Hacker News Reader

Comment by user3939382 | Hacker News Reader

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that).

Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, and allow inspection of the actual traffic.

What Adobe CC, Google Chrome, MS Office, and macOS/Windows itself do with this background network connectivity is completely out of control and abusive to the user. They get away with it because the vast majority of users are non-technical and don't realize it's happening.

I've profiled and decrypted the background traffic on a stock Android install and the volume was also appalling. Getting macOS to 0 background traffic involved blackholing large Apple IP blocks at the router, whereas some of their processes use random IPs from these ranges and don't use DNS.

Just as the general public doesn't have the awareness or ability to fight for their privacy rights I doubt any of this will ever be remedied.

View on HN

On Linux there is OpenSnitch that does its job nicely, although I experienced some occasional desktop slowdowns even after training it to open everything for trusted programs.

https://github.com/evilsocket/opensnitch

I still recall the old days of Windows when I tried Kerio Personal Firewall and realized how much software already phoned home two decades ago. That was the last wake up call that pushed me into getting rid of closed source software, possibly also hardware, especially when they connect to the internet.

I second OpenSnitch, I haven't face any shutdowns due to it yet. For those coming from LittleSnitch on macOS might have to look into the finer details of the connection in the Allow/Deny dialog on OS to get the best results.

Slowdowns, not shutdowns, luckily:) The desktop (XFCE under Debian if that helps) just hung for a while like it was waiting for me to allow some rules, but didn't show the requester to do so, also the timings were random, could have been from 2 seconds to 5 or more.

Oops; Self-reminder to not comment on HN when half sleep.

But, I haven't noticed slowdown either; I wonder whether its because I always keep the OS window open?

Keep in mind, OpenSnitch is Linux-based and none of Linux firewalls can filter incoming packets by process ID like macOS/FreeBSD (Lil'Snitch) can.

From what I understand opensnitch use ebpf to match where the exiting packets are going. TCP being TCP, it is easy to know where the incoming answer will be delivered to as well.

Not sure if this would work also for connectionless protocols such as UDP. That is, if I open a socket and send some datagrams to an external address:port to exfiltrate users data, then close the socket and exit, I don't think it would be able to tell which program did that, unless it detects it live.

I believe opensnitch catches them.

I think iptables was supposed to be able to do this, right?

https://linux.die.net/man/8/iptables

    --pid-owner processid
        Matches if the packet was created by a process with the given process id.

But was disappointed by the note:

> NOTE: pid, sid and command matching are broken on SMP

--pid-owner was removed from Linux some time in the 2.4 days IIRC.

That's a really outdated version of the man page. The current one is: https://ipset.netfilter.org/iptables-extensions.man.html

Probably the closest thing these days is to use the cgroup match extension, together with something that makes sure separate apps are moved to their own cgroup. But that cgroup would be under a separate parent cgroup for each user so it's not ideal.

I expect NFQUEUE or some EBPF magic is a better way to do things - you don't want to be constantly adding/removing per-process iptables rules.

Iptables is a little old. You may want the newer nftables instead.

The iptables rules can be converted directly to nft with iptables-translate and the syntax is more simple.

The owner module can control outbound communication by uid/gid. [1] There are no modules to handle things by PID AFAIK. This can however be accomplished by SELinux and Apparmor custom rules but that is a loaded topic.

Firejail [2] and Bubblewrap [3] can put limits on application capabilities and/or take away network access. Firejail has default policies for many applications, all of which can be overridden by user configurations in their home directory. Firejail leverages Linux Capabilities and AppArmor. For example, when I launch VLC even if it were configured to pull down album information, it could not. If one day they added default-enabled telemetry to VLC it would go nowhere.

A round-about and heavy handed way to manage communications by PID would be to isolation applications in their own VM or container and map the VM or container to a unique user or group.

