I've been using Little Snitch for years, and it's probably the most important software on my computer. However, I've noticed a problematic trend in modern software development: developers are using the same hostname to serve both functional and non-functional web APIs. For example, let's say that Apple's Xcode sends harmless data to their telemetry service at telemetry.apple.test. Even though the data is anonymous, I…
This would be very, very hard to do well. First, for anything that doesn’t use standard libraries for TLS it’s simply not possible. And for things that do, you’re putting this software in a phenomenally trusted position. And then actually maintaining and using a deny/allow list based on something more granular than host:port will be so high that it’s a 0.1% of users type feature.
Negative RoI