51–60 of 489 posts
Earlier quoted context omitted.
This seems pedantic and I think you know what they’re questioning and why.
> I think you know what they’re questioning and why. No, not really. And I disagree with the premise, "They must be a target for the various hacking groups out there." How would you even hack them? I'm a developer too; how would you hack me?
Why would one use this over PiHole?
I run both (LS on Mac, at least), they do different things - pi.hole is a great ad blocker which applies to all of the devices on your network. Little Snitch is doing something different - it tells you every call that every app you use is making, and allows you to approve or deny each one. So, you can block telemetry for apps, or you can block certain apps from contacting certain servers, or you can just use it to wa…
pi.hole is primarily billed as an ad blocker, but the fundamental way it works is by applying a curated set of DNS lists that are blocked (commonly telemetry and ad servers), and the admin dashboard which is just a web page (therefore works on all platforms, smartphones included) will do the same thing: it tells you every call that every app on every device on your network is making, and you can approve or deny it. You can curate your own list as well and block servers/connections you don't want on the network.
LS afaik operates in the same area where it's intended to be used for privacy. I guess I could see it being useful for people who don't have admin access to their router, but for people who do have such access I would think the benefits of network-wide DNS monitoring/blocking would outweight the costs of having to configure your router settings.
Why would one use this over PiHole?
Completely different thing. A littlesnitch type thing is for all traffic. Pihole is a DNS query thing that prevents various ad content from being loaded. It's also trivially easy for a malicious application with network access to bypass any instance of pihole on your LAN by doing its own DNS over HTTPS lookups to its own set of server(s) by IP.
Earlier quoted context omitted.
> I think you know what they’re questioning and why. No, not really. And I disagree with the premise, "They must be a target for the various hacking groups out there." How would you even hack them? I'm a developer too; how would you hack me?
?! The same way every other developer that has been hacked. You surely cannot be suggesting you're un-hackable. That seems ludicrously hubristic.
There's not one single way, so, no, you're just hand-waving here.
Earlier quoted context omitted.
> I think you know what they’re questioning and why. No, not really. And I disagree with the premise, "They must be a target for the various hacking groups out there." How would you even hack them? I'm a developer too; how would you hack me?
Options range from carefully targeted phishing or social engineering attacks to poor opsec and a five dollar wrench.
I'm not even going to respond to this ridiculousness.
I still don't know why anyone thinks that, among all developers in the world, a little indie Mac developer is getting targeted specifically.
Probably should throw it out there that I'm building something inspired by littleSnitch for windows. Currently a bit stealthy about it. But when I crowd source the funding for a code signing cert I'll get it out there. Lots of inspiration from LittleSnitch, in spirit if not actual code.
I'd be curious to hear additional details if you can share - got a timeline, or somewhere I can enter my email address for updates? I'd love to alpha/beta test if you're looking for testers. I've been a GlassWire user for years, which partially fills the role of LS, but not very well. Aside from the many performance issues I've seen, it's missing a lot of LS essentials. To be fair, I think the focus of GlassWire is m…
If you or I guess anyone is curious sereno[hyphen]alpha[dot]ramble[thenumberoftechn9ne'sfavoriterum]@passinbox.com
Earlier quoted context omitted.
Yep, I trust the obdev.at / Snitch guys. I do wonder however, are they sufficiently careful about their processes and own machines to avoid a supply chain attack completely. They must be a target for the various hacking groups out there.
This comment seems a bit confused. A supply chain attack doesn't directly attack an end developer but rather a supplier of the developer. So who or what is the supplier in this case?
The comment was asking about preventing a compromised supplier for the developers.
A supply chain attack can be anywhere in the supply chain to the target. If I, the end user, am the target, then a supply chain attack compromising the developer of LittleSnitch is effective.
I may then be a conduit to compromising other software or components, and would both I and LittleSnitch would be part of the supply chain that could be attacked targeting them.
Isn't MacOS just *nix under the hood? Genuinely curious about this difference.