5 ms·

I'm starting to think I need to worry about things getting out of my firewall more than things getting in.

justThis1Post 11y ago
Couldn't agree more. These days we have to protect ourselves more from our own software than from viruses. Assume any software is a trojan horse, even the OS.
- Paul_S 11y ago
  Or you could use free software.
  - mucker 11y ago
    How, pray tell, does free change the problem except in fantasies? There is plenty of "free" software that contains the same problem.
    - rbanffy 11y ago
      At least, with those, you can audit the code and have someone fix it. No such luck with proprietary software.
    - mackal 11y ago
      Free as in freedom, not beer. You can look at the code of the free software, therefore tell if it's phoning home or not. More importantly, changing it.
      - anigbrowl 11y ago
        How many people have the time or inclination to validate everything that way?
        dripton 11y ago
        Not many, but the effort is parallelizable. If you find a security problem and report it in public, others can verify it, and still others can benefit from the fix even if they never would have bothered to look for themselves.
        creshal 11y ago
        It doesn't take many. The problem is making sure that someone is doing it (cf., OpenSSL).
      - morganvachon 11y ago
        Exactly. This is how the Google Chromium always-on voice recognition payload was discovered, for example. We may never have known about it if it wasn't an open source project, or at least we wouldn't have heard about it until long after it shipped.
  - justThis1Post 11y ago
    Not a guarantee of privacy or anonymity. See: SourceForge. Generally a step in the right direction though.
    - rbanffy 11y ago
      Many software projects I use are hosted on SourceForge. While SF has been using some nasty techniques with binary installers, the source code is, as far as I know, untouched. And, as soon as it's touched, the project maintainers can shut down the SourceForge repos and move on to someplace else. It's not a guarantee of security, privacy or anonymity, but open source is still your best chance to get any (or all) of the three.
    - deleted 11y ago
      [deleted]
  - deleted 11y ago
    [deleted]
  - wl 11y ago
    Counterexample: Ubuntu sending local file system searches off to Amazon because apparently online shopping and file searching are things you want to do simultaneously.
    - RexRollman 11y ago
      Which is why being open source is not enough. It needs to be non-commercial.
    - thejosh 11y ago
      Which you can fix by either using another distro/uninstalling it/disabling it/using another window manager.
    - foiboitoi 11y ago
      The main difference between Ubuntu and Windows 10 is that Ubuntu will respect your decision to opt-out.
      - mosselman 11y ago
        "Your information is ours unless you are aware of it and spend unreasonable amount of time searching for the information leaking settings and disabling them." Yaay
        awalGarg 11y ago
        This is incorrect. Ubuntu told me in clear words that dash searches will be sent after installation when I used dash. That's how I came to know of it, and that's why I disabled it. I didn't like the fact that that it is opt-out and not opt-in, but yeah, way way better than Windows 10 for now. Also note that Canonical took steps to ensure amazon doesn't get to imprint your system by proxying the requests through their server.
gnufrra 11y ago
On my Mac I use Little Snitch to monitor outbound connections and I love it. I haven't found an equivalent simple and lightweight application for Windows yet.
- Gracana 11y ago
  Oh man, I am racking my brain trying to think of the tool I used to have installed on my PC at my last job. It was built by somebody who posted on HN, lightsomething or something? It would warn you about new programs connecting to the network and do other neat stuff. Not quite the same as little snitch, but similar and very pleasant to use. I'll update if I think of it (or maybe somebody else can name it.) [edit] Glasswire! https://www.glasswire.com/ https://www.glasswire.com/ It's super slick. Apparently the paid version has an "ask to connect" feature.
  - mrschwabe 11y ago
    Is there an open source alternative/equivalent, preferably runs on Linux?
    - SSLy 11y ago
      Just iptables.
    - Yuioup 11y ago
      Pretty much every distro on earth comes with a firewall package which you can install and configure.
  - dhimes 11y ago
    eghad recommended glasswire to me yesterday as a "solid" alternative.
  - gnufrra 11y ago
    Thanks, This looks interesting I will definitely give this a try.
- jack_straw 11y ago
Silhouette 11y ago
You absolutely should be concerned about things getting out as much as things getting in. Things getting in can damage your data, but that is what back-ups are for. On the other hand, things getting out can leak your data, which is likely to be a one-way trip and, depending on the type of data, potentially a very expensive one. Of course things getting in can also interfere with your device's normal operation, and in the brave new world of always-online systems and reprogrammable everything, if your system does get compromised today it may be extremely difficult to reliably clean it. The days of booting from a operating system's install CD and reformatting as a reliable recovery mechanism have long passed. This is not a good thing.

