Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

471–480 of 489 posts

Re: LittleSnitch for Linux

#471

Post by cxr »

littlesnitch wrote: post #455
cxr wrote: post #436

Earlier quoted context omitted.

Intentionally not edited to add: Why are you using minified dependencies (like uPlot.iife.min.js[1] and uPlot.min.css[2]) for a desktop application? uPlot is also open source (released by Sorokin under MIT), but why aren't you following the terms of its license[3]? 1. https://github.com/obdev/littlesnitch-linux/blob/main/webroo... > 2. https://github.com/obdev/littlesnitch-linux/blob/main/webroo... > 3. https://githu…

Sorry, I overlooked that. I actually checked the license only to the point whether we can include it without other obligations and then downloaded what was offered as a download on either the web site or github, can't remember. I decided for the minified version because it's smaller. That's the purpose of minification, after all. It's somewhat strange that they require the license to be reproduced in every copy, but…

> I decided for the minified version because it's smaller. That's the purpose of minification, after all.

Mm... the purpose of minification, when it's not (also) being used for obfuscation purposes, is tied directly to the execution model of Web apps—constraints that don't apply for desktop applications (even if they are implemented in e.g. the same programming language or using the same or a similar runtime).

App makers and browser extension developers who shoehorn all of the (frankly already very bad or at least questionable) "best practices" associated with the tooling that was created to deal with creating/maintaining/delivering SPAs and other browser-based products into applications loaded from disk are just fundamentally not thinking things through.

For a security-sensitive application like this one, where a show of nothing-up-the-sleeve is only a benefit, one should expect there to be _no_ minified blobs in use.

Re: LittleSnitch for Linux

#472

Post by efreak »

WhyNotHugo wrote: post #413
alhazrod wrote: post #6

I remember before Little Snitch there was ZoneAlarm for Windows[0] (here is a good screenshot[1]). No clue if the current version of ZoneAlarm does anything like that (have not used it in 2 decades). I always found it weird that Linux never really had anything like it. [0]: https://en.wikipedia.org/wiki/ZoneAlarm [1]: https://d2nwkt1g6n1fev.cloudfront.net/helpmax/wp-content/upl...

> I always found it weird that Linux never really had anything like it. OpenSnitch must be like ten years old by now. I think also portmaster is somewhat similar too.

I tried out portmaster recently. Coming from rethinkdns on Android, I was far from impressed; it looks featured, but it's much harder to use. Opensnitch looks better but doesn't have the nice features to drill down connections (get from app requesting a domain being resolved to an IP and connecting on a port, and filter this at any level including globally; if the request was already filtered, you can see why and get to that filter to either remove it or add an exception)

Re: LittleSnitch for Linux

#473

Post by efreak »

m132 wrote: post #217
fsflover wrote: post #176

Earlier quoted context omitted.

What else is this about? Debian repositories still contain no malware and if you install software exclusively from them, you'll be safe.

Run OpenSnitch for a while and you'll quickly realize how much of your system does phone home. Off the top of my head: - GNOME Shell (extension updates without a way to disable this, weather), - GNOME Calculator (currency exchange rates), - NetworkManager (periodic hotspot portal checks in most configurations), - GDB (debuginfod enabled by default), - Firefox (extension updates, push notifications, feature flags, tel…

Approximately 10-15 years ago I used an early Android app that synced contacts across multiple (local) accounts and deduplicated and merged them. It had Internet permission for some reason; on asking the developer why a dedicated contact management app would need to go online (in a time where I was using XPrivacy to prevent other apps from seeing my contacts), they said there was no real reason for it, and it was removed in an update two days later. This is the only time I've ever seen an app remove the ability to access the internet, and I really wish it was more common.

Of course, about 5-6(?) years ago Google removed it from both the play store and my devices (I allowed it because silly me assumed I could still get it again) because it requested a sensitive permission and didn't support runtime permissions.

Re: LittleSnitch for Linux

#474

Post by nikisweeting »

My friend is building something similar to Little Snitch but specialized for sandboxing agents / monitoring their traffic / building rulesets to restrict traffic by "learning" from good runs. https://greywall.io/

Curious who else is working on stuff like this / what other solutions exist that are like "Little Snitch" for agent network + filesystem calls.

Re: LittleSnitch for Linux

#475

Post by efreak »

m132 wrote: post #237
fsflover wrote: post #193

Earlier quoted context omitted.

It contains Firefox and Chromium. You are right that they may call home, but at least it's very limited and easily configurable. Could be too much for you but fine with me. Also Debian does change their config by default to minimize privacy issues: https://news.ycombinator.com/item?id=32582260

It's far from easy in the case of Firefox [0], and the last time I tried, some .mozilla.com domains would still get pinged. Chromium doesn't even have an official guide. The only options I found to be reliable are source-level patches, i.e. ungoogled-chromium and LibreWolf. Note that LibreWolf still leaves some of the stuff on for you to manually disable (dom.push.connection.enabled, extension updates). [0] https://s…

I agree that push connections should be disabled. Maybe it can prompt you the first time you try to subscribe to one as to whether you're like to turn them on; this would annoy me personally, but also not break features by default. The annoyance hardly matters as websites already put an in-page prompt up before using the API, iirc because of Apple restrictions.

Enabling extension updates by default seems like a smart thing, though, as long as you can turn them off easily (there should really be a setting for this), and possibly a 6-month reminder to update them (similar to the refresh your profile reminder when you haven't used the browser in for a while). Extension updates happen, and many of the most widely used extensions (eg. ublock origin) really should be updated every time it's available. Better that than having the extensions go online to fetch and run arbitrary payloads because you know they will if disabling updates gets popular enough.

Re: LittleSnitch for Linux

#477

Post by aucisson_masque »

riddley wrote: post #470
aucisson_masque wrote: post #210

Earlier quoted context omitted.

[flagged]

Why are you in a thread about Linux software if you hate it so much? Just felt like spreading some negativity?

I find it interesting. Linux is very interesting and yes I think it’s fine to say that Linux has many shortcomings and can be extremely buggy.

Do you have to be 100% positive about everything you like ?

Re: LittleSnitch for Linux

#480

Post by alsetmusic »

ProllyInfamous wrote: post #468
alsetmusic wrote: post #462

Earlier quoted context omitted.

Are you blaming me for promoting software that I didn't write?

No, I'm pointing out (against your initial claim) that OD's attention to detail might be lacking, here... at least they ought'a disclose the described/known vulnerability . Instead, /u/LittleSnitch just commented elsewhere "Little Snitch is not a security tool" — interpret accordingly.

Ok, so what was this?

> Did the "attention to detail" phrase come from devs or you?

It sure sounds like you're accusing me of something like being a schill.

Post reply on HN