[1] - https://ipset.netfilter.org/iptables-extensions.man.html

[2] - https://github.com/netblue30/firejail

[3] - https://github.com/containers/bubblewrap

OoenSnitch can, but it's not implemented O:) (only as a PoC)

But does it have any sense? Usually you block inbound connections, allowing only certain services. If a rogue process starts listening on a local port, you could display a warning alert, and as inbound connections are already blocked you'd be safe (as long as you trust netfilter...) and you wouldn't need to ask the user to perform an action.

The slowdowns are because it still has to hold every connection until it can check which program it is coming from and whether that program is trusted or not, even when the same program creates multiple connections.

To get around the slowdowns, I made an alternative program called picosnitch which only monitors connections since I just stop using anything I don't trust or move it to a sandbox. It also uses BPF, has fairly low CPU usage, and some other features for improved reliability and detection of programs.

For Windows, check out simplewall, it does (almost) exactly that.

https://github.com/henrypp/simplewall

It uses the windows firewall. Do I trust Windows firewall to block itself? NO!

From the README:

> Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall.

> It works over Windows Filtering Platform (WFP) which is a set of API and system services that provide a platform for creating network filtering applications. Windows Filtering Platform is a development technology and not a firewall itself, but simplewall is the tool that uses this technology.

> It uses the windows firewall.

No:

"simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall"

I was referring to the firewall functionality already present in windows, not the GUI called "windows firewall".

Even if it was a wrapper over Windows Firewall, why would that make you trust the filtering less? Like even if it was running fully custom ring 0 code, there's still also Windows kernel code running at the same level. Microsoft could make the kernel interfere however they want.

Like how MS ignored the hosts file if you tried to use it to block windows update. Ultimately MS has final say on what you're allowed to do on windows and they can force updates that disable or enable any kind of behavior they want. It's their system.

If you don't trust MS, don't use windows or at least never ever let connect to the internet. In a fight between you wanting to keep your privacy and an OS designed and determined to exploit you for profit, you will always lose.

I'm to the point of getting a separate hardware firewall and putting that between my computer and home network. But when you do that, you won't be able to tie activity back to an application... maybe the new nextgen firewalls can if you install some sort of agent on the computer? Idk....

I briefly experimented with using such an agent to communicate with a separate hardware firewall and found it was not worth the effort for myself and a better solution was just sandboxing anything I don't trust in a VM, since escaping a VM is harder than compromising the local agent to mask the traffic as coming from something else.

I'm using malwarebytes windows firewall control and it does block itself. I'm constantly dealing with Windows 10 crying over defender not being able to update itself and popups that I may have a virus that is blocking defender from calling home.

It has built-in support to block Windows Services/Apps/Updates without user interaction.

I believe the Mac OS networking APIs go a little bit of the way there - in Lulu, an open source alternative to Little Snitch, the connection prompts tend to contain (and let you filter) by the URL visited (including the query after the domain name). This isn't done through TLS interception, but I believe it's through the network extension API on MacOS receiving the URL requested, as long as the request comes through the regular APIs.

It's a long time since I looked, but I think some apps (mainly ones not using native APIs) only showed the hostname, rather than full URL/API endpoint path.

This also didn't show you the content, or method type (POST vs GET), but to do that you'd really need to start doing proper SSL inspection as you suggested.

Since 2014 I don't trust my macs. There is no Apple computer without LS installed on in my company. Actually, if LS is not available, I will not use Apple computers at all. Period.

Why don't you trust your macs since 2014. Also why do you still use them if you don't trust them any longer?

Not OP, but for me the answer to your question is: is a tool I need. I _could_ use Windows, and absolutely not Linux/BSD (for the programs/tools I need for work), and, frankly, I don't think Windows is better.

Yes, I know that's not completely true. I _could_ use Linux (I even used Solaris on a notebook for 2 years in the past and I survived) but the cost in terms of effort, lost productivity would be higher than I'm ready to pay. It's a rational choice.

> I _could_ use Windows, and absolutely not Linux/BSD (for the programs/tools I need for work)

Are you sure of this? Wine (or Proton for graphics stuff) is pretty good.

