3 ms·

I haven't used Little Snitch, but if it's a firewall then yes, this work is related to the eBPF work in Linux, which has been used for custom firewalls. There's

I haven't used Little Snitch, but if it's a firewall then yes, this work is related to the eBPF work in Linux, which has been used for custom firewalls. There's a lot of work in this space, so I don't know where best to start. One example is cilium: https://github.com/cilium/cilium https://github.com/cilium/cilium

LamaOfRuin 9y ago
Aha, that looks great. Yes, it's a firewall/network monitor, which monitors/controls network traffic tied to specific applications. That does appear to be the level 7 piece in cilium that, based on my naive reading of older attempts at Little Snitch-alike projects, was difficult, unreliable, and costly to do. Now I can confirm my excitement about these developments, even if I don't really understand them. :)
- rkeene2 9y ago
  A "Little Snitch"-like system for Linux would be pretty easy to develop without these changes as well. I've thought about building such a tool, but never really had the need or saw the point over my existing workflows. I did once (over 10 years ago now) develop a tool that would, upon receiving a packet from a new source, perform an OS fingerprint on it and if it turned out to be Microsoft Windows, block it once the fingerprinting process returned... :-) This tool actually just fired off a script (JIT compiled) for every packet that matched pre-defined criteria and that script could return a verdict on what to do with that packet, which could involve inspecting userspace connections trivially