Hacker News Reader

Comment by beckler | Hacker News Reader

Little Snitch 4 is a rather impressive piece of software. The map is my favorite part. It's not always accurate, but it's absolutely wild to see the places apps want to ship data off to.

Also if you interface directly to your WAN, you can see all the bots/worms/etc that try to connect to your IP. I got a surprising amount of netbios queries from Iran (I'm assuming from EternalBlue based malware trying to connect), but I highly recommend NOT doing this. It's the wild west outside your firewall.

View on HN

> It's the wild west outside your firewall.

You mean outside my $5 NAT WiFi router last updated 6 years ago (because the manufacturer won't maintain it any more and the ISP never gave me the admin password anyway)?

better than nothing... arguably...

This right here is the very reason OpenWRT exists.

I never trust ISP provided equipment to do my routing, if I can't use it in modem mode (or provide my own modem) then a DMZ and port forwarding have to do ... but I'd sooner just choose another provider.

At least you need to know the settings for this. I tried attaching my laptop directly to the cable and that didn't work (I would put my own router if it did). There probably is some sort of PPPoE over a statically-configured network.

I use both Little Snitch and Micro Snitch.

The LS proxy completely overwhelmed me. I thought I could be savvy and limit traffic. Yeaaaaah no. Once I started observing what was actually flying around it's... it's just insanity how many requests are made in just a few seconds. What else can I do but throw up my hands and hope for the best? But I guess it won't matter soon.

Little Snitch definitely needs a social feature where you can crowdsource good rules from other people and see what rules are common within the communities for certain apps.

Back when I was using OSX and Little Snitch, first user experience was horrible. I reinstalled OSX and installed Little Snitch first, and went to install app by app after running it, and got a slightly better experience. But, requires a reinstall of your OS (or maybe creating a new user will be enough)

While the social part is not there, the technology is.

I subscribe to rule groups through hostblocker.app, which pulls HOSTS files from different known websites and compile them into a .lsrules file which Little Snitch can use.

While I cannot vouch for the website's underlying code-I did not write it and I can not find an open source implementation-It only provides rules and I can edit any rule group to my liking after subscribing to it.

That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.

No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.

I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host.

If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.

TIL. Thanks. Yes, for whitelisting it does not work.

little snitch supports blocklists ublock origin supports. it's a bit obscure feature but easy to setup.

This is precisely why I've never installed it, because I figure it would overwhelm me.

How does combo help you not be overwhelmed?

It is really obnoxious when you first install it, but once you have set up your rules for your most frequently used applications, it isn't really an issue for me. You can also export and import your rules if you want to move them to a new system.

I haven't used micro snitch, though.

> once you have set up your rules for your most frequently used applications, it isn't really an issue

I can second this, also if you're overwhelmed you probably have a lot of garbage applications making too many outbound network requests to trackers and who knows what else which is actually nice to know about. Chrome-based browsers and Electron based apps seem to be particularly awful about this. My HP printer app tries to connect to Google Analytics, Microsoft RDP phones-home before connecting to a session. I really value that kind of insight and enjoy being able to control it.

I removed little snitch. :)

Micro snitch just alerts me when my mic or camera are activated. I can live with that.

Are they ever activated at times you aren’t expecting them to be? I assume I would have a noticed the little green light on my mbp if the camera was being activated against my wishes.

I've been using Little Snitch since 2.0 and I agree, it's very impressive software. I had the same reaction to seeing the map features -- eye opening to say the least and a very, very interesting feature!

It's kind of peaceful watching attacks crash against your webserver/firewall, like waves at shore.

https://en.wikipedia.org/wiki/Internet_background_noise

I'd like to see a similar map built into pihole. Seems like a natural fit. This way you could get a map for connections made by various apps on your phone too.

Reply on news.ycombinator.com