News for hackers. Stuff that matters.

A comment on Little Snitch and the deprecation of kernel extensions. Parent comment

Re:Little Snitch and the deprecation of kernel extensions by jedberg on Tuesday March 24, 2020 @07:57PM (#22680395)
That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.
[ Parent | on HN ]
Re:Little Snitch and the deprecation of kernel extensions by jfkebwjsbx on Wednesday March 25, 2020 @07:47AM (#22683678)
No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.
[ Parent | on HN ]
Re:Little Snitch and the deprecation of kernel extensions by jedberg on Wednesday March 25, 2020 @02:40PM (#22687237)
I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host.

If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.

[ Parent | on HN ]
Re:Little Snitch and the deprecation of kernel extensions by jfkebwjsbx on Thursday March 26, 2020 @11:30AM (#22694509)
TIL. Thanks. Yes, for whitelisting it does not work.
[ Parent | on HN ]