Live data from Hacker News

Snitch – A friendlier ss/netstat

github.com

41–50 of 109 posts

Re: Snitch – A friendlier ss/netstat

#41
post #25

Earlier quoted context omitted.

Are they as accessible as GUI though (genuine question) UI libraries have a lot of features for allowing people with disabilities to “read” and interact with the screen in efficient ways

Accessibility is a great thing to have and strive for, but it cannot be the number one design principle. Imagine if everything around us would be designed for blind people.

I suspect blind people imagine that a lot.

The idea is to design for all (or as many as feasible), it's not a binary either/or.

Re: Snitch – A friendlier ss/netstat

#42

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

At the very least, these tools should not parse /proc to obtain information of processes or connections. It should be the last option.

Many LD_PRELOAD rootkits hide their activity from the system by manipulating the output of libc functions like readdir(), open(), stat(), etc. kernel rootkits can hide whatever they need, but the common functionality is also to hide data from /proc.

That's why netstat, ps, *top or lsof are not reliable tools if the system is compromised. ss is a bit different and is a bit more reliable.

In this case, snitch is written in Go, which doesn't use the libc functions, so probably it'll be able to obtain information from /proc even if hidden by a LD_PRELOAD rootkit.

Another option would be to compile the binary statically.

Anyways, these tools are not meant to unhide malicious traffic or processes, so I think detecting beacons, inspecting traffic, etc, is out of the scope.

Resources:

https://github.com/gustavo-iniguez-goya/decloaker

User-space library rootkits revisited: Are user-space detection mechanisms futile? - https://arxiv.org html/2506.07827v1

The Hidden Threat: Analysis of Linux Rootkit Techniques and Limitations of Current Detection Tools - https://dl.acm.org/doi/10.1145/3688808

https://matheuzsecurity.github.io/hacking/bypass-userland-ho...

https://ops.tips/blog/how-is-proc-able-to-list-pids/

Re: Snitch – A friendlier ss/netstat

#43
post #8

When I saw this headline I assumed it was Little Snitch an existing network monitor and firewall for Macs. Might need a different name. https://www.obdev.at/products/littlesnitch/index.html

I immediately thought of that too. The names these people come up with are so embarrassing. And I'm not even talking about the meaning of 'snitch'. But you already have a tool within the same IT area that is basically named the same. Why the hell would you do that? Aren't there other words in the dictionary?

It's not even a friendly word

Re: Snitch – A friendlier ss/netstat

#44
post #25
post #13

I love the recent increase in TUI-based tooling. This looks cool - will check it out!

Are they as accessible as GUI though (genuine question) UI libraries have a lot of features for allowing people with disabilities to “read” and interact with the screen in efficient ways

TUI tools are generally as accessible as the terminal on which they run.

GUI apps are much trickier. They require that the developer implement integration with accessibility frameworks (which vary depending on X11/Wayland) or use a toolkit which does this.

Re: Snitch – A friendlier ss/netstat

#45

Earlier quoted context omitted.

I think the same applies for many of the new breed of command line applications like fd and ag/rg. Being able to use them intuitively trumps ubiquity, speed or features.

But it's not tradeoff! You can make default view useful without trading versatility. Another annoying part is not supporting json or even CSV. Some tools got modernized with it (like iproute2 tool set), but for these you might as well do /proc scraping yourself...

That's true in general. But default view is still subjective. The challenge probably lies in recognizing the larges subset of your user base that would like it to be a certain consistent way.

Re: Snitch – A friendlier ss/netstat

#46
post #40

Earlier quoted context omitted.

1. Linux → https://github.com/evilsocket/opensnitch 2. Windows → https://www.glasswire.com/ 3. Windows (open source) → https://github.com/henrypp/simplewall 4. Windows → https://safing.io/

I've been a long time Litte Snitch user. However, these days I'm just using LuLu: https://objective-see.org/products/lulu.html

Why did you switch? Price? OSS? Or does LuLu have compelling features?

Re: Snitch – A friendlier ss/netstat

#47

Earlier quoted context omitted.

Seems like a fine name. Why would little snitch existing necessitate a name change?

Because it's potentially trademark infringement because it could confuse people.

Can you actually trademark a common word? (Serious question)

Re: Snitch – A friendlier ss/netstat

#48
One aspect of sysadminship that I find cute (but suboptimal) is how we memorize this strings of commands that were clearly not quite designed to be used in that manner. A slightly related example is how our intents in our mind end up having commands that don't resemble at all what we actually want, creating a map between intent and command that is almost exclusively arbitrary except for some obsucre etymological origin that might or might not help you remember the command in a time of need.

For example:

Intent: "create a file"

Command: "touch $FILE"

As it happens, touching a file doesn't mean to create, it was supposed to touch to modify the last access date, like a null op. But now if you want to create a file you do that.

Intent: "Print a file contents to screen" Command: "cat $FILE"

Is this a reference to a feline? some slang for printing or reading? No it's short for concatenate, but if you pass just one argument instead of 2, it prints the concatenation of 1 file and nothing.

Even something as simple as

Intent: "Rename a file" Command: "mv $FILE"

Of ocurse there's the fact that moving a file and renaming the file are very similar if not identical in most FS/OS, but also, the slight change from a word to a proper-name style command already creates a style of command line interaction that was very natural in the 80s, but is now being reinvented with the advent of more powerful language decoding technology. So even:

Intent: "Copy a file" Command: "cp $FILE"

Now to the topic, you can see how my relationship with ss is the mapping:

Intent: "See a list of open ports" Command: "ss -tulnp"

Which I remember mnmemotecnically because it is close to -tulip. This is similar to ps -aux in that the command includes a set of options and I remember it mnemotecnically ("auxiliary" or "auxilio"), and I use the options even when I don't need them, modifying the options from that baseline if needed, like removing "a" to get just the current user's processes.

That said. I don't know if the future is going to be "better" alternatives to old tools, but rather deconstructing or making use of the concept of "binary":"command", running man and --help has never been an optimal solution, and let's be honest, kids nowadays are googling, stackoverflowing and chatgpting their intent in order to get a magical command.

No easy way to improve upon this at the userspace level, the OS model of delegating control to binaries based on a hierarchical command structure is sensible, and "magic", or sharing commands across binaries without a clear ruleset would be too opaque. But I feel that creating new tools while barely revolutionizing the way they work is too small an incremental change, it adds more noise, I'm not sure that ss2 or network-manager instead of wpa_supplicant is a better outcome, now you are just linearly increasing the cognitive demand of new sysadmins linearly with time.

Sorry to be a bummer.

Re: Snitch – A friendlier ss/netstat

#49
post #25

Earlier quoted context omitted.

Are they as accessible as GUI though (genuine question) UI libraries have a lot of features for allowing people with disabilities to “read” and interact with the screen in efficient ways

Accessibility is a great thing to have and strive for, but it cannot be the number one design principle. Imagine if everything around us would be designed for blind people.

Not necessarily designed for, but accessible to.

Additionally in sysadmin, blind-users are not just some random group, the ability not to use one's eyes is central to the Command Line Interface. You could always in theory get by with just a keyboard and a TTS that reads out the output, it's all based on the STDIO abstractions that are just string streams, completely compatible and accessible to blind, and even deaf users. (Unlike GUIs)

Re: Snitch – A friendlier ss/netstat

#50

I just want a single tool that has a known, generalized set of capabilities on just about every distribution. Systemd's obsession with remaking every single wheel in Linux has been aggravating enough. Please don't do it again.

That's not a feature that the developer has control over. All they can do is try to develop a good tool.
Post reply on HN