Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

281–290 of 489 posts

Re: LittleSnitch for Linux

#281

Post by lapcat »

latexr wrote: post #263
lapcat wrote: post #247

Earlier quoted context omitted.

> Depends on the target and what you can get. Think about Bartender, As I said in another comment, Bartender had no target! It was not an attack. An app was sold by one developer to another developer. End of story. > If you know of someone specific you want to target who uses it But you don't. And you don't in the case of Little Snitch either. You can dream up a bunch of absurd hypothetical scenarios, but they are no…

> Bartender had no target! It was not an attack. The point is that it shows it can happen. You’re a browser extension developer, surely you know how often it happens that developers of popular extensions are approached by shady businesses and sometimes do even sell. > You can dream up a bunch of absurd hypothetical scenarios, but they are not the reality. As someone else has pointed out to you, not hypothetical. http…

> surely you know how often it happens that developers of popular extensions are approached by shady businesses and sometimes do even sell.

Yes, developers of free extensions who sell for a pittance.

I don't have a popular extension. My extension is relatively expensive and thus unpopular. I don't have enough users to be interesting to shady businesses. My extension is more valuable to me than to anyone else, because I, one person, can make a living from it.

> As someone else has pointed out to you, not hypothetical.

That link seems a bit silly. There's a screenshot with no explanatory context whatsoever. There's a list of items, many of which look quite mundane and uninteresting. Certainly it is not suggesting acquiring the company for millions of dollars. It sounds like someone—could even be an intern for all we know—is interested in attacking the app from the outside.

I agree with tptacek: "This is clownish" https://news.ycombinator.com/item?id=13813828

> You give yourself too little credit.

No, I give myself too much credit. ;-)

> I know of several developers and other people with influence who use your extensions with complete trust. Compromising you means compromising them, which means compromising even more people.

What is the value of compromising these people? Oh noes, the CIA can now write Daring Fireball articles!

> Jia Tan has aptly demonstrated you don’t need to directly attack your final target, only a link in the chain, even if it looks insignificant.

What chain? I have no third-party dependencies. If someone can compromise Apple's operating systems, then my software or Little Snitch is the least of our worries.

I do specifically and intentionally avoid using NPM, because of frequent compromises. Little Snitch is not even JavaScript, so no worries there.

Re: LittleSnitch for Linux

#282

Post by npodbielski »

veber-alex wrote: post #279
npodbielski wrote: post #199

Earlier quoted context omitted.

Exactly! Me personally in 2010 would never though about the time when one on every 20 gamers will be Linux user. That is huge IMHO.

I wouldn't be too exited. Statistics like this are very problematic. For example, I have Steam installed on my Macbook pro and I occasionally play a single very simple game there. Does that make me a macOS gamer? of course not. The vast majority of games I want to play don't work on macOS. I suspect that most of those 5% are just Linux users who have steam installed and play a small amount of games. Some probably jus…

That would mean that it still would be around 0,5%. If you want to split the hair probably 4,5% of this 5% is Steam Deck.

Re: LittleSnitch for Linux

#283

Post by littlesnitch »

emmelaich wrote: post #21
lapcat wrote: post #9

Earlier quoted context omitted.

> Do you still trust them not to do self-reporting or phoning home, even though it is $0 and closed source? If you trust Little Snitch on Mac, then yes. They've been in business for over 20 years. They're not going to blow their entire business and reputation for a few Linux users.

Yep, I trust the obdev.at / Snitch guys. I do wonder however, are they sufficiently careful about their processes and own machines to avoid a supply chain attack completely. They must be a target for the various hacking groups out there.

We have not detected a targeted attack yet. On the Mac side, we are safe: No dependencies on any third party libraries. Only Apple.

On the Linux side, there is no single big vendor such as Apple who provides all the necessary libraries. I have tried to choose reputable sources from crates.io only, but to be honest, I don't know a secure solution to the problem.

Re: LittleSnitch for Linux

#284

Post by veber-alex »

preisschild wrote: post #202
konart wrote: post #174

Earlier quoted context omitted.

So... what if the maker can't make it on donations only?

Then development will stop and users don't have the software anymore. If users consider this software important they should donate so they can keep using it.

How exactly is this different from payed software?

Re: LittleSnitch for Linux

#285

Post by hsbauauvhabzb »

lapcat wrote: post #57
heartbreak wrote: post #41

Earlier quoted context omitted.

Options range from carefully targeted phishing or social engineering attacks to poor opsec and a five dollar wrench.

> a five dollar wrench. I'm not even going to respond to this ridiculousness. I still don't know why anyone thinks that, among all developers in the world, a little indie Mac developer is getting targeted specifically.

The same people who targeted the open source uncommercial library axios *last week*?

Access to little snitch would be worth millions to the right party.

Re: LittleSnitch for Linux

#286

Post by littlesnitch »

chris_wot wrote: post #104

Can someone elaborate on the limitations bit? "Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible…

eBPF limits the size of the code, its complexity and how data can be stored. You cannot just implement any algorithm in eBPF for that reason.

That's not only a weakness, it's also a strength of eBPF. This way it can provide security and safety guarantees on the code loaded into the kernel.

Re: LittleSnitch for Linux

#287

Post by hsbauauvhabzb »

lapcat wrote: post #255
emmelaich wrote: post #111

Earlier quoted context omitted.

Some targets are more valuable than others. A firewall product has obvious security value. The fact that it requires high privilege is another reason. I have the same thoughts about other Mac apps. e.g. iTerm2 - cause they "see" so much sensitive data.

[flagged]

Yeah just yolo install whatever, it’s not like applications or libraries such as axios which have a decade of trusted history would all of a sudden become malicious and do nasty things to developer machines, just chill, everything’s fine.

Re: LittleSnitch for Linux

#288

Post by a022311 »

sgc wrote: post #84
Bromeo wrote: post #3

How does it compare to opensnitch? https://github.com/evilsocket/opensnitch

I just tried littlesnitch and it did not resolve very many ips to domains, which is pretty basic. It also failed to identify most processes, and they were grouped under "Not Identified". It appears these are known limitations of the Linux version [1]. So for that alone I need to stick with opensnitch. [1] "Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can…

I guess that makes sense, since it's pretty new. OpenSnitch is great software in terms of functionality but I find the UI lacking. If LittleSnitch can keep the same functionality, while improving the UI, I'm switching. My other current concern here is that the LittleSnitch UI is just a Webview and I think it would be much better if there was a native option (ideally GTK-based for me, but Qt would also be acceptable). Webviews are slow and full of bloat.

Re: LittleSnitch for Linux

#289

Post by littlesnitch »

serious_angel wrote: post #16

> The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible to reliably tie every network packet to a process or a DNS name. > And reconstructing which hostname was originally looked up for a gi…

eBPF programs are able to accuratly process network traffic in high performance, but the amount of CPU instructions you can use is limited. Otherwise it would not be high performance. This limits the complexity of in-kernel processing.

Re: LittleSnitch for Linux

#290

Post by Joel_Mckay »

mixedbit wrote: post #214

I'm not a Little Snitch or Open Snitch user, I wonder if these firewalls are able to block requests done with the use of some other, allow-listed program. Say I run a script `suspicious.py' and I deny this script from making any network requests. I also have firefox which is allowed to make any HTTPS requests. If suspicious.py does something like: key = (Path.home() / '.ssh' / 'id_rsa').read_text() subprocess.Popen([…

The SELinux MAC policy should restrict which files and ports each process may access. In general, most modern distro have this feature, but normal users do not go through the rules training and default enable flag setup. =3
Post reply on HN