Couldn't agree more. These days we have to protect ourselves more from our own software than from viruses. Assume any software is a trojan horse, even the OS.

Paul_S 11y ago
Or you could use free software.
- mucker 11y ago
  How, pray tell, does free change the problem except in fantasies? There is plenty of "free" software that contains the same problem.
  - rbanffy 11y ago
    At least, with those, you can audit the code and have someone fix it. No such luck with proprietary software.
  - mackal 11y ago
    Free as in freedom, not beer. You can look at the code of the free software, therefore tell if it's phoning home or not. More importantly, changing it.
    - anigbrowl 11y ago
      How many people have the time or inclination to validate everything that way?
      - dripton 11y ago
        Not many, but the effort is parallelizable. If you find a security problem and report it in public, others can verify it, and still others can benefit from the fix even if they never would have bothered to look for themselves.
      - creshal 11y ago
        It doesn't take many. The problem is making sure that someone is doing it (cf., OpenSSL).
    - morganvachon 11y ago
      Exactly. This is how the Google Chromium always-on voice recognition payload was discovered, for example. We may never have known about it if it wasn't an open source project, or at least we wouldn't have heard about it until long after it shipped.
- justThis1Post 11y ago
  Not a guarantee of privacy or anonymity. See: SourceForge. Generally a step in the right direction though.
  - rbanffy 11y ago
    Many software projects I use are hosted on SourceForge. While SF has been using some nasty techniques with binary installers, the source code is, as far as I know, untouched. And, as soon as it's touched, the project maintainers can shut down the SourceForge repos and move on to someplace else. It's not a guarantee of security, privacy or anonymity, but open source is still your best chance to get any (or all) of the three.
  - deleted 11y ago
    [deleted]
- deleted 11y ago
  [deleted]
- wl 11y ago
  Counterexample: Ubuntu sending local file system searches off to Amazon because apparently online shopping and file searching are things you want to do simultaneously.
  - RexRollman 11y ago
    Which is why being open source is not enough. It needs to be non-commercial.
  - thejosh 11y ago
    Which you can fix by either using another distro/uninstalling it/disabling it/using another window manager.
  - foiboitoi 11y ago
    The main difference between Ubuntu and Windows 10 is that Ubuntu will respect your decision to opt-out.
    - mosselman 11y ago
      "Your information is ours unless you are aware of it and spend unreasonable amount of time searching for the information leaking settings and disabling them." Yaay
      - awalGarg 11y ago
        This is incorrect. Ubuntu told me in clear words that dash searches will be sent after installation when I used dash. That's how I came to know of it, and that's why I disabled it. I didn't like the fact that that it is opt-out and not opt-in, but yeah, way way better than Windows 10 for now. Also note that Canonical took steps to ensure amazon doesn't get to imprint your system by proxying the requests through their server.

gnufrra 11y ago

On my Mac I use Little Snitch to monitor outbound connections and I love it. I haven't found an equivalent simple and lightweight application for Windows yet.

Gracana 11y ago
Oh man, I am racking my brain trying to think of the tool I used to have installed on my PC at my last job. It was built by somebody who posted on HN, lightsomething or something? It would warn you about new programs connecting to the network and do other neat stuff. Not quite the same as little snitch, but similar and very pleasant to use. I'll update if I think of it (or maybe somebody else can name it.) [edit] Glasswire! https://www.glasswire.com/ https://www.glasswire.com/ It's super slick. Apparently the paid version has an "ask to connect" feature.
- mrschwabe 11y ago
  Is there an open source alternative/equivalent, preferably runs on Linux?
  - SSLy 11y ago
    Just iptables.
  - Yuioup 11y ago
    Pretty much every distro on earth comes with a firewall package which you can install and configure.
- dhimes 11y ago
  eghad recommended glasswire to me yesterday as a "solid" alternative.
- gnufrra 11y ago
  Thanks, This looks interesting I will definitely give this a try.
jack_straw 11y ago

Silhouette 11y ago

You absolutely should be concerned about things getting out as much as things getting in. Things getting in can damage your data, but that is what back-ups are for. On the other hand, things getting out can leak your data, which is likely to be a one-way trip and, depending on the type of data, potentially a very expensive one. Of course things getting in can also interfere with your device's normal operation, and in the brave new world of always-online systems and reprogrammable everything, if your system does get compromised today it may be extremely difficult to reliably clean it. The days of booting from a operating system's install CD and reformatting as a reliable recovery mechanism have long passed. This is not a good thing.