Work only allows Mac or Win to log in to their VPN.

Change your work then. Or use windows in a VM. Always good to separate work and private system anyway.

They provide a mac. I will exit at some point.

What happened in 2014?

Also someone told me here that LS should be considered harmful.

It's complicated, but the 2013-2014 years were when the bulk of the Snowden leaks were hitting the internet, and people were starting to dig up really suspicious stuff relating to all big tech companies, not just Apple. However, Apple was still among the companies compliant with PRISM, the NSA's newly established surveillance/tracking effort that also roped in Microsoft, Google, AOL and any other major service provider you can think of.

The implications of this are unclear. I like blowing these claims out of proportion, but in reality we genuinely have no idea what this means. It could simply signal that Apple is complicit with benign cloud-storage security procedures enforced by the USA. It could also mean that the US has carte-blanche access to iCloud data and decryption keys. You're free to draw your own conclusions, but the surrounding context seems to imply that Apple has an under-the-table relationship with our government (as does most of the tech industry, surprise surprise).

Oh, and I don't really know/care if LS is harmful. You should be aware that it's not going to outsmart Apple if they want to collect your info, though. They have kernel-level networking access, which companies like Microsoft have abused in the past to collect telemetry on crafty users. It's probably not harmful, per-se, but your perception of it as an impassible wall might be.

LS is not the only solution that I use. But is a good start and limits the telemetry baked into the macOS significantly. On my Debian installs, I use Open Snitch. https://bit.ly/3t6VSCk

Why do you trust Little Snitch? It's closed source and in the perfect position to steal information.

If worrying about closed-source threat models is something you spend a significant portion of your time doing, you shouldn't be using MacOS in the first place.

I believe, even if I have not tried yet to do this, that you can do this in Linux if you create one or more virtual network interfaces in some namespaces, and you ensure that only that interface or those interfaces get IP addresses.

Then any program that is not run inside the namespace with configured virtual network interfaces can see only unconfigured interfaces, so it will not be able to open and connect sockets.

The Internet browser and any other program that needs network access, e.g. a NTP server, DHCP client, e-mail client etc., can be run inside the namespace with an IP-configured network interface.

The same could be done in FreeBSD by using a jail for the programs that need network access.

Obviously, this would not be enough to prevent network access for a program that would be aware of this configuration and would try to circumvent it, because such a program could list the network namespaces and try to execute itself, or another helping program, inside the network namespace. For complete isolation, all the programs for which network access is not desired would have to be executed inside a distinct namespace. That requires a more complex configuration.

> What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that).

If you want to you can do that with Linux.

Sure you'd need to use the CLI, and a combination of tools but you can pinpoint every packet to an associated process and if you add your self made cert to trusted certs, then you can decrypt TLS as well in most cases.

Nah, you can't. The issue is the "easy monitor outgoing traffic with TLS/SSL" part.

It is not impossible but it is far from easy. If the application uses statically linked SSL client (as it should if it is commercially distributed) then you have to modify the application (for example in memory) to get a copy of everything that gets written to the SSL stream.

You know how you can do Ctrl+Shift+K in Firefox to open up the browser console and inspect all the bits of the page, see the code (and fuck with it), see all the network traffic, and so on? I dream of being able to do that for arbitrary applications. Imagine having a Super+Ctrl+Shift+K that opened an OS-level GUI showing all the pertinent details of the running program.

You know that this only pertains to webapps and there is still a lot of software running on your machine that you have no idea what it does?

I am specifically referring to the ability to have the same sort of interface with non-webapps as we do with webapps.

I believe the parent commenter is aware of that - they’re describing their wish for a tool that makes monitoring native application requests easy and transparent, similar to the experience of using browser devtools with web apps.

Not quite.

For this to work well, all your apps need to run with not being able to do their own TLS, but to various (reasonable) reasons a lot of applications today do their own TLS.

You also don't want to add self-signed certificates, but grab the traffic _before_ it gets encrypted IMHO.

