Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

241–250 of 489 posts

Re: LittleSnitch for Linux

#241

Post by worthless-trash »

m132 wrote: post #217
fsflover wrote: post #176

Earlier quoted context omitted.

What else is this about? Debian repositories still contain no malware and if you install software exclusively from them, you'll be safe.

Run OpenSnitch for a while and you'll quickly realize how much of your system does phone home. Off the top of my head: - GNOME Shell (extension updates without a way to disable this, weather), - GNOME Calculator (currency exchange rates), - NetworkManager (periodic hotspot portal checks in most configurations), - GDB (debuginfod enabled by default), - Firefox (extension updates, push notifications, feature flags, tel…

Are these malware ?

Re: LittleSnitch for Linux

#242

Post by eviks »

alsetmusic wrote: post #238
eviks wrote: post #134

Earlier quoted context omitted.

Did the "attention to detail" phrase come from devs or you?

From me. OD is a great dev firm. Do you understand my statement?

Do you understand that you can't redirect the question addressed to you to the devs if that question questions your own statement by pointing out that some important details are not attended to?

Re: LittleSnitch for Linux

#244

Post by littlesnitch »

sgc wrote: post #84
Bromeo wrote: post #3

How does it compare to opensnitch? https://github.com/evilsocket/opensnitch

I just tried littlesnitch and it did not resolve very many ips to domains, which is pretty basic. It also failed to identify most processes, and they were grouped under "Not Identified". It appears these are known limitations of the Linux version [1]. So for that alone I need to stick with opensnitch. [1] "Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can…

Regarding unidentified processes: Little Snitch daemon must have been running when the process started in order to identify it reliably. It's best to reboot after installation so that Little Snitch starts before everything else. I should probably note this somewhere.

And regarding failed reverse DNS names: Little Snitch is sniffing DNS lookups. If lookups are encrypted, there is little it can do. We usually recommend DNS encryption at the systemd layer, not at app layer. This way we can see lookups on 127.0.0.53 and the actual lookup sent out is still encrypted.

Also, it's currently only sniffing UDP lookups, not TCP. The eBPF part is already very close to the complexity limits (700k instructions of allowed 1M) and adding TCP parsing would exceed this limit. It should be possible to forbid TCP port 53 with a rule, though. Some complex DNS lookups will fail, but routine things should still work.

Re: LittleSnitch for Linux

#245

Post by zamadatix »

duskdozer wrote: post #225
zamadatix wrote: post #220

Earlier quoted context omitted.

With the literal rules described it would not be blocked. A more detailed rule (in Open Snitch at least, not as familiar with the other variants) could match e.g. whether the process's parent tree contained the python binary rather than just if python is the process binding the socket.

Would it silently allow or would you still get the notif or whatever (iirc from littlesnitch years ago)?

The allow rule for Firefox is what would suppress the prompt. You probably don't want to have a prompt for every Firefox connection though, so you'd need to come up with some kind of ruleset (or get very annoyed :D).

Re: LittleSnitch for Linux

#246

Post by m132 »

worthless-trash wrote: post #241
m132 wrote: post #217

Earlier quoted context omitted.

Run OpenSnitch for a while and you'll quickly realize how much of your system does phone home. Off the top of my head: - GNOME Shell (extension updates without a way to disable this, weather), - GNOME Calculator (currency exchange rates), - NetworkManager (periodic hotspot portal checks in most configurations), - GDB (debuginfod enabled by default), - Firefox (extension updates, push notifications, feature flags, tel…

Are these malware ?

Per se? No, maybe with the exception of GNOME Shell which literally runs code from the Internet unsandboxed. Can the traffic they silently generate be used for malicious purposes? Absolutely.

Re: LittleSnitch for Linux

#247

Post by lapcat »

latexr wrote: post #232
lapcat wrote: post #90

Earlier quoted context omitted.

> I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too. No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.

Depends on the target and what you can get. Think about Bartender, an app requiring an insanely high level of trust and permissions, which was quietly sold. If you know of someone specific you want to target who uses it, the investment could pay off. For example, we know from your blog posts that you use LittleSnitch. Someone who wanted to target you might do a lot to spy on you by buying LittleSnitch, probably. Thin…

> Depends on the target and what you can get. Think about Bartender,

As I said in another comment, Bartender had no target! It was not an attack. An app was sold by one developer to another developer. End of story.

> If you know of someone specific you want to target who uses it

But you don't. And you don't in the case of Little Snitch either.

You can dream up a bunch of absurd hypothetical scenarios, but they are not the reality.

> Someone who wanted to target you

Nobody wants to target me. Nobody cares about me. I am insignificant.

Re: LittleSnitch for Linux

#249

Post by dmantis »

mixedbit wrote: post #230

Recently I was wondering how viable it is to launch a niche, paid tool for Linux. I found that this is a very rare model, most tools are either just free, supported by sponsorship, supported by some paid cloud-based service that accompanies the tool, use an open-core model with paid add-ons. I wonder if the decision of Little Snitch to make the Linux version free forever was also informed by this "no way to make mone…

Many from linux crowd are slightly paranoid and ideological.

I'm as a linux user very reluctant to install anything proprietary that has such sensitive info as my network traffic and would rather use opensnitch or any other foss fork.

The same time I don't mind to pay for open-source, I donate several thousands USD per year to FOSS projects. But I guess I'm in a minority here and if you make the whole stack open-source you're not going to make many sells really.

Re: LittleSnitch for Linux

#250

Post by [deleted] »

scheme271 wrote: post #98
lapcat wrote: post #90

Earlier quoted context omitted.

> I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too. No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.

Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M.

[deleted]
Post reply on HN