Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

251–260 of 489 posts

Re: LittleSnitch for Linux

#251

Post by sgbeal »

Latty wrote: post #209
dainank wrote: post #175

Earlier quoted context omitted.

I think there is a lot of talk (and this is good), but very little action. Market share is still incredibly low for LNX. I believe only a small subset of people actually attempt the jump from WIN to LNX (since most just want to play their games and run their programs without hassle) and then quickly realize that its tougher than they anticipated and swiftly return to WIN.

This is true, but also the original comment still stands: Linux desktop usage outside developers was so low that it was barely worth mentioning before, so even a small uptick like this is a serious change, and it's how bigger changes start. I definitely don't think it's even the likely outcome, but for Linux to get serious traction this is how it has to start: power users but not the traditional developer crowd start…

> Microsoft are certainly doing their best to push people away right now

According to a speculative blog post by Eric S. Raymond in September 2020, Microsoft is literally moving towards replacing Windows' internals with Linux. Unfortunately, that post is now unreachable, but searching for "eric raymond article about windows being replaced with a linux kernel" finds many third-party references to it and summaries of it.

Re: LittleSnitch for Linux

#252

Post by littlesnitch »

parhamn wrote: post #64

Okay hear me out, I use little snitch for a while. Great product. Love finding out what phones where. I make every single request (except my browser, because I'm fine with their sandbox) block until I approve. Recently I was wondering how you really have to trust something like little snitch given its a full kernel extension effectively able to MITM your whole network stack. So I went digging (and asked some agents t…

Disclaimer: I'm the developer of Little Snitch for Linux. Regarding MITM concerns: The eBPF component, which actually sees all the traffic, is Open Source (GPLv2). You can review it on Github and verify whether it sends any data to user space: https://github.com/obdev/littlesnitch-linux

But the trust issue is still real, the daemon has to run as root because it needs to watch for new mounts and keep a table of file system roots up-to-date, even after loading all the eBPF programs. As a root process, it can technically do whatever it wants. Unless you limit it with a kind of mandatory access control (SELinux or similar).

This is the very first release and we will probably come up with a more restricted permission requirement in the future. For the moment, I try to catch up with bug reports. There seems to be more diversity in the Linux landscape than I had expected.

Re: LittleSnitch for Linux

#253

Post by lapcat »

emmelaich wrote: post #109
lapcat wrote: post #62

Earlier quoted context omitted.

> They don't build their own machines or write their compilers or write their own crpyto code or ... so many other things. An attack on any of these things has nothing specifically to do with the developers of Little Snitch and would have vastly more widespread and important effects. Why would you even be talking about Little Snitch if a compiler were compromised?!? Your paranoia here is bizarrely narrow. Little Snit…

Their copy of the compiler. Just an example. ¯\_(ツ)_/¯

> Their copy of the compiler.

This doesn't even make sense. You have no examples.

Re: LittleSnitch for Linux

#254

Post by lapcat »

microtonal wrote: post #157
lapcat wrote: post #69

Earlier quoted context omitted.

> If I, the end user, am the target You're not a target, anonymous rando.

Many supply chain attacks aim to run malware on the end-users machine to harvest authentication tokens, etc. So pretty much everyone here who is a developer is the target.

> So pretty much everyone here who is a developer is the target.

Are you going to have this same discussion about every piece of software every mentioned on Hacker News? Why are we having it for Little Snitch specifically?

Re: LittleSnitch for Linux

#255

Post by lapcat »

emmelaich wrote: post #111
lapcat wrote: post #57

Earlier quoted context omitted.

> a five dollar wrench. I'm not even going to respond to this ridiculousness. I still don't know why anyone thinks that, among all developers in the world, a little indie Mac developer is getting targeted specifically.

Some targets are more valuable than others. A firewall product has obvious security value. The fact that it requires high privilege is another reason. I have the same thoughts about other Mac apps. e.g. iTerm2 - cause they "see" so much sensitive data.

[flagged]

Re: LittleSnitch for Linux

#256

Post by lapcat »

emmelaich wrote: post #110
lapcat wrote: post #56

Earlier quoted context omitted.

> The same way every other developer that has been hacked. There's not one single way, so, no, you're just hand-waving here.

Just saying developers have been hacked. Underrated existence proof.

> Just saying developers have been hacked.

So are you going to have this same discussion in every HN submission that mentions any piece of software?

Re: LittleSnitch for Linux

#257

Post by littlesnitch »

eviks wrote: post #126

Does it leak your IP like the Mac version? https://news.ycombinator.com/item?id=35363343 > Little Snitch for Linux is not a security tool. Maybe not? > Its focus is privacy: Or maybe yes?

You are referring to the TCP three way handshake problem here. The macOS version is bound by the API provided by Apple: We get the API call for filtering only after the three way handshake has started.

The Linux version is limited in complexity. It has to decide immediately. This has the consequence that no packet leaves the machine if the connection is denied, but on the other hand it means that it's easier to trick. The macOS version can inspect the first packet sent (deep packet inspection) to find the remote host name in TLS headers. The Linux version relies on heuristics: The most recent lookup seen which returned the IP address determines the name. This part is Open Source and you can inspect the algorithm.

Re: LittleSnitch for Linux

#258

Post by latexr »

lapcat wrote: post #240
latexr wrote: post #227

Earlier quoted context omitted.

Like how it happened for Bartender, another macOS app which required a lot of permissions. It was sold to a company and they told no one, until a user noticed via the now defunct MacUpdater that the app signature changed. Ben Surtees (Bartender’s original developer) burned all the good will accumulated over years in one moment. Never again can anyone trust software under that name.

Bartender was not a supply chain attack! The app was sold for monetary reasons to another developer for monetary reasons. There were no targets involved. There were no nation-states involved. There were no attacks involved. You might not like the new developer, but this whole discussion of a nation-state and 9 figure payoff is totally ridiculous.

> You might not like the new developer

What I didn’t like was the secrecy, that was a breach of user trust. Why wasn’t it announced is the problem.

Re: LittleSnitch for Linux

#259

Post by lapcat »

selcuka wrote: post #154
wafflemaker wrote: post #100

Earlier quoted context omitted.

>why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? Per user hacked, it can be very cheap ¹ compared to bribing anyone. And give data/access that SO can't get. State is not interested in you until it does. Being Jewish, Polish, Gypsy, Gay. Or just WrongThinking. Or maybe it becomes super cheap and easy to process all information? 1: it can even be fr…

> it can even be free. You either give us backdoor to all your users or you rot in jail. It is already a thing, at least in UK and AU [1]: > Both countries now claim the right to secretly compel tech companies and individual technologists, including network administrators, sysadmins, and open source developers – to re-engineer software and hardware under their control, so that it can be used to spy on their users. En…

1) Little Snitch is not based in the UK or Australia.

2) They are interested in software will billions of users. They are not interested in software with thousands of users.

Post reply on HN