Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LuLu: An open-source macOS firewall that blocks unknown outgoing connections

objective-see.com

Post reply on HN
Print view View original

51–60 of 252 posts

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#51

Post by 333c »

pash wrote: post #41
reaperducer wrote: post #32

Earlier quoted context omitted.

I've seen /, -, --, and +. Any other ones leap to mind? I wonder if there's a complete list somewhere.

The usual convention is a single hyphen for short-form (single-letter) options, and a double hyphen for long-form options: > python -v or > python —-version It’s good practice to offer both. It should also be possible to set multiple options at once by appending one after another in short form following a single hyphen: > ls -alR is the same as > ls -a -l -R Long-form options are technically a GNU thing [0] and are n…

Thanks, this is what I meant in my original comment. I said "named" when I really meant "long-form," as you said.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#52

Post by pdonis »

Unfortunately, this still has the key flaw that has plagued outbound firewalls since their invention:

"Currently, LuLu only supports rules at the 'process level', meaning a process (or application) is either allowed to connect to the network or not. As is the case with other firewalls, this also means that if a legitimate (allowed) process is abused by malicious code to perform network actions, this will be allowed."

In other words, it won't stop malicious Javascript running in your browser from making an outbound connection, which is the most common way for malware to do that.

It does say "currently", but I'm not sure how you would get around this flaw; at any rate, nobody has yet figured out how.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#53

Post by kristofferR »

killjoywashere wrote: post #42
kristofferR wrote: post #39

What's the CPU usage? I tried Little Snitch, but it was often consuming insane amounts of CPU (40%+) which matters a lot on a 12' Macbook on battery, so I uninstalled it.

Long time Little Snitch user here, that seems ... high

Yeah, I though so too. I even tried a complete reinstall, but that didn't improve the situation.

It's probably due to the absurd amounts of logging it does (every single connection tracked on a world map), which I didn't find a way to disable... I probably have an abnormal number of connections too due to torrenting (only Linux distros obviously). The Macbook CPU isn't high performance either.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#55

Post by ballenf »

pdonis wrote: post #52

Unfortunately, this still has the key flaw that has plagued outbound firewalls since their invention: "Currently, LuLu only supports rules at the 'process level', meaning a process (or application) is either allowed to connect to the network or not. As is the case with other firewalls, this also means that if a legitimate (allowed) process is abused by malicious code to perform network actions, this will be allowed."…

Combining process (source) and destination rule combos, the Little Snitch could be customized to "solve" this issue. Process A is allowed to talk to domains X, Y and Z.

"Solve" not solve because, for me, setting up baseline rule sets was too intrusive to my workflow.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#56

Post by ReverseCold »

jle17 wrote: post #54

Unless I'm mistaken, this isn't actually open source, as it's under a non-commercial clause. edit: there is an open issue about it: https://github.com/objective-see/LuLu/issues/4

So it is open source, but you're not free to do what you want with it.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#57

Post by ballenf »

reaperducer wrote: post #28

Looks promising. I used to use Little Snitch, but last year they decided to charge for the new version, and I uninstalled it. Little Snitch was effective, but overly complex for the average user. I'm sure it's great for someone who configures networks on a regular basis, but as a Mac user, I just want to use my Mac. If I wanted to twiddle with security settings all day long, I'd still be on Windows. This looks like i…

That comment makes me chuckle. These days, I have close to zero faith in commercial software that is "free", assuming that the business model is selling my data.

I happily paid for Little Snitch and was comforted by the fact that I was the customer.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#58

Post by HenryBemis »

erAck wrote: post #18

Nowadays it's more important to control and restrict outgoing connections than incoming connections. Who would had thought of that 25 years ago.

me :) I remember in 2000 when I first installed ZoneAlarm as a trial I noticed that Word wanted to connect to something, and I was thinking "why would Word want to escape my PC?

Later I switched to McAfee Corporate Firewall (in which I could even allow/block IPs/ports).

Now I am proudly using WFC that someone mentioned in another post earlier.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#59

Post by skue »

doctoboggan wrote: post #22

Does anyone know how this compares to Little Snitch?

Based only on glancing through the linked product page... here are some LS features LuLu currently lacks:

* Reporting domain names rather than just reporting destination IPs.

* Inbound monitoring & rules

* Temporary rules that auto-expire (e.g. Once, next 15 mins, etc.)

* Fine-grained control over protocol/domain/subdomain in blocking rules (at least when prompted)

* Graphical monitor of recent blocked/allowed traffic

* Profiles to easily change rule sets based on network, etc.

* Unclear whether LuLu provides special handling of connection attempts during startup, software updates, etc.

* Graphical installer, polish, support, etc.

...OTOH, LuLu does provide features I don’t recall seeing in LS:

* Icon indicating whether originating binary has been signed by system/third party/unsigned

* Button to optionally check binary hash against VirusTotal

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#60

Post by jle17 »

ReverseCold wrote: post #56
jle17 wrote: post #54

Unless I'm mistaken, this isn't actually open source, as it's under a non-commercial clause. edit: there is an open issue about it: https://github.com/objective-see/LuLu/issues/4

So it is open source, but you're not free to do what you want with it.

Non-commercial clauses are explicitly prohibited by the OSD.
Post reply on HN