30

  Hi HN, I'm Tyler Flint. Eight months ago we shared qtap here (https://news.ycombinator.com/item?id=43928118). Today we're releasing DevTools - a browser-based interface that gives you the Chrome Network tab experience for server-side HTTP/S traffic. The problem: You're debugging a production issue. An external dependency is returning errors. Your logs say "request failed" but not what was actually sent. Adding debug logging means redeploying and restarting services - which takes time and often changes the conditions you're trying to debug. tcpdump shows encrypted blobs.…

• FA
  Firefox addon to quarantine a tab to use offline with private data2023 · ▲166

  Introducing QuaranTab: Companion extension to quarantine tabs so you can safely use them offline with private data I find myself wanting to use online format parsers to quickly decode that production JWT or decode a base64 Authorization header but cannot trust these websites to not leak my information. I thought to myself if only I could cut-off network access to this site, use it offline, and then throw away all browsing data. So I created an extension just for that. It uses Firefox contextual identities API (Containers) to isolate browsing data and inter-tab communication. Once the site is…

• 
  Context GatewayMar 2026 · github.com · ▲220

  We built an open-source proxy that sits between coding agents (Claude Code, OpenClaw, etc.) and the LLM, compressing tool outputs before they enter the context window. Demo: https://www.youtube.com/watch?v=-vFZ6MPrwjw#t=9s. Motivation: Agents are terrible at managing context. A single file read or grep can dump thousands of tokens into the window, most of it noise. This isn't just expensive — it actively degrades quality. Long-context benchmarks consistently show steep accuracy drops as context grows (OpenAI's GPT-5.4 eval goes from 97.2% at 32k to 36.6% at 1M…

• PI
  Pixie, Instant Kubernetes-Native Application Observability Using EBPF2020 · pixielabs.ai · ▲108
• 
  Zxc – Rust TLS proxy with tmux and Vim as UI, BurpSuite alternative2025 · github.com · ▲106

  Ditch Burp Suite’s bloat for zxc, a Rust-built, terminal-based proxy that uses tmux and Vim to intercept HTTP/S and WebSocket traffic. It captures requests for debugging, security testing, or tweaking—fast and lean. # Key Features - Disk Wizardry: Stashes massive datasets on disk-100k+ entries without breaking a sweat. - Addons: Boost your workflow with default support for ffuf and sqlmap, or craft your own addons for extra fun. - Buffer Tweaks: Edit variables in a popup (e.g., b:host, b:scheme) in Interceptor/Repeater to twist requests. - Config Control: TOML files for global…

• 
  Write your BPF programs in Go, not CMay 2026 · github.com · ▲112

  Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings. - boratanrikulu/gobee

• 
  WallHop – 12ft.io is gone, so I built a replacement▲287

  wallhop is a free paywall bypass. Paste any article link to read it without paywall popups, ads or clutter. No signup, no extension. A simple 12ft.io alternative.

  Growth · 11d ago · wallhop.io

• 
  Prefer▲201

  The execution layer for AEO

  Growth · 22d ago · tryprefer.com

• 
  MakerMap▲197

  A living map of makers and what they’re building

  Growth · 26d ago · makermap.lol

• 
  Tapflow 2.0▲1,125

  We built Tapflow for devs, designers, PMs, and tech folks who’ve been sitting on internal docs, templates, and systems — but never productized them. Upload a PDF, notes, or workshop deck, and Tapflow drafts a structured product (with chapters, teaser and pricing plans). It’s good for AI kits, onboarding guides, design systems, and frameworks. You can sell through Stripe, LemonSqueezy, or PayPal. Real-time collaboration is in early beta. No site builder, no LMS — clean design and just focused tools to ship. Fully bootstrapped and just launched on PH today →…

  Work · 2025 · tapflow.ai

• C9
  Clippy – 90s UI for local LLMs▲1,122

  Life & fun · 2025 · felixrieseberg.github.io

• 
  Appwrite Sites▲990

  Appwrite 2.0 brings a new engine, a rebuilt Console, five database types, an S3 API, an OAuth 2.1 server, and organization-level Domains and Firewall.

  Dev tools · 2025 · appwrite.io

• 
  AI Meeting Notes by Notion▲965

  Perfect meeting memory in Notion

  AI · 2025 · notion.com

• 
  Den▲948

  Multiplayer AI agent builder

  AI · 2025 · getden.io

• 
  Raycast for iOS▲870

  Powerful productivity on the go

  AI · 2025 · raycast.com