Hacker News Reader

Comment by blackbeard | Hacker News Reader

I'm starting to think I need to worry about things getting out of my firewall more than things getting in.

On my Mac I use Little Snitch to monitor outbound connections and I love it. I haven't found an equivalent simple and lightweight application for Windows yet.

Oh man, I am racking my brain trying to think of the tool I used to have installed on my PC at my last job. It was built by somebody who posted on HN, lightsomething or something? It would warn you about new programs connecting to the network and do other neat stuff. Not quite the same as little snitch, but similar and very pleasant to use. I'll update if I think of it (or maybe somebody else can name it.)

[edit] Glasswire! https://www.glasswire.com/ It's super slick. Apparently the paid version has an "ask to connect" feature.

Is there an open source alternative/equivalent, preferably runs on Linux?

Pretty much every distro on earth comes with a firewall package which you can install and configure.

Just iptables.

eghad recommended glasswire to me yesterday as a "solid" alternative.

Thanks, This looks interesting I will definitely give this a try.

Have you tried GlassWire?

https://www.glasswire.com

Thanks.

As others have mentioned, GlassWire is quite simple and lightweight. Unfortunately, while it’s absolutely invaluable for monitoring changes to the system (DNS changes, application changes (becoming unsigned, etc.), webcam and microphone changes, etc.), its firewall is too simple compared to Little Snitch. Unlike Little Snitch, which lets you choose which domains and ports an application is and isn’t allowed to connect to as it attempts to make those connections, GlassWire only allows you to either allow all connections an application makes or deny all connections an application makes. NetLimiter¹ is much closer to Little Snitch in this regard (example²).

Personally, I’d recommend using a combination of GlassWire for monitoring system changes and NetLimiter for the firewall.

――――――

¹ — http://www.netlimiter.com/products/nl4

² — http://www.netlimiter.com/Files/ImageGalleries/netlimiter-4-...

I've looked at screenshots of Little Snitch and I don't understand why it's so interesting.

Isn't this what e.g. Zonealarm has been doing for 15 years on Windows?

Zonealarm back in the day did something similar, yes (I haven't used it recently so I'm not sure what it does now). Little Snitch is the OSX equivalent :).

Snakeoil with a better taste

Do you actively block then grant-access to everything, or just periodically check what's happening? I've tried the active filter before, but found it to be very disruptive to my typical workflow.

I do active blocking. I permanently allow any application that I can trust. For example I will allow chrome to connect permanently. But if it is some cryptically named service trying to connect I will block it permanently. After an initial approval stage you do not see too may popups for approval.

But I can see how this can be a disruptive process, when all you want is some work done. I wish we lived in a place where I did not have to use tools like this.

Couldn't agree more. These days we have to protect ourselves more from our own software than from viruses. Assume any software is a trojan horse, even the OS.

Or you could use free software.

How, pray tell, does free change the problem except in fantasies? There is plenty of "free" software that contains the same problem.

At least, with those, you can audit the code and have someone fix it. No such luck with proprietary software.

Free as in freedom, not beer. You can look at the code of the free software, therefore tell if it's phoning home or not. More importantly, changing it.

How many people have the time or inclination to validate everything that way?

Not many, but the effort is parallelizable. If you find a security problem and report it in public, others can verify it, and still others can benefit from the fix even if they never would have bothered to look for themselves.

It doesn't take many. The problem is making sure that someone is doing it (cf., OpenSSL).

Exactly. This is how the Google Chromium always-on voice recognition payload was discovered, for example. We may never have known about it if it wasn't an open source project, or at least we wouldn't have heard about it until long after it shipped.

Not a guarantee of privacy or anonymity. See: SourceForge. Generally a step in the right direction though.

Many software projects I use are hosted on SourceForge. While SF has been using some nasty techniques with binary installers, the source code is, as far as I know, untouched.

And, as soon as it's touched, the project maintainers can shut down the SourceForge repos and move on to someplace else.

It's not a guarantee of security, privacy or anonymity, but open source is still your best chance to get any (or all) of the three.

Counterexample: Ubuntu sending local file system searches off to Amazon because apparently online shopping and file searching are things you want to do simultaneously.

Which is why being open source is not enough. It needs to be non-commercial.

Which you can fix by either using another distro/uninstalling it/disabling it/using another window manager.

The main difference between Ubuntu and Windows 10 is that Ubuntu will respect your decision to opt-out.

"Your information is ours unless you are aware of it and spend unreasonable amount of time searching for the information leaking settings and disabling them." Yaay

This is incorrect. Ubuntu told me in clear words that dash searches will be sent after installation when I used dash. That's how I came to know of it, and that's why I disabled it.

I didn't like the fact that that it is opt-out and not opt-in, but yeah, way way better than Windows 10 for now.

Also note that Canonical took steps to ensure amazon doesn't get to imprint your system by proxying the requests through their server.

You absolutely should be concerned about things getting out as much as things getting in.

Things getting in can damage your data, but that is what back-ups are for. On the other hand, things getting out can leak your data, which is likely to be a one-way trip and, depending on the type of data, potentially a very expensive one.

Of course things getting in can also interfere with your device's normal operation, and in the brave new world of always-online systems and reprogrammable everything, if your system does get compromised today it may be extremely difficult to reliably clean it. The days of booting from a operating system's install CD and reformatting as a reliable recovery mechanism have long passed. This is not a good thing.

Reply on news.ycombinator.com