In some cases it's still quite viable, like if they dynamic link to OpenSSL (or similar) you could create a facade which allows grabbing traffic.

But things get problematic when it's statically compiled in and not open source.

Additionally there are quite a bunch of use-cases where the encryption is not TLS, like e.g. with some WebRTC applications it's not uncommon to have an encrypted channel we could access to a broker server but in that channel E2E encrypted messages are send e.g. using libsodium statically compiled in.

While i partially agree, even DNS query/http headers (I'm not sure if that is encrypted with ssl?) Could be useful here. Told the software not to connect to cloud, still connects to cloud. Enough reason to complain.

> You also don't want to add self-signed certificates, but grab the traffic _before_ it gets encrypted IMHO.

that would be ideal but self signed + added to trusted store works

> Additionally there are quite a bunch of use-cases where the encryption is not TLS, like e.g. with some WebRTC applications it's not uncommon to have an encrypted channel we could access to a broker server but in that channel E2E encrypted messages are send e.g. using libsodium statically compiled in.

yeah youre right.

In other cases the only options we have are ld_preload to catch encryption lib. If that doesnt work we can still use ptrace to capture syscalls but encryption will be done in userspace so capturing network activity wont help us with encryption.

Like the other guy said, the info we can gather is still useful.

Reverse engineering + modyfing the binary is a possibility too but it gets complicated fast, especially if they intentionally try to protect it. I feel this isnt really an issue with jvm or interpreted langauges but with the others its hard especially if theyre statically linked. C/C++ have good enough decompilers that its still possible, I don't know about Go/Rust tho.

  What I want is Little Snitch on steroids built 
  into the OS where every process,

You cannot trust an OS you cannot build yourself. That's why I see Linux as the only option for professionals and privacy minded people.

How do you know there are no outside efforts to log linux activities? There's a lot of source code to go through and is it possible there are callbacks even within OSS that most people are not aware of?

At least its possible _in principal_ and many people out there can at least look at the code even if you can't dig through yourself. With Windows or OSX you're just out of luck.

OSS is necessary, but (as you point out) not sufficient.

Well at least with open source, you CAN verify it. There are people and companies who do audit You're replacing a big and unstoppable problem with a smaller one that can be mitigated

It all depends of course on the level of your paranoia/threat model.

To prevent standard data leaking or rather stealing like in this case, linux is a quite solid choice.

But if you think you are a high profile target, you should probably learn how to deactivate Intels ME and co.

And if you are really paranoid, you should assume that there are hardware backdoors. But what do you do then? Build your computer from scratch?

Layers. It's all about layers.

I don’t need to go through all the source code myself. The fact that Apple itself, for example, relies on Linux for most of its servers and has not raised any alarms about bits of Linux phoning home is a pretty powerful heuristic that it’s relatively safe.

Multiply that by all the multibillion dollar other companies, the tens of thousand open source focused smaller and large companies, the hobbyists, the enthusiasts, the CS professors, the CS undergrad and grad students, the PHD candidates who would be thrilled to discover a flaw on the basis of which they could write their thesis, etc. and I think one can have a fair degree of confidence.

There’s still a decent chance something would be missed. But it’s much smaller than the chance that the proprietary OS owners, whom we know for a fact phone home and have been trying to collect increasing amounts of data, are sending stuff we may not know about.

> The fact that Apple itself relies on Linux for most of its servers is a pretty powerful heuristic that Linux is relatively safe [paraphrased by me]

Many world-class companies depend on Windows, so does that mean you think Windows is safe?

An individual does not have the same access to custom tools, and teams of competent people, that ensure their usage of the Linux ecology is secure.

A recent example: I was investigating using CloudFlare Functions, because I think CloudFlare has world-class security and that “serverless” product avoids many security issues I might have with other solutions. Yet one setup step suggested piping in a script from curl to shell (commonly suggested for install steps!). Even worse, https://github.com/cloudflare/wrangler2 is their CLI tool to help development, and Wrangler is based on the node ecology, which is completely insecurable as an individual developer IMHO (trillion dollar companies can probably secure the dev environment). I use a VM to provide some sandboxing, but it still leaves me feeling icky.

