4 ms·

So, Little Snitch has lots to block because MacOS is proprietary and filled with proprietary software which would be inclined to track users for the goals of th

So, Little Snitch has lots to block because MacOS is proprietary and filled with proprietary software which would be inclined to track users for the goals of the developers (which are only sometimes aligned with the interests of users)… On GNU/Linux, is this much of an issue? Most programs seem to offer opt-in on metrics related stuff. If you assume OpenSnitch is set to match the opt-in settings whenever they are present, what sort of stuff is remaining to block at all? I.e. if people use this, what stuff are they seeing blocked?

fulafel 10y ago
Yes, desktop apps are quite bad at this. Browsers (FF & Chrome) and plugins, dev tools (Atom at least), distro tools etc call home by default. Then there's Steam games, and sandboxed or emulated apps many people run under Linux (like Windows, Android or Chrome web store apps). There are also popular bona fide proprietary desktop apps on Linux, like Skype, Spotify, etc. edit: Docker images also come to mind, they're quite black boxes.
- quadrangle 10y ago
  FF has opt-in to metrics (and I trust Mozilla to honestly anonymize anyway). I wouldn't trust OpenSnitch to stop all the deeply-integrated tracking in Chrome. Atom used to have analytics built-in by default, but they switched it to be opt-in (last I checked). I could certainly see using OpenSnitch if you let your system get infected with stuff like Steam games, Skype, or Spotify, sure… Thanks for the answers to my question.
  - fulafel 10y ago
    Nope, FF is opt-out. I just verified this by creating a new profile, the Health Report is enabled by default. I have a recollection that Atom had telemetry checked by default, but I'm not at a computer with Atom installed right now. There's also a big fight about it on the Atom issue tracker, but I can't be bothered to read through it. (https://github.com/atom/atom/issues/4966 https://github.com/atom/atom/issues/4966)
    - quadrangle 10y ago
      Okay, but regarding Atom, that thread stared in 2015, and all you had to do was hit END on your keyboard to see "At the current pace of development metrics should be disabled by default starting in Atom 1.11.0." as the last comment in the issue that is closed (or check current Atom behavior). Thanks for the note about FF opt-out, okay.
sasas 10y ago
Out of the box, Ubuntu doesn't behave well. [1] Let's not forget applications such as browser plugins. https://fixubuntu.com/ https://fixubuntu.com/ [1]
- quadrangle 10y ago
  I think that's all gone now, as of a year ago. http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feature-disabled-16-04 http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feat... But even so, that can be disabled via the stuff on that site.
  - annnnd 10y ago
    That's not the point. Sure, everything can be disabled - if you know there is something that should be disabled. Do you? I am 100% sure I don't. LittleSnitch notifies you about such activity and conveniently offers to block it. But it's the notifying part that makes the difference (which iptables can't do because of all the noise on common computer setup).
    - Karunamon 10y ago
      Mhh.. Little Snitch (and its alternatives like HandsOff!) is pretty damn chatty when you first set it up as well. Unless you have an encyclopedic knowledge of what each Apple daemon does, you don't have the ability to make an informed decision on whether it should be getting online or not.
    - quadrangle 10y ago
      Yeah, but what I'm getting at is basically: running LittleSnitch on MacOS makes it clear how much activity is happening. Surely OpenSnitch on GNU/Linux would do the same. But I would assume that some knowledgeable people would know about the extent of the difference generally. I suspect that MacOS programs are far more rampant in calling home, and the GNU/Linux stuff would mostly just be proprietary programs doing it. So, I was asking if people know about this stuff generally…
- deleted 10y ago
cyphar 10y ago
> On GNU/Linux, is this much of an issue? Even if you ignore the proprietary software side of things (which is an issue unfortunately), if an application is misconfigured or exploited then this is one way of detecting and blocking that. And sometimes there's some weirdness like VLC will sometimes make network requests to get album artwork even though I'm fairly sure I've disabled that feature. It's better to have a tool that screams about applications that are safe than it is to try to patch things up with configuration options in every app on your machine.
LinuxBender 10y ago
Right now, only a little bit. In the future, very likely. Systemd will eventually be functionally overloaded with network requests much like svchost.exe is (over)used on Microsoft Windows. That is just one example. This is also useful for folks to catch browser exploits that escape the sandboxes and make arbitrary connections to bypass privacy mechanisms such as Tor or other forms of proxies. i.e. dns leakage, tcp leakage via websockets, etc.. There are many other examples I could provide, but I have limited time right now to respond.

