Some time ago I built something I call “Network Blackhole”.
The project intercepts HTTP traffic from applications that I installed in either my MacBook or iPhone. An excellent example of this is Crashlytics [1], Segment [2], and Sentry [3], which are among a list of popular web services that many developers use to report bugs and crashes in their software, and the famous Google Analytics, which I hope I don’t need to explain what it is used for.
With the help of Little Snitch [4] a popular network monitor for macOS, I detect when an app tries to connect to one of these services, or similar. Then I execute a tool written in Go like so: “blackhole example.com” which does the following:
1. Inserts domain into /etc/hosts
2. Create an HTTP web server (in Go)
3. Adds a match-all endpoint to the server
4. Creates an SSL certificate with mkcert [5]
5. Creates an Nginx virtual-host for the server
6. ???
7. Profit
In the end, and after 1-2 minutes, I have all the traffic to that domain gracefully redirected to a black hole, reducing the amount of data that I leak to 3rd-party websites.
However, don’t get me wrong, I understand the purpose of these services, I haven’t said they are evil or anything like that. I would probably use them myself if I had to, but I certainly would add an alert to ask for explicit consent from the user to send this information to a service that I won’t even have control over. If one of them leaks my customer’s data, I will be the only one facing the consequences.
I hope I don’t have to add another domain to my network black hole anymore.