Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

261–270 of 489 posts

Re: LittleSnitch for Linux

#261

Post by littlesnitch »

jshier wrote: post #43
p-e-w wrote: post #19

Earlier quoted context omitted.

Is that true? If so, that’s not a good sign. I remember how impressed I was by ZoneAlarm in the early 2000s asking permission for itself to connect to the Internet, using the exact same dialogue it presented for any other program, with no dark patterns suggesting that the user should give preferential treatment to it.

Doesn't seem to be, I can see LittleSnitch itself connecting to yoyo.org and obdev.at. GP may be referencing a past bug, either in LittleSnitch or macOS.

If it connects to yoyo.org, you have subscribed to Peter Lowe's blocklist and Little Snitch is trying to update the list from there.

Re: LittleSnitch for Linux

#262

Post by lapcat »

dmantis wrote: post #249
mixedbit wrote: post #230

Recently I was wondering how viable it is to launch a niche, paid tool for Linux. I found that this is a very rare model, most tools are either just free, supported by sponsorship, supported by some paid cloud-based service that accompanies the tool, use an open-core model with paid add-ons. I wonder if the decision of Little Snitch to make the Linux version free forever was also informed by this "no way to make mone…

Many from linux crowd are slightly paranoid and ideological. I'm as a linux user very reluctant to install anything proprietary that has such sensitive info as my network traffic and would rather use opensnitch or any other foss fork. The same time I don't mind to pay for open-source, I donate several thousands USD per year to FOSS projects. But I guess I'm in a minority here and if you make the whole stack open-sour…

> Many from linux crowd are slightly paranoid

Slightly? There are quite a few tin foil hat comments on this submission.

Re: LittleSnitch for Linux

#263

Post by latexr »

lapcat wrote: post #247
latexr wrote: post #232

Earlier quoted context omitted.

Depends on the target and what you can get. Think about Bartender, an app requiring an insanely high level of trust and permissions, which was quietly sold. If you know of someone specific you want to target who uses it, the investment could pay off. For example, we know from your blog posts that you use LittleSnitch. Someone who wanted to target you might do a lot to spy on you by buying LittleSnitch, probably. Thin…

> Depends on the target and what you can get. Think about Bartender, As I said in another comment, Bartender had no target! It was not an attack. An app was sold by one developer to another developer. End of story. > If you know of someone specific you want to target who uses it But you don't. And you don't in the case of Little Snitch either. You can dream up a bunch of absurd hypothetical scenarios, but they are no…

> Bartender had no target! It was not an attack.

The point is that it shows it can happen. You’re a browser extension developer, surely you know how often it happens that developers of popular extensions are approached by shady businesses and sometimes do even sell.

> You can dream up a bunch of absurd hypothetical scenarios, but they are not the reality.

As someone else has pointed out to you, not hypothetical.

https://news.ycombinator.com/item?id=47699068

> Nobody wants to target me. Nobody cares about me. I am insignificant.

You give yourself too little credit. I know of several developers and other people with influence who use your extensions with complete trust. Compromising you means compromising them, which means compromising even more people. Jia Tan has aptly demonstrated you don’t need to directly attack your final target, only a link in the chain, even if it looks insignificant.

Re: LittleSnitch for Linux

#264

Post by supernes »

littlesnitch wrote: post #239
supernes wrote: post #165

Tried it on Fedora 43 (6.19.11 x86_64) and it loaded all CPU cores, dumped 50K lines in the journal and failed to start. > Error: the BPF_PROG_LOAD syscall returned Argument list too long (os error 7). > littlesnitch.service: Consumed 3min 38.832s CPU time, 13.7G memory peak.

Sorry, we have not tested on Fedora before release. Did not expect so much interest in the first hours after release... I have now installed Fedora in a VM (ARM64 architecture, though) and it does load, but cannot identify processes. I'm investigating this now. The other issue seems to be with eBPF compatibility. That's a moving target and I'll investigate next. But resources are limited, I'll need some time to dig i…

There's some good feedback in the GitHub issue on the subject, seems to happen on slightly newer versions of the kernel than the one you've tested on and affects other distros like Arch as well. I'll keep an eye on the discussion and test again once updates are ready.