fulafel 10y ago

Yes, desktop apps are quite bad at this. Browsers (FF & Chrome) and plugins, dev tools (Atom at least), distro tools etc call home by default. Then there's Steam games, and sandboxed or emulated apps many people run under Linux (like Windows, Android or Chrome web store apps). There are also popular bona fide proprietary desktop apps on Linux, like Skype, Spotify, etc. edit: Docker images also come to mind, they're quite black boxes.

quadrangle 10y ago
FF has opt-in to metrics (and I trust Mozilla to honestly anonymize anyway). I wouldn't trust OpenSnitch to stop all the deeply-integrated tracking in Chrome. Atom used to have analytics built-in by default, but they switched it to be opt-in (last I checked). I could certainly see using OpenSnitch if you let your system get infected with stuff like Steam games, Skype, or Spotify, sure… Thanks for the answers to my question.
- fulafel 10y ago
  Nope, FF is opt-out. I just verified this by creating a new profile, the Health Report is enabled by default. I have a recollection that Atom had telemetry checked by default, but I'm not at a computer with Atom installed right now. There's also a big fight about it on the Atom issue tracker, but I can't be bothered to read through it. (https://github.com/atom/atom/issues/4966 https://github.com/atom/atom/issues/4966)
  - quadrangle 10y ago
    Okay, but regarding Atom, that thread stared in 2015, and all you had to do was hit END on your keyboard to see "At the current pace of development metrics should be disabled by default starting in Atom 1.11.0." as the last comment in the issue that is closed (or check current Atom behavior). Thanks for the note about FF opt-out, okay.

sasas 10y ago

Out of the box, Ubuntu doesn't behave well. [1] Let's not forget applications such as browser plugins. https://fixubuntu.com/ https://fixubuntu.com/ [1]

quadrangle 10y ago
I think that's all gone now, as of a year ago. http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feature-disabled-16-04 http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feat... But even so, that can be disabled via the stuff on that site.
- annnnd 10y ago
  That's not the point. Sure, everything can be disabled - if you know there is something that should be disabled. Do you? I am 100% sure I don't. LittleSnitch notifies you about such activity and conveniently offers to block it. But it's the notifying part that makes the difference (which iptables can't do because of all the noise on common computer setup).
  - Karunamon 10y ago
    Mhh.. Little Snitch (and its alternatives like HandsOff!) is pretty damn chatty when you first set it up as well. Unless you have an encyclopedic knowledge of what each Apple daemon does, you don't have the ability to make an informed decision on whether it should be getting online or not.
  - quadrangle 10y ago
    Yeah, but what I'm getting at is basically: running LittleSnitch on MacOS makes it clear how much activity is happening. Surely OpenSnitch on GNU/Linux would do the same. But I would assume that some knowledgeable people would know about the extent of the difference generally. I suspect that MacOS programs are far more rampant in calling home, and the GNU/Linux stuff would mostly just be proprietary programs doing it. So, I was asking if people know about this stuff generally…
deleted 10y ago

cyphar 10y ago

> On GNU/Linux, is this much of an issue? Even if you ignore the proprietary software side of things (which is an issue unfortunately), if an application is misconfigured or exploited then this is one way of detecting and blocking that. And sometimes there's some weirdness like VLC will sometimes make network requests to get album artwork even though I'm fairly sure I've disabled that feature. It's better to have a tool that screams about applications that are safe than it is to try to patch things up with configuration options in every app on your machine.

LinuxBender 10y ago

Right now, only a little bit. In the future, very likely. Systemd will eventually be functionally overloaded with network requests much like svchost.exe is (over)used on Microsoft Windows. That is just one example. This is also useful for folks to catch browser exploits that escape the sandboxes and make arbitrary connections to bypass privacy mechanisms such as Tor or other forms of proxies. i.e. dns leakage, tcp leakage via websockets, etc.. There are many other examples I could provide, but I have limited time right now to respond.