Re:Little Snitch and the deprecation of kernel extensions
by malandrew on Tuesday March 24, 2020 @04:51PM
(#22678879)
Little Snitch definitely needs a social feature where you can crowdsource good rules from other people and see what rules are common within the communities for certain apps.
[ Parent
| on HN ]
Re:Little Snitch and the deprecation of kernel extensions
by jumarm on Tuesday March 24, 2020 @05:18PM
(#22679118)
While the social part is not there, the technology is.
I subscribe to rule groups through hostblocker.app, which pulls HOSTS files from different known websites and compile them into a .lsrules file which Little Snitch can use.
While I cannot vouch for the website's underlying code-I did not write it and I can not find an open source implementation-It only provides rules and I can edit any rule group to my liking after subscribing to it.
Re:Little Snitch and the deprecation of kernel extensions
by jedberg on Tuesday March 24, 2020 @07:57PM
(#22680395)
That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.
Re:Little Snitch and the deprecation of kernel extensions
by jfkebwjsbx on Wednesday March 25, 2020 @07:47AM
(#22683678)
No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.
Re:Little Snitch and the deprecation of kernel extensions
by jedberg on Wednesday March 25, 2020 @02:40PM
(#22687237)
I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host.
If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.
Re:Little Snitch and the deprecation of kernel extensions
by jfkebwjsbx on Thursday March 26, 2020 @11:30AM
(#22694509)
TIL. Thanks. Yes, for whitelisting it does not work.
Re:Little Snitch and the deprecation of kernel extensions
by capableweb on Tuesday March 24, 2020 @04:58PM
(#22678939)
Back when I was using OSX and Little Snitch, first user experience was horrible. I reinstalled OSX and installed Little Snitch first, and went to install app by app after running it, and got a slightly better experience. But, requires a reinstall of your OS (or maybe creating a new user will be enough)