Re: LittleSnitch for Linux

#265

Post by littlesnitch »

txrx0000 wrote: post #63

As articulated in the author's own blog post: https://obdev.at/blog/little-snitch-for-linux/ The core issue is simple and uncomfortable: through automatic updates, a vendor can run any code, with any privileges, on your machine, at any time. ----- If the author is serious about this, then they should make their own program completely open source, and make builds bit-for-bit reproducible. For all I know, the proprieta…

This is correct, of course. But I currently can't make the entire project Open Source. My other option would be to keep it completely private (wrote it mostly for myself in the first place).

I think it's still better to make it public and only partially Open Source so that some people can benefit from it. If you don't trust us, that's completely reasonable, just don't install it.

Re: LittleSnitch for Linux

#266

Post by dmantis »

lapcat wrote: post #262
dmantis wrote: post #249

Earlier quoted context omitted.

Many from linux crowd are slightly paranoid and ideological. I'm as a linux user very reluctant to install anything proprietary that has such sensitive info as my network traffic and would rather use opensnitch or any other foss fork. The same time I don't mind to pay for open-source, I donate several thousands USD per year to FOSS projects. But I guess I'm in a minority here and if you make the whole stack open-sour…

> Many from linux crowd are slightly paranoid Slightly? There are quite a few tin foil hat comments on this submission.

Well, it's all relative and depends on perception.

I tried to briefly explain a typical i-own-my-computer mindset regarding the linux monetization question from the parent comment.

I can pay for cool stuff I can trust, but the "I can trust" part is very tricky.

Re: LittleSnitch for Linux

#267

Post by littlesnitch »

ProllyInfamous wrote: post #78
alsetmusic wrote: post #74

Congrats to Linux users on getting a great tool from a quality development shop. Objective Development is one of our (Mac users) exemplars for attention to detail and fit & finish. Congrats to Objective Development for expanding their well-loved tool to a new platform. You guys rock.

>attention to detail Why does LittleSnitch (Mac) pre-resolve IP addresses, before user presses Accept/Deny? IMHO DNS queries shouldn't initiate without user input.

Little Snitch is bound to the API provided by Apple. The NEFilterDataProvider API calls `handleNewFlow()` only after sending out the first IP packet.

Version 6 added DNS encryption and in principle we could filter lookups (similar to PiHole) at this level. That brings other issues, though: This filter is system-wide, so process-specific rules (and overrides) would not work. And results can be cached by mDNSResponder. So when a blocklist causes an issue, you may not be able to fix it by simply disabling the blocklist. But it's still something we consider.

Re: LittleSnitch for Linux

#268

Post by lapcat »

latexr wrote: post #258
lapcat wrote: post #240

Earlier quoted context omitted.

Bartender was not a supply chain attack! The app was sold for monetary reasons to another developer for monetary reasons. There were no targets involved. There were no nation-states involved. There were no attacks involved. You might not like the new developer, but this whole discussion of a nation-state and 9 figure payoff is totally ridiculous.

> You might not like the new developer What I didn’t like was the secrecy, that was a breach of user trust. Why wasn’t it announced is the problem.

That's a legitimate criticism. Nonetheless, this subthread started with a comment about supply chain attacks and nation states, which is ridiculous.

Re: LittleSnitch for Linux

#269

Post by littlesnitch »

xrio wrote: post #170

Back when I was still using macOS I loved Little Snitch and was a paying customer. And I agree nothing on Linux comes close. Would it be technically feasible to also provide this as a Flatpak to support immutable distros like Bazzite?

As far as I can tell, Flatpak does not allow a daemon running as root early during system boot.

Re: LittleSnitch for Linux

#270

Post by littlesnitch »

xn--yt9h wrote: post #150

Giving it a shot right now. Very easy setup, intuitive UI, but a lot of requests' processes are not identified (while they could easily be identified, as they belong to the browser that has some, but less, identified calls)

Little Snitch must be running when the process starts in order to identify it correctly. You get less "Not Identified" if you run it for a while, or you should get none if you reboot and Little Snitch can start before everything else.

I would love to fix this requirement, but have not found a way yet.

Post reply on HN