That assumes people actually have the capacity to examine the source to do so and make the requisite adjustments.

The real answer IMHO is to control your networking stack outside of your computer instead. Firewall that and you have way better security

How do you do packet inspection when they're all encrypted?

You can still inspect whether you’re having packets sent when you add text or just when you click on certain options

You could add large amounts of text and see if the packets increase proportionally.

You can perhaps analyze which apps or extensions are sending packets.

This post doesn’t provide enough information of value

> You can still inspect whether you’re having packets sent when you add text or just when you click on certain options

Batching very commonly obscures this kind of UI interaction reporting.

You install a proxy server that MITMs all connections and reencrypts data with your own certificate that you install in your system.

TLS MITM. But you better be 100% sure your middle box is not compromised.

This. Not so hard to do and lots of corporations already do it.

But yeah - whatever you are running on that box better be legit!

With the compiler that you verified and built yourself :)

I believe this is a reference to: http://wiki.c2.com/?TheKenThompsonHack

Itself built with a compiler you verified and built yourself.

It's self built compilers all the way down

In fact, you cannot trust an OS you DIDN'T build yourself. And there are only two of those: Linux from scratch and Gentoo.

How do you know that the compiler that was used to compile your compiler was not backdoored (or binutils/glibc/bash)?

You may instead want to look at the bootstrapping work done using stage0, m2-planet, GNU Mes, etc.

https://bootstrapping.miraheze.org/wiki/Stage0

https://guix.gnu.org/manual/en/html_node/Reduced-Binary-Seed...

It starts with a hex monitor of less than 500 bytes and bootstraps all the way up to gcc, all from source.

In fact, you cannot trust an OS you DIDN'T build yourself

... with a compiler you wrote yourself. In assem-- uh, in hexade... no. With toggle switches.

Yeah, this is a strange take to me. Akin to catching the fox guarding your hen house eating the hens and reacting by having the fox install and monitor a security camera for the hen house. The problem is still the fox and he'll just turn the camera off when he wants the hens.

This analogy makes me smile, it's a good one!

> Kind of like granular oauth permissions, apps should have to declare which outgoing they have,

Just like PayPal. There's a table you can bring up that lists everyone you ever engaged with on paypal for recurring pricing, and deactivate them.

I've wanted exactly what you describe for years. Little Snitch taught me that there's just too much data that isn't organized properly. Even if you get down to the app level (like PowerPoint), it is still transceiving a lot of data. How do you tell what is necessary and what is dubious telemetry?

> with TLS/SSL inspection built in (you'd need some OS API to enable that).

I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis.

You'd need to disable HSTS, but other than that I think it should be the solution you're looking for. Oh, and for good measure, ethernet cable instead of wifi.

A well-designed OS API doesn't need to do MitM and therefore would work with HSTS or cert pinning enabled.

Of course for obvious reasons, few commercial apps would actually use this API unless they have some other incentive.

Well, the original article was about Microsoft. Since they're the OS vendor too, I discounted that as being reliable for this use-case.

Any application that uses certificate pinning would fail in this situation as that's specifically what it is trying to prevent.

You "just" need the key to the encrypted traffic. You don't have to change the handshake/negotiation, you just want a copy of the key so you can decrypt the traffic.

In TLS, the client authenticates server, then they both agree to use a key for the session; the OS can get a hold of this key (this is usually a bad move because then any captured traffic frames could be later decrypted).

I was just thinking about this- pair that with a iPad that sits on refrigerator and shows your grocery list and family calendar. Then it blocks your smart tv from sending data out and allows family to keep organized. Does 3 things very well and that’s it

Cool idea. This was posted a few days ago on here, and I was impressed by the UX and capabilities. Tho I didn’t delve too deep.

https://news.ycombinator.com/item?id=33481518

That would be nice, but I would hate to see mobile OS with their permission system replicated for PC. Simply because mobile OS are fairly lacking.

