Hacker News Reader

Hacker News

Comment by fnord123 | Hacker News Reader

Parent Full thread

fnord123

Lulu setup for Sentry seems to be for crash dumps being sent:

https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361...

It does seem like a good idea that this could be disabled but now it's hard coded.

Issue on the topic: https://github.com/objective-see/LuLu/issues/488

View on HN

This particular line in the developer's response[1] leads me to believe they don't - or at least don't properly - validate third party dependency changes, which is even more worrying if I'm honest:

  > I will look into why Sentry.io is being contacted so often! This is strange as unless they changed their SDK/framework, is only supposed to happen on a crash report.

1: https://github.com/objective-see/LuLu/issues/488#issuecommen...

That's a poor characterisation, I'm not convinced any developer can say with 100% certainty they've never missed anything in the release notes of their dependencies or had any unexpected behaviour in changes that made it to production. Mistakes happen.

The nature and capabilities of these products makes me significantly less forgiving towards these sorts of mistakes, however.

Just to be clear I have no ill will towards this developer or their products.

I agree with sibling: I think you're giving it an uncharitable interpretation. There is an open issue and they are investigating to improve the situation.

You’d think, if they wanted telemetry so badly they are prepared to deal with the fallout, they’d be on top of the information collected by that telemetry.

> crash dumps being sent

Crash dumps can contain highly sensitive info. I have blocked Crashlytics[0] and Sentry with my pi-hole so nothing gets sent. I'm starting to believe these tools are abused and not even used to improve services. They're basically a MITM so people can violate other's privacy.

[0] https://firebase.google.com/products/crashlytics

Can the same be done with hosts file (block crashlytics/sentry?) for those of us unable to use pi-holes at work?

edit: it looks like it is working, but unknown if there are any negative side-effects at this point.

    └─[$] <> ping sentry.io
    PING sentry.io (0.0.0.0): 56 data bytes
    ping: sendto: Socket is not connected
    ping: sendto: Socket is not connected
    Request timeout for icmp_seq 0
    ^C
    --- sentry.io ping statistics ---
    2 packets transmitted, 0 packets received, 100.0% packet loss

You can block the root, but usually the domain contains random (unique) strings as a subdomain, so you need to wildcard block it, which pi-hole supports.

Thanks. Bummer, I figured they probably didn't use the root domain but some amalgamation of letters/number/sub-domains. I have a pi-hole at home which has been working great for 3+ years now, but I mostly run objective-see stuff on my work machine.

You can block Lulu with Lulu. I think by now we should all have learnt to block internet access for every app, and only enable it if it really needs it - that's exactly what an application firewall like Lulu is for.

Potentially relevant that the Sentry client is configured in debug mode there. Not sure what the actual impact of that is but maybe it causes additional network traffic to Sentry (outside of crash reports)?

Reply on news.ycombinator.com