Hacker News Reader

Comment by terlisimo | Hacker News Reader

Compared to etc/hosts or PiHole, it allows you to go from "allow by default, block specific" to "block by default, allow specific".

View on HN

I understand that, but again, what's a real-world use-case for that? Are there any domains that you want to block for every application except one?

Again, the key is block vs allow by default, not whether it's per application.

But yes there's real world use cases for per application filtering -- you want Facebook messenger to reach Facebook.com but probably not any other applications.

Ah, but if I use the FB messenger, I probably trust FB enough that I also regularly visit/use it in my browser, and probably even use it to authorize other apps and services through it... So I'll have to unblock every app that uses FB services anyways.

And FB's trackers and ad-services and other privacy-invading stuff is all on different sub-domains that PiHole or any other "generic" firewall blocks anyways, so again I'm fine without application-level firewalling

> Ah, but if I use the FB messenger, I probably trust FB enough that I also regularly […]

Except if someone sends you a specially crafted message that causes an exploit to be triggered which could contact some other site to download malware on your system.

* https://www.wired.com/story/facebook-messenger-bug-bounty/

Do a search for "no-click exploits":

* https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

You may trust the authors of the software and how the software acts as intended, but you should also considered unintended / undesired usage.

For example I have allowed only my mail servers for Thunderbird. And then I have discovered that Thunderbird sends filenames and SHA-256 hashes of all received email attachments to Google (browser.safebrowsing.downloads.remote.url, https://brmlab.cz/project/spyzilla#thunderbird) and that it sends telemetry saying "you have disabled telemetry" when you disable telemetry.

It also allows you to deny all internet access per-app. For example, should there be an exploit for a MP3 parser in Audacity (presume that Audacity has no use for internet normally -- at least that's my use case), it will probably try to download a second stage from the internet, and you want to block this. Unfortunately, OpenSnitch probably cannot detect "Audacity has spawned wget and you have allowed wget, but only as a child of bash in your terminal launched from your DE startup script, not as a child of Audacity".

This is not entirely made up (only the exploit part), there was indeed an Audacity telemetry incident: https://www.google.com/search?client=firefox-b-e&q=site%3Ane...

As another real-life example, I have discovered that Stardict scans clipboard by default and tries to translate what it finds there using an online dictionary. This includes passwords in your clipboard. https://jenda.hrach.eu/w/et#stardict (the linked page contains several other less severe examples discovered about 2014-2016; I'm not in infosec anymore, so I'm not looking for this that much)

Reply on news.ycombinator.com