Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LuLu: An open-source macOS firewall that blocks unknown outgoing connections

objective-see.com

Post reply on HN
Print view View original

101–110 of 252 posts

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#101

Post by pdonis »

willstrafach wrote: post #94
pdonis wrote: post #52

Unfortunately, this still has the key flaw that has plagued outbound firewalls since their invention: "Currently, LuLu only supports rules at the 'process level', meaning a process (or application) is either allowed to connect to the network or not. As is the case with other firewalls, this also means that if a legitimate (allowed) process is abused by malicious code to perform network actions, this will be allowed."…

> In other words, it won't stop malicious Javascript running in your browser from making an outbound connection, which is the most common way for malware to do that. This might be possible, if you start off with deny-all as the default and then start manually adding exceptions as you browse.

> This might be possible, if you start off with deny-all as the default and then start manually adding exceptions as you browse.

Which is unworkable if you visit more than a small number of websites, as I said in another subthread.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#102

Post by pdonis »

qubex wrote: post #78
pdonis wrote: post #52

Unfortunately, this still has the key flaw that has plagued outbound firewalls since their invention: "Currently, LuLu only supports rules at the 'process level', meaning a process (or application) is either allowed to connect to the network or not. As is the case with other firewalls, this also means that if a legitimate (allowed) process is abused by malicious code to perform network actions, this will be allowed."…

And of course, anything local to the machine can only be trusted as long as you are willing to accept that the kernel is not compromised, because it's pretty trivial for a rootkit that is running in the kernel’s context to conceal files, sockets, or even create unreported network interfaces. I remember that Greg Hoglund's rootkit.com contained several first crude (and not so crude) implementations that could do this…

> anything local to the machine can only be trusted as long as you are willing to accept that the kernel is not compromised

Yes, of course. That's one of the reasons I run Linux.

> if you are really serious about firewalling, said firewall must be a separate device.

Yes. That's a key reason I run OpenWRT on a router I own instead of taking whatever my ISP wants to give me.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#103

Post by lifty »

killjoywashere wrote: post #65

What I want for all these services (Little Snitch, ESET, etc) is an EasyList-like ... list. A community-aggregated and reviewed list of servers that don't merit my connection. I'd pay a monthly subscription fee for that. I'd also like separate lists for * "this wifi is public, be extra cautious" * "this wifi is public, be nice and don't torrent, do backups, etc" * "I'm on a metered connection (e.g. LTE), don't run to…

I would pay for such a service as well. In addition to that, I would love if this service would allow companies like Apple and Google to maintains their own lists of IP's and update them regularly, so you can be 100% sure that an IP belongs to them.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#104

Post by flanbiscuit »

willstrafach wrote: post #94
pdonis wrote: post #52

Unfortunately, this still has the key flaw that has plagued outbound firewalls since their invention: "Currently, LuLu only supports rules at the 'process level', meaning a process (or application) is either allowed to connect to the network or not. As is the case with other firewalls, this also means that if a legitimate (allowed) process is abused by malicious code to perform network actions, this will be allowed."…

> In other words, it won't stop malicious Javascript running in your browser from making an outbound connection, which is the most common way for malware to do that. This might be possible, if you start off with deny-all as the default and then start manually adding exceptions as you browse.

I would like to see internet access treated as an OS permission that need to be expressly granted by the user, same goes for iOS and Android. I wish this was part of the OS and not something I need to go and install 3rd party apps for. I like the idea of deny all by default.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#105

Post by iamdave »

killjoywashere wrote: post #65

What I want for all these services (Little Snitch, ESET, etc) is an EasyList-like ... list. A community-aggregated and reviewed list of servers that don't merit my connection. I'd pay a monthly subscription fee for that. I'd also like separate lists for * "this wifi is public, be extra cautious" * "this wifi is public, be nice and don't torrent, do backups, etc" * "I'm on a metered connection (e.g. LTE), don't run to…

takes notes

So would you want just the curated list, or an application that uses said list and provides feedback to the user? Either? Both?

Because I've _sort_ of done this on my personal Mac-though for reasons more pertaining to an infrastructure I maintain for a client, scaling this to a type of service wouldn't be TOO difficult.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#106

Post by killjoywashere »

lifty wrote: post #103
killjoywashere wrote: post #65

What I want for all these services (Little Snitch, ESET, etc) is an EasyList-like ... list. A community-aggregated and reviewed list of servers that don't merit my connection. I'd pay a monthly subscription fee for that. I'd also like separate lists for * "this wifi is public, be extra cautious" * "this wifi is public, be nice and don't torrent, do backups, etc" * "I'm on a metered connection (e.g. LTE), don't run to…

I would pay for such a service as well. In addition to that, I would love if this service would allow companies like Apple and Google to maintains their own lists of IP's and update them regularly, so you can be 100% sure that an IP belongs to them.

perfect seed material for the list. Start from an empty Little Snitch config and whois everything that tries to connect.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#107

Post by pdonis »

flanbiscuit wrote: post #104
willstrafach wrote: post #94

Earlier quoted context omitted.

> In other words, it won't stop malicious Javascript running in your browser from making an outbound connection, which is the most common way for malware to do that. This might be possible, if you start off with deny-all as the default and then start manually adding exceptions as you browse.

I would like to see internet access treated as an OS permission that need to be expressly granted by the user, same goes for iOS and Android. I wish this was part of the OS and not something I need to go and install 3rd party apps for. I like the idea of deny all by default.

> I would like to see internet access treated as an OS permission.

That would be nice, but it wouldn't fix the problem I've been talking about, because you would have to give your browser the internet access permission, and the OS has no way of knowing which of the connections your browser is making are legitimate and which are not. Only you know that, which means you would have to continually be interrupting your browsing to approve or disapprove connections.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#109

Post by killjoywashere »

iamdave wrote: post #105
killjoywashere wrote: post #65

What I want for all these services (Little Snitch, ESET, etc) is an EasyList-like ... list. A community-aggregated and reviewed list of servers that don't merit my connection. I'd pay a monthly subscription fee for that. I'd also like separate lists for * "this wifi is public, be extra cautious" * "this wifi is public, be nice and don't torrent, do backups, etc" * "I'm on a metered connection (e.g. LTE), don't run to…

takes notes So would you want just the curated list, or an application that uses said list and provides feedback to the user? Either? Both? Because I've _sort_ of done this on my personal Mac-though for reasons more pertaining to an infrastructure I maintain for a client, scaling this to a type of service wouldn't be TOO difficult.

I want to drop that list into little snitch. In fact, when I install Little Snitch, I want it to ask me "would you like to subscribe to iamdave's list?"

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#110

Post by siruncledrew »

draugadrotten wrote: post #31
erAck wrote: post #18

Nowadays it's more important to control and restrict outgoing connections than incoming connections. Who would had thought of that 25 years ago.

Give it another 25, and you will have to pay a premium for things which are stand-alone, disconnected from the net. Want a car which is not navigating using cloud AI? Only the rich can afford that...

Hands-free AI navigation is still worth it to not totally disable though. Now paying to not have all your personal driving data, preferences, and in-car conversations uploaded to the cloud is another story..
Post reply on HN