Hacker News Reader

I'm not sure about the other commenter's intentions, but on desktop, I wish every program started in a restricted network namespace. Instead of blocking all incoming and outgoing connections by default, it would request user permission interactively and adjust access accordingly.

View on HN

On Linux you can do the next best thing which is to move out all the interfaces from the default network namespace and use iptables rules for it which block everything just in case.

Then you have to explicitly launch applications in a desired network namespace such as physical (eth0, wlan0 etc) or vpn (wg0).

Accidentally launched applications, or something like the desktop environment have no network connectivity.

opensnitch does this

Are you sure? Because last I checked OpenSnitch used different techniques from namespaces, that seemed more brittle to me.

I was referring to "request user permission interactively and adjust access accordingly"... it can do that. It uses eBPF though

Reply on news.ycombinator.com