Hacker News Reader

Comment by danpalmer | Hacker News Reader

> It’s essential for every macOS user

Is it? I'm interested in hearing why. I've been using macOS for ~15 years, so very familiar with Little Snitch. I think I owned a version many years ago but haven't for a long time. I don't really see what I'd use it for. I don't run dodgy software, I don't want to partially break the software I do run by nit picking what connections it can make as that wouldn't improve my experience and would most likely cause issues. I also mostly trust Apple's anti-malware efforts to protect me from other software I don't want to run, but if I didn't I'd run better anti-malware software before a firewall.

View on HN

I caught a python ml library phoning home to a chinese server on a project that my company was building. My developer had no idea it was happening but I caught it first run thanks to lil snitch. If deployed this would've been a security escape that would need to be disclosed at a govt level.

Also, Apple. Their junk phones home just about everything you do. 50+ services constantly pinging Cupertino.

What was the library?

The exact reason that I use Deno is the sandbox, it will not run if something is calling an unknown endpoint.

“Junk phones”, lol. Gratuitous hate without any substance.

> I don't run dodgy software

I was confident I didn't either, but Little Snitch has proven otherwise. The amount of 'instrumentation' in modern JS and Python libraries is insane.

I owned several versions of Little Snitch too. It started to be annoying when you had to approve each request, especially when running command-line scripts. Then I moved to run in silent-approval mode. At that point, there was no reason to have LS any longer, so I uninstalled it. Haven't used it in years now. But not to discredit LS, it is an amazing software when you need it.

Which command line script are u using that much other than curl/npm etc..

Thanks.

> But not to discredit LS, it is an amazing software when you need it.

Yes! I perhaps didn't make this as clear as I should have. Little Snitch is fantastic software, no question. I'm just not sure that most people need it, I think a custom local firewall was always a bit of a power user tool, and nowadays with security being so much better than 20+ years ago, firewalls on personal machines just feel like an outdated concept to me.

LS is beyond annoying for the first couple of days on a new computer. "Do you want to connect to gmail.com on port 443? What about kagi.com on port 443? What about your employer on port 443? Mind if Weather.app checks the weather?" After a couple of days, I have blanket rules like "allow Safari to connect to any host :443, except for googleadservices.com because nah".

It quickly tapers down to alerting about rare new connections, which is when it becomes hugely useful. RandomTool.app normally connects to cloud.randomtool.xyz. Why is it suddenly asking to connect to exfiltrate.ru?

Analytics is malware and Little Snitch allows me to put the ban hammer on desktop apps that send data to places I don't want them to.

I have grown weary of little snitch annoying me all the time but it was insightful about how much stuff Apple has me pinging by default: like yahoo.com for weather on boot just to name one.

This kind of angered me, I don’t want yahoo getting my ip anywhere I am in the world any time I turn on my computer. I think I found like 4-5 things that are baked into a clean Mac install these days that I took exception to and forbade.

Then Microsoft office and adobe are evil and constantly evading it and getting smacked down too.

Apple OSes maintain consistent connections to APNS (apple push notification service) using hardware-linked certificates, exposing your unique system and IP address (and thus city-level location) to Apple at all times.

The best feature is the map which shows the locations of all the connection attempts.

You can quickly spot anomalous connections to countries/servers, and locate the specific process doing this.

I found a daemon left over from an uninstalled app which was attempting to connect to its mother ship in China. Very strange.

I mean renting us-east servers is not hard if you’re trying to conceal what you’re trying to do

Sure is nice for spotting the low hanging fruit though.

What exactly does one learn from this normally? A leftover daemon is a bit of an edge case, and you could have learnt the same from looking at Activity Monitor, seeing a permissions pop-up, noticing higher energy use, etc, but learning that software connects to China seems... fine? Unless one wants to classify all connections to China as by-definition bad, which is discrimination that I don't want to engage in personally.

A bad actor can conceal whatever they want by renting a server anywhere they like. Meanwhile, there are many legit reasons why software might connect to China – maybe the company hosts services on Alibaba Cloud, maybe the software is from a Chinese producer and they chose local hosting.

To me, the map is mostly fear-mongering.

You obviously know more about macOS internals than most people.

I don’t know how to monitor energy use, and if I have time, I will look it up.

For me, one app which not only notifies, also shows me where its connecting is a big advantage.

>I don't want to partially break the software I do run by nit picking what connections it can make as that wouldn't improve my experience and would most likely cause issues.

Partially breaking web pages by blocking all connections to ad servers does wonders for my experience.

I did exaggerate a bit. Many users don’t care about where their connections are going and many users have only limited set of apps.

I wouldn’t mind like to correct myself and say “essential for me”. So many times I caught up software going to places where it should not go. On top of that I often do local development without containers (guilty) and any random npm package can be compromised any time.

The issues it causes are for nosy devs, not for the end user, generally speaking.

If I had a penny for every time I've blocked a tracker and broken critical functionality in an app or on a website because of it, I'd be rich.

I'm sad that that's the case, but in almost all circumstances, the relatively minor tracking of my email signing up for a service going into some advertising ROI calculation is outweighed by the fact I get to use that service.

Reply on news.ycombinator.com