> That's trivial to do with little snitch.

It's not trivial unless you have a lot of network, sysadmin, and OS X background. You have to think about a lot of issues of what to permit, what to deny. Then you still get alerts and have to research the things that want access.

I'm reluctant to deny unfamiliar system apps in case I break something and later have to spend a half a day tracking down mysterious behavior.

The developers of Little Snitch have this knowledge. They could create presets for common situations.

The only preset I want is "maximum privacy while user initiated outbound still works". I'd be satisfied even with cookbook step-by-step instructions for such a preset.