At some point phoning home was a sin for software. Sadly that changed, also because of the naivete of some developers.

Ha, what a timing! Just 2 days ago on HN front page:

Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall https://news.ycombinator.com/item?id=33481518

Disclaimer: I'm the CTO.

Why not just disable the network interface and see what stops working.

Why not set the Windows computer's gateway to a computer that the user can properly control, i.e., do not give the Windows computer direct access to the internet.

Windows is an OS that was created before the public had access to the internet.

It worked just fine "offline", i.e., connected to a LAN but not an internet.

Same for the Mac.

To be honest, I cannot think of many PowerPoints that needed internet access, at least not in the fields I have worked in.

Obviously, "tech" companies want personal computers to be online for every waking moment of their owner's day. Neverthless it is in fact possible to "block", i.e., not assent to, much of this outgoing transfer of personal data/metadata to "tech" companies at the user's expense. I have been doing it for over 20 years. With few exceptions, I inspect all HTTPS traffic that I allow over the networks I control. The "tech" companies gathering this data do not pay for the user's internet or cellular service. The user covers the cost of the data transfer.

Change begins with the people who know how to make it. For example, it is not difficult to stop PowerPoint from phoning home. Why go along with it. But when those with the requisite knowledge year after year make statements on HN how it is futile to thwart any personal data mining because it is not 100% "perfect" solution,^1 I have been seeing these comments on HN for many years, then it is arguable this becomes a self-fulfilling prophecy.

The "majority of people", "general public", etc., do not know they have a choice. They will use whatever is presented to them. What happens when those who do know there is a choice go along with what "tech" companies present to them. They are in no position to blame "the majority".

Certainly, those working at or investing in "tech" companies would welcome a lax attitude toward avoiding data collection. "Nothing is going to change because no one cares." Tell that to Zuckerberg after Apple prsented its customers with the means to "block" some of Facebook's data collection.

https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv...

1. All-or-nothing, black-and-white, binary style reasoning.

Could build it yourself w/ eBPF.

I tend to just mitm said talkative devices and drop packets -- it is alarming the amount they want to phone home.

I used little snitch for so many years but stopped using it a while ago for some reason. Is it still as good as it used to be?

What you've described is none other than a Winston Privacy device (no longer available, alas).

Would it be possible to develop something like this for Linux using eBPF?

pf is built into macOS. There is a (paid) frontend - https://www.murusfirewall.com

Have a look at firejail. Does this, and more.

Isn't this what safing does basically?

Yes! For reference: https://safing.io/

We could go to our EU representatives and ask for them to make it mandatory. Though I suspect it'll go down the same way as the GDPR, at least at first.

(Lessons have already been learned of course)

We really just need a clarification/ruling that ANY telemetry is not essential to providing a service and thus requires informed consent before it can be collected and consent cannote be required to use the service. And then enforcement against all these applications.

I don't think adding technical layers to block these data leaks is going to work long term.

> I doubt any of this will ever be remedied.

What if you didn’t use PowerPoint?

Seems much simpler.

Also, maybe the data makes PowerPoint good? Or better?

Alternatives to PowerPoint: won’t all of the viable ones be hosted on the web?

What do you want? You can install PowerPoint 97. No one is stopping you.

The Little Snitch would be asking the OS to please tell it about network traffic.

Microsoft's OS.

It would be asking Microsoft's OS to tell it about traffic Microsoft's software wants to keep secret.

I'm sure there's a world where that isn't a laugh line, but I certainly don't live there.

I disagree. What's a worse look: not having this OR having this and being discovered subverting their own security?

OS network filtering APIs don’t work that way and another unrelated and unimportant Microsoft team can’t override it

What indication is there that Microsoft wants to keep this traffic secret? The OP was able to detect and inspect this traffic with standard network monitoring software.

Reply on news.ycombinator.com