Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Little Snitch 6.0 Released

obdev.at

Post reply on HN
Print view View original

11–19 of 19 posts

Re: Little Snitch 6.0 Released

#11

Post by andresen »

I seem to recall the past paid upgrades being timed to release with new macOS versions, but this one comes out ahead of WWDC in June, where presumably a new version will be unveiled. Is this related to the network filter extensions, so there's no longer the same risk of OS version incompatibilities?

An issue that's not unique to this developer, is that I'm having trouble determining what their update policy will be regarding the now previous version. Based on their past procedure, I'm not expecting it'll work with the next major macOS version, but it would be wonderful with clearer expectations on what types of bugs or security issues (if any) they commit themselves to fixing after the new version is out.

Re: Little Snitch 6.0 Released

#12

Post by bunnyfoofoo »

I love the inclusion of DNS here, as that was a major pain point on version 5. Currently on MacOS you can only use a single network filter, which Little Snitch is, so you couldn't use an encrypted DNS service easily in addition to Little Snitch. This made it an instant purchase for me (and it works).

Re: Little Snitch 6.0 Released

#13

Post by unifer1 »

frankjr wrote: post #5

Beware that Little Snitch and other similar network filter extensions leak your IP address to the remote server even if there's an explicit block for that server. https://lapcatsoftware.com/articles/2023/6/3.html

I emailed the dev and they responded by pointing me to this post and explaining that this was because of a design decision by Apple and not something they are able to fix. https://www.obdev.at/blog/three-way-handshake-bypassing-litt...

Perhaps just VPN + little snitch is your best bet if you're still worried

Re: Little Snitch 6.0 Released

#14

Post by frankjr »

unifer1 wrote: post #13
frankjr wrote: post #5

Beware that Little Snitch and other similar network filter extensions leak your IP address to the remote server even if there's an explicit block for that server. https://lapcatsoftware.com/articles/2023/6/3.html

I emailed the dev and they responded by pointing me to this post and explaining that this was because of a design decision by Apple and not something they are able to fix. https://www.obdev.at/blog/three-way-handshake-bypassing-litt... Perhaps just VPN + little snitch is your best bet if you're still worried

The blog post is mentioned in the first linked article. Needless to say I fundamentally disagree with Apple's decision* - If I explicitly install a firewall, I want it to actually function like a firewall and not let some packets through. The overhead explanation seems a bit like a stretch.

* It's actually not clear whether this is a feature or a bug. Apple never responded to the bug report (FB12088655).

Re: Little Snitch 6.0 Released

#15

Post by hi-v-rocknroll »

frankjr wrote: post #5

Beware that Little Snitch and other similar network filter extensions leak your IP address to the remote server even if there's an explicit block for that server. https://lapcatsoftware.com/articles/2023/6/3.html

Yep. It's not/wasn't a VPN or DNS proxy but more of an host-side application firewall specifically to control apps' use of outbound connections. If you need pristine infosec, then you need something else and probably public WiFi too.

I used to use LuLu and Little Snitch but LuLu nondeterministically dropped packets and connections causing ssh to drop and navigation problems in the browser, so I had to remove LuLu.

Re: Little Snitch 6.0 Released

#16

Post by hi-v-rocknroll »

bunnyfoofoo wrote: post #12

I love the inclusion of DNS here, as that was a major pain point on version 5. Currently on MacOS you can only use a single network filter, which Little Snitch is, so you couldn't use an encrypted DNS service easily in addition to Little Snitch. This made it an instant purchase for me (and it works).

When on public networks, I use dnscrypt-proxy with a captive-portal compatible workaround.

When at home, I point the router to DoT non-logging servers and clients use the router for all domain resolution.

Re: Little Snitch 6.0 Released

#17

Post by MindfulMonk »

frankjr wrote: post #14
unifer1 wrote: post #13

Earlier quoted context omitted.

I emailed the dev and they responded by pointing me to this post and explaining that this was because of a design decision by Apple and not something they are able to fix. https://www.obdev.at/blog/three-way-handshake-bypassing-litt... Perhaps just VPN + little snitch is your best bet if you're still worried

The blog post is mentioned in the first linked article. Needless to say I fundamentally disagree with Apple's decision* - If I explicitly install a firewall, I want it to actually function like a firewall and not let some packets through. The overhead explanation seems a bit like a stretch. * It's actually not clear whether this is a feature or a bug. Apple never responded to the bug report (FB12088655).

Yeah it seems going to https://feedbackassistant.apple.com/feedback/12088655 the report doesn't even exist anymore.

Would be good to get an official answer from Apple if this is won't fix or coming as a fix in a future release.

Re: Little Snitch 6.0 Released

#18

Post by lapcat »

MindfulMonk wrote: post #17
frankjr wrote: post #14

Earlier quoted context omitted.

The blog post is mentioned in the first linked article. Needless to say I fundamentally disagree with Apple's decision* - If I explicitly install a firewall, I want it to actually function like a firewall and not let some packets through. The overhead explanation seems a bit like a stretch. * It's actually not clear whether this is a feature or a bug. Apple never responded to the bug report (FB12088655).

Yeah it seems going to https://feedbackassistant.apple.com/feedback/12088655 the report doesn't even exist anymore. Would be good to get an official answer from Apple if this is won't fix or coming as a fix in a future release.

> Yeah it seems going to https://feedbackassistant.apple.com/feedback/12088655 the report doesn't even exist anymore.

That link is for Apple engineers. Feedback reports are not public. They're only accessible by the reporter and Apple.

Post reply on HN