Eric Lawrence

The tool uses a ton of energy even when the tab is not visible. Could you use the [PageVisibility API] (https://developer.mozilla.org/en-US/docs/Web/API/Page_Visibility_API) to pause updates when the tab is not visible...

Current phrasing like > those cookies which would actually be sent over HTTP etc. talks all about sending a Cookie header, but we should be clear that this applies to...

I wasn't sure exactly what was meant by this? Isn't rebuilding infrastructure == pain? > Our goal should be to ensure that the friction involved with rebuilding their entire infrastructure...

Looks like you've already got the certificate, so <deploymentProvider codebase="http://www.hanselman.com/BabySmash/BabySmash.application" /> can become <deploymentProvider codebase="https://www.hanselman.com/BabySmash/BabySmash.application" />

IP addresses aren't sent in SNI

3

Browsers shouldn't be sending an IP address in a SNI, and LetsEncrypt, as far as I know, should refuse to issue a certificate for an IP address.

TLS handshake sniff may fail if client sends 1 byte before rest of handshake

1

If the first MSG_PEEK returns only one byte, it should probably block until the second byte is read?

Word detector checks for incorrect protocol

1

On Windows, at least, the current version of Word registers for `ms-word` rather than `word`. 

Brotli support?

3

A while back, Chromium started using Brotli compression on textual resources. It doesn't look like the unpacker handles that? If I strip 8 bytes off the front of the file...

Correct isCommentLine()

2

I don't know much about Go, but the old code definitely looks wrong.