Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

271–280 of 489 posts

Re: LittleSnitch for Linux

#271

Post by littlesnitch »

0xbadcafebee wrote: post #108

> Compatible with Linux kernel 6.12 or higher I know everyone today is used to upgrading every 5 seconds, but some of us are stuck on old software. For example, my Linux machine keeps rebooting and sucks up power in suspend mode because of buggy drivers in 6.12+, so I'm stuck on 6.8. (which is extra annoying because I bought this laptop for its Linux hardware support...)

In theory, it could be possible to get the requirement down to 5.17, but I don't get around the verifier constraints on pre 6.12 kernels. Maybe somebody who is more experienced with eBPF and the verifier can help. This part is Open Source and you can replace it.

Re: LittleSnitch for Linux

#272

Post by littlesnitch »

badc0ffee wrote: post #79

Does anyone know how the blocking functionality works? I worked on some eBPF code a few years ago (when BTF/CO-RE was new), and while it was powerful, you couldn't just write to memory, or make function calls in the kernel. Is there a userland component that's using something like iptables? (Can iptables block traffic originating from/destined to a specific process nowadays?)

eBPF is extended in every kernel version. There is a layer where you get network packets and return a verdict. Little Snitch uses this type of eBPF function. You can look at the sources on Github.

Re: LittleSnitch for Linux

#273

Post by lapcat »

chabreck wrote: post #106
lapcat wrote: post #85

Earlier quoted context omitted.

> Said motivation could be a nation state handing them $XXX million dollars You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.

its been known for some time that little snitch and other personal firewalls are established targets of three-letter agencies https://news.ycombinator.com/item?id=13813160

That comment is a screenshot presented with no context, listing a bunch of rather mundane stuff.

"This is clownish" https://news.ycombinator.com/item?id=13813828

Re: LittleSnitch for Linux

#274

Post by tosti »

alhazrod wrote: post #6

I remember before Little Snitch there was ZoneAlarm for Windows[0] (here is a good screenshot[1]). No clue if the current version of ZoneAlarm does anything like that (have not used it in 2 decades). I always found it weird that Linux never really had anything like it. [0]: https://en.wikipedia.org/wiki/ZoneAlarm [1]: https://d2nwkt1g6n1fev.cloudfront.net/helpmax/wp-content/upl...

I ran ntop on a router in 2001. It had a highly insightful overview of traffic with nice looking diagrams and everything. There hasn't been anything like that since as far as I'm aware.

ZoneAlarm otoh, was snakeoil. Programs that ran at the same privilege level (typically everything) could bypass it in various ways.

Re: LittleSnitch for Linux

#275

Post by littlesnitch »

Tepix wrote: post #163

> One thing to be aware of: the .lsrules format from Little Snitch on macOS is not compatible with the Linux version. Why?

Just because I did not port the parser for it to Rust. And I thought that the lsrules format is rare for blocklists. If there is popular demand, we can add it.

Re: LittleSnitch for Linux

#276

Post by littlesnitch »

smashah wrote: post #219

Is there a way to kill little snitch completely without screwing up my DNS/other things?

Which one? Mac or Linux? For the Linux Snitch, just stop the service. For the macOS Snitch, you need to move the app to the trash via Finder. Only Apple can remove the network extension and they do this only when deleted via Finder.

Re: LittleSnitch for Linux

#277

Post by littlesnitch »

akimbostrawman wrote: post #180

i will never understand why people will flock to this but opensnitch which is just better, fully open and has existed for longer (on linux) gets ignored.

Little Snitch is not there to replace OpenSnitch. It's just an additional option you can choose from. Some people might prefer it, others not.

Re: LittleSnitch for Linux

#278

Post by hsbauauvhabzb »

lapcat wrote: post #256
emmelaich wrote: post #110

Earlier quoted context omitted.

Just saying developers have been hacked. Underrated existence proof.

> Just saying developers have been hacked. So are you going to have this same discussion in every HN submission that mentions any piece of software?

What software do you actually develop? You clearly don’t give a shit about your users and I want to make sure I’m not using your software .

Re: LittleSnitch for Linux

#279

Post by veber-alex »

npodbielski wrote: post #199
Doxin wrote: post #187

Earlier quoted context omitted.

5% on the steam survey though. The jump isn't quite as big from previous years as it seems as they did some corrections to the statistics this year, but 5% is nothing to sneeze at.

Exactly! Me personally in 2010 would never though about the time when one on every 20 gamers will be Linux user. That is huge IMHO.

I wouldn't be too exited. Statistics like this are very problematic.

For example, I have Steam installed on my Macbook pro and I occasionally play a single very simple game there. Does that make me a macOS gamer? of course not. The vast majority of games I want to play don't work on macOS.

I suspect that most of those 5% are just Linux users who have steam installed and play a small amount of games. Some probably just installed it to check what's available and don't play anything.

Everyone I know who is a "serious" gamer, as in exited about upcoming releases of AAA games is using Windows.

Re: LittleSnitch for Linux

#280

Post by Jakson_Tate »

cool to see eBPF used for a desktop firewall instead of just ddos packet dropping. the note about bpf map overflows is super relatable, dealing with that on bare-metal is a pain.

my question is... if the tracking maps fill up completely, does the daemon fail-open or fail-closed?

Post reply on HN