Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

101–110 of 489 posts

Re: LittleSnitch for Linux

#101

Post by VerTiGo_Etrex »

alhazrod wrote: post #6

I remember before Little Snitch there was ZoneAlarm for Windows[0] (here is a good screenshot[1]). No clue if the current version of ZoneAlarm does anything like that (have not used it in 2 decades). I always found it weird that Linux never really had anything like it. [0]: https://en.wikipedia.org/wiki/ZoneAlarm [1]: https://d2nwkt1g6n1fev.cloudfront.net/helpmax/wp-content/upl...

Wow. Insane throwback. I think I first learned about ZoneAlarm from some PC magazine my parents bought for me. Completely forgot about this great piece of freemium!

Re: LittleSnitch for Linux

#102

Post by loeber »

brandon272 wrote: post #32
alhazrod wrote: post #6

I remember before Little Snitch there was ZoneAlarm for Windows[0] (here is a good screenshot[1]). No clue if the current version of ZoneAlarm does anything like that (have not used it in 2 decades). I always found it weird that Linux never really had anything like it. [0]: https://en.wikipedia.org/wiki/ZoneAlarm [1]: https://d2nwkt1g6n1fev.cloudfront.net/helpmax/wp-content/upl...

Completely forgot about ZoneAlarm. I remember using it in the early 2000s!

Same!

Re: LittleSnitch for Linux

#103

Post by Avicebron »

LoganDark wrote: post #96
TheTaytay wrote: post #95

I’ve been researching the “best” way to build a little outbound network proxy to replace credential placeholders with the real secrets. Since this is designed to secure agents workloads, I figured I might as well add some domain blocking, and other outbound network controls, so I’ve been looking for Little-snitch-like apps to build on. I’ve been surprised to find that there aren’t a ton of open source “filter and pot…

Something almost no firewalls get right is pausing connections (NOT rejecting them) until I've decided whether to allow or not. The only firewalls I've seen do this are Little Snitch for Mac, and Portmaster for Windows (before they made it adware / started locking existing local features behind the subscription).

Firewalls don't do this because they are built at the wrong layer to do proper pending calls. It's too narrow of a design space for most firewalls to care.

Re: LittleSnitch for Linux

#104

Post by chris_wot »

Can someone elaborate on the limitations bit?

"Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible to reliably tie every network packet to a process or a DNS name. And reconstructing which hostname was originally looked up for a given IP address requires heuristics rather than certainty. The macOS version uses deep packet inspection to do this more reliably. That's not an option here."

Is this a limitation of the eBPF implementation? Pardon my ignorance, I'm genuinely curious about this.

Re: LittleSnitch for Linux

#105

Post by LoganDark »

Avicebron wrote: post #103
LoganDark wrote: post #96

Earlier quoted context omitted.

Something almost no firewalls get right is pausing connections (NOT rejecting them) until I've decided whether to allow or not. The only firewalls I've seen do this are Little Snitch for Mac, and Portmaster for Windows (before they made it adware / started locking existing local features behind the subscription).

Firewalls don't do this because they are built at the wrong layer to do proper pending calls. It's too narrow of a design space for most firewalls to care.

True, most firewalls aren't built to pause for user input. But then again, that's why almost no firewall software is suitable for this user experience.

Re: LittleSnitch for Linux

#106

Post by chabreck »

lapcat wrote: post #85
gmzamz wrote: post #82

Earlier quoted context omitted.

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

> Said motivation could be a nation state handing them $XXX million dollars You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.

its been known for some time that little snitch and other personal firewalls are established targets of three-letter agencies https://news.ycombinator.com/item?id=13813160

Re: LittleSnitch for Linux

#108

Post by 0xbadcafebee »

> Compatible with Linux kernel 6.12 or higher

I know everyone today is used to upgrading every 5 seconds, but some of us are stuck on old software. For example, my Linux machine keeps rebooting and sucks up power in suspend mode because of buggy drivers in 6.12+, so I'm stuck on 6.8. (which is extra annoying because I bought this laptop for its Linux hardware support...)

Re: LittleSnitch for Linux

#109

Post by emmelaich »

lapcat wrote: post #62
emmelaich wrote: post #50

Earlier quoted context omitted.

They don't build their own machines or write their compilers or write their own crpyto code or ... so many other things.

> They don't build their own machines or write their compilers or write their own crpyto code or ... so many other things. An attack on any of these things has nothing specifically to do with the developers of Little Snitch and would have vastly more widespread and important effects. Why would you even be talking about Little Snitch if a compiler were compromised?!? Your paranoia here is bizarrely narrow. Little Snit…

Their copy of the compiler. Just an example. ¯\_(ツ)_/¯

Re: LittleSnitch for Linux

#110

Post by emmelaich »

lapcat wrote: post #56
emmelaich wrote: post #51

Earlier quoted context omitted.

?! The same way every other developer that has been hacked. You surely cannot be suggesting you're un-hackable. That seems ludicrously hubristic.

> The same way every other developer that has been hacked. There's not one single way, so, no, you're just hand-waving here.

Just saying developers have been hacked. Underrated existence proof.
Post reply on HN