So excellent that some malware deletes itself if Little Snitch is even installed (https://www.f-secure.com/v-descs/trojan-downloader_osx_flash...). However, it's worth noting "DYLD_PRINT_TO_FILE" is a root exploit, which may circumvent or disable Little Snitch entirely if used by APT; Little Snitch may not see all network activity. In fact, a root exploit allows one to write malware completely hidden from userland altogether (lsof, ps, tcpdump, etc.) (https://github.com/hackedteam/driver-macos). It is truly scary how vulnerable OS X is at the moment.

As a Little Snitch user, I'm inclined to agree, but I find that I sometimes end up in a state of "WTF wants to use the network now?!" saturation.

My solution for that is to deny anything I don't recognize, and create rules for things I see more than twice, but if you're conditioned to click "OK" on everything you see, Little Snitch isn't going to to much for you...

Although be aware that it can be quite daunting for a novice user. If you're installing for a friend or family member, you should go through all of this apps to whitelist requests and maybe teach them how to identify bad requests, but it's non-trivial. The UI doesn't interact very well with CDNs, for example, sometimes telling you that "App Store" is trying to access "arstechnica.com" because they use the same CDN provider.

Patrick Wardle dropped two Little Snitch bypasses at BlackHat [1] this year.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-W... [PDF Warning]

Our old infosec guy at work used the icefloor PF management tool at work. It seemed interesting, and I mention it in the vein of the venerable Little Snitch.

http://www.hanynet.com/icefloor/

Does anyone know of anything like Little Snitch or ZoneAlarm for Linux? I miss the program-level firewall capabilities of these programs when I'm on Linux.

Does anyone know of a FOSS tool similar to littlesnitch?