Looks intriguing. A few questions:

(1) Are you planning on having support for more than 5 devices at a future point?

(2) Will you have any features to support parents protection of their children?

(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack?

(4) Have you considered a one-time unlimited buy-in level in lieu of monthly?

(5) Is this coming for iOS & MacOS?

Thanks for pushing the privacy front.

Thanks for your interest.

(1) Are you planning on having support for more than 5 devices at a future point?

5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users).

(2) Will you have any features to support parents protection of their children?

We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share!

(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack?

Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use.

(4) Have you considered a one-time unlimited buy-in level in lieu of monthly?

We had a couple lifetime plans on our Kickstarter (years ago). Right now, we don't have any plans for this. You can pay in advance though - up to 4 years.

(5) Is this coming for iOS & MacOS?

Yes. Or, at least we will attempt. Going to be "fun" if Apple continues their locking down strategy. Maybe the EU will force them to open up until then. Expect at least 1-2 years for this to land though.

Rather insightful on (2) with regard to:

    > ... we need to start protecting against the person in front of the device

My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original state, they won't touch it again. :o).

But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?

Yes. Good points.

Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast.

(I also think the original question was more about blocking features and the likes.)

Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.

>(1) Are you planning on having support for more than 5 devices at a future point?

>5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users).

I'd estimate for a family plan (my case) we'd have 5 users. Given that I am on HN and part of the technocrati collective we have a ton of devices, particularly once your iOS & Mac OS coverage kicks in too.

>(2) Will you have any features to support parents protection of their children?

>We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share!

I think it would be person in front of the device, but a NSFW filter list is the min requirement, sounds like you already meet that.

>(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack?

>Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use.

Aggregating logs across all devices protected. I don't know if syslog would be best, as there are options

Unified console for centralized control of all instances would be a stretch goal

Thanks for elaborating.

Shopping logs is easy technically, but what to put in there? Just mirror the logs from the local instance or just limit it to connections? Which format, what data?

We recently switched to an in-mem SQLite database for querying connections. In the future, we'd like to send the rows to a central instance of the user, with a UI for querying everything at once.

Also, creating setting templates for apps and enforcing certain settings on many devices is something that seems useful.

Note: This is all quite far out.

Congrats on releasing 1.0! It looks very cool. A few questions about Portmaster Unlimited and SPN:

1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it?

2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use.

3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?

Thanks!

1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it?

Everyone can join. We also plan to compensate in some way in the future. Docs: https://docs.safing.io/spn/hosting-a-community-node

2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use.

We rent servers. If you have the SPN, you can click on every server on the map and check where it is hosted. Currently mainly Hetzner, OVH, Katamera, HostHatch. We regularly try new providers, rent a couple servers and see how it goes.

3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?

The client "pins" destination domains/IPs to an exit for an hour (scoped per app) in order to get more stability here. We had issues in the past.

Congrats!

Just one question: In the past, postmaster had problems with WSL2.

I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b...

Is it fixed now?

We still don't have first-class support for VMs, but it will come.

Did you read the link?

Just add a PowerShell script at install time to exempt the virtual network interfaces from Windows Firewall if WSL is detected and the user agrees! It's super simple and easy.

Looks like a nice project! What library are you using for a front end here?

Angular with TailwindCSS.

Currently running in an electron instance, with the plan to switch (back) to a webview provided by the OS.

UI is served by the background process, so you can also open it in the browser at 127.0.0.1:817 - if you have development mode enabled.

Hi. After a quick look, I found that the codebase spread across several repos. e.g. safing/portmaster, safing/portmaster-ui and safing/portmaster-packaging.

I didn't found any guides regarding building from source. How can I build the app/installer by myself?

Yes, we definitely want to improve here.

The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension.

Can you elaborate on your use case?

[0] https://docs.safing.io/portmaster/architecture/update-system...

It is not about use cases.

Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time.

Is compiling locally not possible without the signing cert?

I understand.

Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions.

Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate.

As I said, this is an area where we need to improve.

Which versions of Windows do you support? Also what happens with the firewall that ships with Windows when you install Safing?

Q: Which versions of Windows do you support?

Windows 10+11 full. Windows 7+8 without desktop notifications.

Q: Also what happens with the firewall that ships with Windows when you install Safing?

Currently nothing. It stays there and active as it is.

Thanks for the answers.

Would you recommend to manually disable the Windows firewall?