Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LittleSnitch for Linux

obdev.at

Post reply on HN
Print view View original

481–489 of 489 posts

Re: LittleSnitch for Linux

#481

Post by ignoramous »

efreak wrote: post #472
WhyNotHugo wrote: post #413

Earlier quoted context omitted.

> I always found it weird that Linux never really had anything like it. OpenSnitch must be like ten years old by now. I think also portmaster is somewhat similar too.

I tried out portmaster recently. Coming from rethinkdns on Android, I was far from impressed; it looks featured, but it's much harder to use. Opensnitch looks better but doesn't have the nice features to drill down connections (get from app requesting a domain being resolved to an IP and connecting on a port, and filter this at any level including globally; if the request was already filtered, you can see why and get…

rethinkdns dev here

> I tried out portmaster recently. Coming from rethinkdns on Android, I was far from impressed; it looks featured, but it's much harder to use. Opensnitch looks better but doesn't have the nice features

If 'far from impressed ... much harder to use' is about Rethink DNS + Firewall... Over the years, we've got numerous complaints about the UI over emails and on GitHub Issues, so we're acutely aware of the fact. In our defense, we have had no help from a designer, and couldn't come up with a good UX even if our life depended on it. We'll keep trying though.

Re: LittleSnitch for Linux

#482

Post by emmelaich »

littlesnitch wrote: post #283
emmelaich wrote: post #21

Earlier quoted context omitted.

Yep, I trust the obdev.at / Snitch guys. I do wonder however, are they sufficiently careful about their processes and own machines to avoid a supply chain attack completely. They must be a target for the various hacking groups out there.

We have not detected a targeted attack yet. On the Mac side, we are safe: No dependencies on any third party libraries. Only Apple. On the Linux side, there is no single big vendor such as Apple who provides all the necessary libraries. I have tried to choose reputable sources from crates.io only, but to be honest, I don't know a secure solution to the problem.

Thanks very much for your reply.

Re: LittleSnitch for Linux

#483

Post by ProllyInfamous »

alsetmusic wrote: post #480
ProllyInfamous wrote: post #468

Earlier quoted context omitted.

No, I'm pointing out (against your initial claim) that OD's attention to detail might be lacking, here... at least they ought'a disclose the described/known vulnerability . Instead, /u/LittleSnitch just commented elsewhere "Little Snitch is not a security tool" — interpret accordingly.

Ok, so what was this? > Did the "attention to detail" phrase come from devs or you? It sure sounds like you're accusing me of something like being a schill.

Chill, dawg.

That comment wasn't mine.

Re: LittleSnitch for Linux

#484

Post by ckunte »

littlesnitch wrote: post #252
parhamn wrote: post #64

Okay hear me out, I use little snitch for a while. Great product. Love finding out what phones where. I make every single request (except my browser, because I'm fine with their sandbox) block until I approve. Recently I was wondering how you really have to trust something like little snitch given its a full kernel extension effectively able to MITM your whole network stack. So I went digging (and asked some agents t…

Disclaimer: I'm the developer of Little Snitch for Linux. Regarding MITM concerns: The eBPF component, which actually sees all the traffic, is Open Source (GPLv2). You can review it on Github and verify whether it sends any data to user space: https://github.com/obdev/littlesnitch-linux But the trust issue is still real, the daemon has to run as root because it needs to watch for new mounts and keep a table of file s…

Thank you for creating this. I tried running it on Raspberry Pi 5 (running debian trixie), but could not make it work. Does it require compiling in lieu of the .deb file you offer?

Re: LittleSnitch for Linux

#485

Post by hubabuba44 »

ckunte wrote: post #484
littlesnitch wrote: post #252

Earlier quoted context omitted.

Disclaimer: I'm the developer of Little Snitch for Linux. Regarding MITM concerns: The eBPF component, which actually sees all the traffic, is Open Source (GPLv2). You can review it on Github and verify whether it sends any data to user space: https://github.com/obdev/littlesnitch-linux But the trust issue is still real, the daemon has to run as root because it needs to watch for new mounts and keep a table of file s…

Thank you for creating this. I tried running it on Raspberry Pi 5 (running debian trixie), but could not make it work. Does it require compiling in lieu of the .deb file you offer?

Are you referring to rustnet or littlesnitch?

Re: LittleSnitch for Linux

#486

Post by hubabuba44 »

littlesnitch wrote: post #457
hubabuba44 wrote: post #389

Earlier quoted context omitted.

I'm happy to see this on Linux and I really appreciate the open-sourcing of the eBPF component. I maintain rustnet, a passive network monitor in the same eBPF + libpcap space, so I ran into a lot of the same issues. Wanted to share what has been working for me on the privilege side, in case any of it is useful for v2. rustnet ships with setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' instead of setuid-root. During start…

Thanks for sharing! I took rustnet as proof that complex eBPF programs can be done in Rust. Otherwise I would not have dared to try this! Reducing the set of privileges is on my todo list, but for the moment I just want to get things working without worrying about self-made limitations. Regarding mount points: I needed the inode numbers of the mounted nodes. With my last commit this requirement has been dropped and i…

Ah nice, I'll take a look at the open source eBPF part for the process resolution which is an area where I still have some rough edges and there is probably something I can learn from your approach.

Re: LittleSnitch for Linux

#487

Post by Doxin »

dainank wrote: post #360
veber-alex wrote: post #279

Earlier quoted context omitted.

I wouldn't be too exited. Statistics like this are very problematic. For example, I have Steam installed on my Macbook pro and I occasionally play a single very simple game there. Does that make me a macOS gamer? of course not. The vast majority of games I want to play don't work on macOS. I suspect that most of those 5% are just Linux users who have steam installed and play a small amount of games. Some probably jus…

Indeed. The bigger problem is also that consistently the most played games are multiplayer competitive titles with anti-cheat software that is only written for Windows (and sometimes MacOS). I suppose this issue will solve itself, once enough people start playing on Linux. Then developers will be forced to support that too in order to not lose too much of their player base, but we are still a far cry from this thresh…

I'm not convinced "most played" is the relevant criteria here. That's easily skewed by games which are time-sinks, like PvP games with draconic anti-cheat and DRM. That doesn't make those games more important than games which absorb less playtime.

Re: LittleSnitch for Linux

#488

Post by riobard »

littlesnitch wrote: post #317
riobard wrote: post #177

>> The macOS version uses deep packet inspection to do this more reliably. That's not an option here. I thought it would be easier to do DPI on Linux than macOS. No???

eBPF is very limited in the code complexity you can achieve. DPI on QUIC, for example, needs a lot of cryptography. That's simply not possible in eBPF. DPI on ordinary TLS still requires that you collect enough network packets to get the name, hold them back until you have a decision and then re-inject them. Holding back packets is not even possible at the layer where we intercept. And even if we find a layer to do t…

How do you achieve that on macOS then? With PF?
Post reply on HN