So excellent that some malware deletes itself if Little Snitch is even installed (https://www.f-secure.com/v-descs/trojan-downloader_osx_flash...). However, it's worth noting "DYLD_PRINT_TO_FILE" is a root exploit, which may circumvent or disable Little Snitch entirely if used by APT; Little Snitch may not see all network activity. In fact, a root exploit allows one to write malware completely hidden from userland altogether (lsof, ps, tcpdump, etc.) (https://github.com/hackedteam/driver-macos). It is truly scary how vulnerable OS X is at the moment.

As a Little Snitch user, I'm inclined to agree, but I find that I sometimes end up in a state of "WTF wants to use the network now?!" saturation.

My solution for that is to deny anything I don't recognize, and create rules for things I see more than twice, but if you're conditioned to click "OK" on everything you see, Little Snitch isn't going to to much for you...

I really wish Little Snitch could generate aggregate rules for apps. I keep having situations where an app starts making requests over and over until I realize that the developer is using https requests to cdn###.somehost.com where ### is apparently a dozen or more different hosts, and the only option I have is to just allow all https traffic rather than more granular by-host rules.

Although be aware that it can be quite daunting for a novice user. If you're installing for a friend or family member, you should go through all of this apps to whitelist requests and maybe teach them how to identify bad requests, but it's non-trivial. The UI doesn't interact very well with CDNs, for example, sometimes telling you that "App Store" is trying to access "arstechnica.com" because they use the same CDN provider.

Patrick Wardle dropped two Little Snitch bypasses at BlackHat [1] this year.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-W... [PDF Warning]

Our old infosec guy at work used the icefloor PF management tool at work. It seemed interesting, and I mention it in the vein of the venerable Little Snitch.

http://www.hanynet.com/icefloor/

I've used both, they're a good start, but any sophisticated rootkit will be able to work under the hood and these tools won't detect it. Also some malware functionality can be injected into legit processes that make use of the network and appear invisible to these filters eyes. http://www.arbingersys.com/osx-injection-override-tutorial-h...

If you really want to monitor what's going in&out of your computer you'll need to use wireshark from other computer in your network... =)

Does anyone know of anything like Little Snitch or ZoneAlarm for Linux? I miss the program-level firewall capabilities of these programs when I'm on Linux.

Does anyone know of a FOSS tool similar to littlesnitch?