301–310 of 391 posts
What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…
Earlier quoted context omitted.
> it may ask your permission I wonder when that is? Because I haven’t used PP yet, and it didn’t ask me. Of course, we use Office 365, and maybe my boss turned it on globally? Does anyone know where the setting is?
Have you used the Designer feature? That’s what’s being talked about. It should prompt you when you first use it. If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM.
Yes.
> If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM.
It has to be a global Office 365 setting, my computer is not in the domain, I’m the only admin for it. That’s why I’m asking where the setting for the permission is, so I can have a look at it (I’m secondary admin for the O365 account) and potentially disable it.
Earlier quoted context omitted.
Do you make the same differentiation when it comes to what Chinese companies may collect from the computers of American companies? Especially this part: > there's a difference between the data being nigh-impossible for internal employees to access (perhaps only used as input for other automated systems), and data with few controls.
This bias is very apparent in most of western media. A Chinese software vendor could do as much as sending your keystrokes for autocomplete you bet it will be front page news on Reddit and here with every comment reminding me about Xinjiang and 1989. But Microsoft could upload the entirety of your hard drive and we would find apologists like OP rationalizing away the behavior. I’m not convinced either governments are…
By which you mean that we have plenty of evidence that both are?
Earlier quoted context omitted.
On Linux there is OpenSnitch that does its job nicely, although I experienced some occasional desktop slowdowns even after training it to open everything for trusted programs. https://github.com/evilsocket/opensnitch I still recall the old days of Windows when I tried Kerio Personal Firewall and realized how much software already phoned home two decades ago. That was the last wake up call that pushed me into getting…
Keep in mind, OpenSnitch is Linux-based and none of Linux firewalls can filter incoming packets by process ID like macOS/FreeBSD (Lil'Snitch) can.
https://linux.die.net/man/8/iptables
--pid-owner processid
Matches if the packet was created by a process with the given process id.
> NOTE: pid, sid and command matching are broken on SMP
Earlier quoted context omitted.
It's complicated, but the 2013-2014 years were when the bulk of the Snowden leaks were hitting the internet, and people were starting to dig up really suspicious stuff relating to all big tech companies, not just Apple. However, Apple was still among the companies compliant with PRISM, the NSA's newly established surveillance/tracking effort that also roped in Microsoft, Google, AOL and any other major service provid…
Why do you trust Little Snitch? It's closed source and in the perfect position to steal information.
This seems blindingly obvious? They use a cloud powered feature, then complain that information is sent to the cloud? According to this help article using designer for the first time will request permissions. https://support.microsoft.com/en-us/office/create-profession...
Earlier quoted context omitted.
Keep in mind, OpenSnitch is Linux-based and none of Linux firewalls can filter incoming packets by process ID like macOS/FreeBSD (Lil'Snitch) can.
From what I understand opensnitch use ebpf to match where the exiting packets are going. TCP being TCP, it is easy to know where the incoming answer will be delivered to as well.
Why doesn’t this article include the packet capture or whatever data he has that shows exactly what’s being sent?
Earlier quoted context omitted.
Keep in mind, OpenSnitch is Linux-based and none of Linux firewalls can filter incoming packets by process ID like macOS/FreeBSD (Lil'Snitch) can.
I think iptables was supposed to be able to do this, right? https://linux.die.net/man/8/iptables --pid-owner processid Matches if the packet was created by a process with the given process id. But was disappointed by the note: > NOTE: pid, sid and command matching are broken on SMP
That's a really outdated version of the man page. The current one is: https://ipset.netfilter.org/iptables-extensions.man.html
Probably the closest thing these days is to use the cgroup match extension, together with something that makes sure separate apps are moved to their own cgroup. But that cgroup would be under a separate parent cgroup for each user so it's not ideal.
I expect NFQUEUE or some EBPF magic is a better way to do things - you don't want to be constantly adding/removing per-process iptables rules.
Earlier quoted context omitted.
How do you know there are no outside efforts to log linux activities? There's a lot of source code to go through and is it possible there are callbacks even within OSS that most people are not aware of?
I don’t need to go through all the source code myself. The fact that Apple itself, for example, relies on Linux for most of its servers and has not raised any alarms about bits of Linux phoning home is a pretty powerful heuristic that it’s relatively safe. Multiply that by all the multibillion dollar other companies, the tens of thousand open source focused smaller and large companies, the hobbyists, the enthusiasts,…
Many world-class companies depend on Windows, so does that mean you think Windows is safe?
An individual does not have the same access to custom tools, and teams of competent people, that ensure their usage of the Linux ecology is secure.
A recent example: I was investigating using CloudFlare Functions, because I think CloudFlare has world-class security and that “serverless” product avoids many security issues I might have with other solutions. Yet one setup step suggested piping in a script from curl to shell (commonly suggested for install steps!). Even worse, https://github.com/cloudflare/wrangler2 is their CLI tool to help development, and Wrangler is based on the node ecology, which is completely insecurable as an individual developer IMHO (trillion dollar companies can probably secure the dev environment). I use a VM to provide some sandboxing, but it still leaves me feeling icky.