For comparison a single use case, what are the top linux tools used today to quickly list/watch which program/process made outbound to where?
LittleSnitch for Linux
441–450 of 489 posts
Re: LittleSnitch for Linux
#442I'm not a Little Snitch or Open Snitch user, I wonder if these firewalls are able to block requests done with the use of some other, allow-listed program. Say I run a script `suspicious.py' and I deny this script from making any network requests. I also have firefox which is allowed to make any HTTPS requests. If suspicious.py does something like: key = (Path.home() / '.ssh' / 'id_rsa').read_text() subprocess.Popen([…
If the IP address of evil.com is not in the DNS data available to firefox, then it does not matter
Maybe an application firewall is useful if one wants firefox but not suspicious.py to be able to upload to evil.com
But IMHO the criteria chosen by the user to decide access and then configure the firewall accordingly, is evil.com not the name of the application
That's why the example in this comment uses the name "evil"
Otherwise, the application name "suspicious" would be enough
Re: LittleSnitch for Linux
#443cool to see eBPF used for a desktop firewall instead of just ddos packet dropping. the note about bpf map overflows is super relatable, dealing with that on bare-metal is a pain. my question is... if the tracking maps fill up completely, does the daemon fail-open or fail-closed?
There is currently no treatment of errors because I would not know how to handle them anyway. There are two tables which can overflow affecting the filter: the table of open flows and the table of recent DNS lookups. The table of flows just fills up, meaning that we cannot store state about new flows. Without state, we can't attribute a process to them and end up evaluating rules on each packet. I guess that blocklis…
gotcha... makes total sense. LRU for the DNS map is definitely the right call for a desktop setup. and falling back to the user's default policy is smart so you don't randomly brick their internet if an app goes crazy.
really appreciate the honest answer, man. awesome work on this...!
Re: LittleSnitch for Linux
#444Tried it on Fedora 43 (6.19.11 x86_64) and it loaded all CPU cores, dumped 50K lines in the journal and failed to start. > Error: the BPF_PROG_LOAD syscall returned Argument list too long (os error 7). > littlesnitch.service: Consumed 3min 38.832s CPU time, 13.7G memory peak.
Had the same issue on arch, though survived it OK (6.19.11-zen1-1-zen). Maybe it's a zen kernel thing, it only pegged 2-3 cores and the others were OK so could jump in and kill it.
Re: LittleSnitch for Linux
#445Earlier quoted context omitted.
[flagged]
The take on flatpaks is such an uninformed one. DMGs on MacOS come with all the dependencies bundled in, which make them essentially just as big as the comparable flatpak (minus the shared runtime that gets installed once)
I know the theory but it doesn’t work that way in real life. Files that are 20mb on macOS are GB on flatpaks.
Flatpak is eating storage and bandwidth which are both issue for many users.
Re: LittleSnitch for Linux
#446Earlier quoted context omitted.
Wifi and Bluetooth are pretty decent now. As far as I can tell the biggest blockers are: * Laptop battery life. Still in the "it's fine; I get 5 hours!" stage. * Wayland & graphics. It's still a mess. Getting there though. Probably will be ok in about 5 years I'd guess. * RAM management. I don't know why nobody cares about this but when Mac or Windows run low of RAM I don't even notice. With Linux it either hard free…
> * Laptop battery life. Still in the "it's fine; I get 5 hours!" stage. Not on ARM, though! Getting 8-10h here easily. > * RAM management Agreed, since I switched to Linux, I am getting regular OOM on my 16GB laptop.
> Agreed, since I switched to Linux, I am getting regular OOM on my 16GB laptop.
Fwiw, when I had a 16GB Linux laptop I upgraded it to 32GB, enabled zram and a ton of swap. That improved things a bit (but didn't completely solve the issue).
Re: LittleSnitch for Linux
#447I used Little Snitch on Mac a few years ago and liked it, though I wasn't a fan of how (necessarily) deep it had to be in the OS to work. It felt like one of those things where, the moment you have any kind of network connectivity issue, it's the first thing you need to disable to troubleshoot because it's the weirdest thing you're doing. I guess what I'd really like is a middleware box or something that I could put…
An external appliance does not have access to your process table, so it can't tell you which process originated the request. Only which device.
Re: LittleSnitch for Linux
#448How does it compare to Portmaster? https://news.ycombinator.com/item?id=29761978 Portmaster – Open-source network monitor and firewall [315 points | 113 comments] https://news.ycombinator.com/item?id=23539687 Show HN: Block trackers system-wide on Linux/Windows, a Pi-hole “to go” alt [6 points by davegson on June 16, 2020 | 2 comments] https://news.ycombinator.com/submitted?id=davegson
As far as I can tell, they are very different in their goals. Portmaster is targeted at security and business customers, it's surprisingly powerful for an open source project. The interception mechanism seems to be based on iptables, but I skimmed over the source code only quickly.
Little Snitch for Linux, on the other hand, is much less complex and tries to analyze and filter based on DNS names, not IP addresses where possible. It is not made for security, but rather to provide insight for the curious what's going on. It hooks into the kernel via eBPF, not iptables.
Re: LittleSnitch for Linux
#449LittleSnitch for Mac is a good looking app. I always thought that ugly UIs on Linux are because of good designers do not intersect well with programming enthusiasts. But looking how ugly same app looks on Linux, I’m starting to think it could be a technical limitation. Can someone elaborate?
It depends on several factors. One factor here was the decision to make it web based. The other is that this one is by me, and I'm not a UI designer or frontend developer. I usually work on network stack, model design and other low level stuff. Exactly the same as most Linux developers, so it's no surprise that the outcome is similar.
Re: LittleSnitch for Linux
#450Just tried it on my laptop. Unfortunately, my laptop got extremely hot about 10 seconds after installation. The resource monitor showed that it was eating up all of my laptop's CPU. I panically stopped the service and uninstalled it before I could even open the web UI. It was a really poor first impression.
We meanwhile found out that it does not pass the eBPF verifier on kernels above 6.19.0. When this happens, it's restarted over and over again, running the eBPF verifier in a loop on all available CPUs.
We are working on the issue.