Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

81–90 of 489 posts

Re: LittleSnitch for Linux

#81

Post by mixmastamyk »

waterTanuki wrote: post #53
roughly wrote: post #20

Earlier quoted context omitted.

I run both (LS on Mac, at least), they do different things - pi.hole is a great ad blocker which applies to all of the devices on your network. Little Snitch is doing something different - it tells you every call that every app you use is making, and allows you to approve or deny each one. So, you can block telemetry for apps, or you can block certain apps from contacting certain servers, or you can just use it to wa…

To clarify, I'm aware that pihole is not intended to run on a client OS, and doesn't monitor at a process level. I'm focused on the intended effect rather than the process itself (blocking malicious/ad servers). And I think I framed my initial question incorrectly as if LS and PiHole as subtitutes. It's perfectly fine and even preferrable to use both as layered protection. I'm just thinking however when it comes for…

Some telemetry uses hardcoded addresses when DNS doesn't work.

Some telemetry might not be recognized by pi-hole as it is new or has nothing to do with ads.

Re: LittleSnitch for Linux

#82

Post by gmzamz »

lapcat wrote: post #80
umpalumpaaa wrote: post #75

Earlier quoted context omitted.

Everything has a price though… (I also use little snitch)

> Everything has a price though… What is that supposed to mean in this context?

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users.

Said motivation could be a nation state handing them $XXX million dollars

Re: LittleSnitch for Linux

#83

Post by sneak »

It’s not really necessary on Linux. Linux systems work without 40 invisible background services phoning home to the mothership to leak your hardware identifiers for FAA702 collection.

Re: LittleSnitch for Linux

#84

Post by sgc »

Bromeo wrote: post #3

How does it compare to opensnitch? https://github.com/evilsocket/opensnitch

I just tried littlesnitch and it did not resolve very many ips to domains, which is pretty basic. It also failed to identify most processes, and they were grouped under "Not Identified". It appears these are known limitations of the Linux version [1]. So for that alone I need to stick with opensnitch.

[1] "Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible to reliably tie every network packet to a process or a DNS name. And reconstructing which hostname was originally looked up for a given IP address requires heuristics rather than certainty. The macOS version uses deep packet inspection to do this more reliably. That's not an option here." -- from https://obdev.at/products/littlesnitch-linux/index.html

Re: LittleSnitch for Linux

#85

Post by lapcat »

gmzamz wrote: post #82
lapcat wrote: post #80

Earlier quoted context omitted.

> Everything has a price though… What is that supposed to mean in this context?

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

> Said motivation could be a nation state handing them $XXX million dollars

You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars?

A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.

Re: LittleSnitch for Linux

#86

Post by parhamn »

gmzamz wrote: post #82
lapcat wrote: post #80

Earlier quoted context omitted.

> Everything has a price though… What is that supposed to mean in this context?

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

Or even sell the whole org for say $50M and no one ever mentions anything.

I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.

Re: LittleSnitch for Linux

#87

Post by umpalumpaaa »

gmzamz wrote: post #82
lapcat wrote: post #80

Earlier quoted context omitted.

> Everything has a price though… What is that supposed to mean in this context?

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

That’s what i meant. Thanks for reading my mind. :)

Re: LittleSnitch for Linux

#88

Post by sgc »

unsnap_biceps wrote: post #49
haswell wrote: post #11

Earlier quoted context omitted.

I've used OpenSnitch for years, and while LittleSnitch definitely has a better UI for showing which process is making which connections over time, OpenSnitch does a pretty good job here. I get a modal popup when a program that hasn't made a connection tries to make a connection, and I can either allow/deny in one click, or further customize the rule e.g. allowing ntpd to connect, but only to pool.ntp.org on port 123.…

When I looked at OpenSnitch (years ago), it didn't support running headless on a server. Am I mistaken about this, or has it changed?

You can run daemons on several nodes (different machines) and view them all through a central ui, it is pretty cool.

Re: LittleSnitch for Linux

#90

Post by lapcat »

parhamn wrote: post #86
gmzamz wrote: post #82

Earlier quoted context omitted.

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

Or even sell the whole org for say $50M and no one ever mentions anything. I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.

> I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.

No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.

Post reply on HN