4 ms·

Transmission is not an indie mac app, it's a cross platform open source program, free both as in free speech and free beer. Little Snitch is a malware vector,

by 4ad 8y ago

Transmission is not an indie mac app, it's a cross platform open source program, free both as in free speech and free beer. Little Snitch is a malware vector, pretty much like PC "antivirus" software.

CharlesW 8y ago
> Little Snitch is a malware vector, pretty much like PC "antivirus" software. Wait, what? I personally found it annoying and poorly designed to the point that I uninstalled it, but I'd like to see the receipts on "malware vector" please.
- nvr219 8y ago
  yeah malware vector is quite an accusation
walterbell 8y ago
> Little Snitch is a malware vector, pretty much like PC "antivirus" software. Is that because the Little Snitch network capture parser can be exploited by magic/malformed network packets to gain kernel privileges? Are there known exploits that were previously patched? Do you recommend any alternative Mac firewall which doesn't have this problem? Can the native firewall perform outbound packet filtering? Edit: https://www.sentinelone.com/blog/shut-snitch-reverse-engineering-exploiting-critical-little-snitch-vulnerability-reverse-engineering-mac-os-x/ https://www.sentinelone.com/blog/shut-snitch-reverse-enginee... (2016)
- pseudalopex 8y ago
  There was a local privilege escalation vulnerability in the kext[1] and another in the installer[2]. pf can filter outbound packets but not by application. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8661 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8661 [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2675 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2675
Wowfunhappy 8y ago
Transmission's native Windows port is relatively recent. There was technically an unofficial "qt" port before that one, but it was outdated and never felt great. Transmission was designed as a Mac-first program, and it really shows.
- Nullabillity 8y ago
  Transmission's Git repository only goes back to some time before 0.5 in 2005-10-26[0], but GTK support was added 2005-11-18[1], less than a month after the first commit. [0]: https://github.com/transmission/transmission/tree/a6aa88477617ee0c570a3229a220682338834165 https://github.com/transmission/transmission/tree/a6aa884776... [1]: https://github.com/transmission/transmission/tree/aad7bf22cbe85fc30ef7984de606de0df8dbb31e https://github.com/transmission/transmission/tree/aad7bf22cb...
  - Wowfunhappy 8y ago
    Yes, the Linux port has been around for forever. It's just... I don't know, every aspect of the UI has always really felt like it was built around the macOS design ethos first and foremost, with Linux tagging along for the ride.

by 4ad 8y ago

CharlesW 8y ago

> Little Snitch is a malware vector, pretty much like PC "antivirus" software. Wait, what? I personally found it annoying and poorly designed to the point that I uninstalled it, but I'd like to see the receipts on "malware vector" please.

nvr219 8y ago
yeah malware vector is quite an accusation

walterbell 8y ago

> Little Snitch is a malware vector, pretty much like PC "antivirus" software. Is that because the Little Snitch network capture parser can be exploited by magic/malformed network packets to gain kernel privileges? Are there known exploits that were previously patched? Do you recommend any alternative Mac firewall which doesn't have this problem? Can the native firewall perform outbound packet filtering? Edit: https://www.sentinelone.com/blog/shut-snitch-reverse-engineering-exploiting-critical-little-snitch-vulnerability-reverse-engineering-mac-os-x/ https://www.sentinelone.com/blog/shut-snitch-reverse-enginee... (2016)

pseudalopex 8y ago
There was a local privilege escalation vulnerability in the kext[1] and another in the installer[2]. pf can filter outbound packets but not by application. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8661 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8661 [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2675 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2675

Wowfunhappy 8y ago

Transmission's native Windows port is relatively recent. There was technically an unofficial "qt" port before that one, but it was outdated and never felt great. Transmission was designed as a Mac-first program, and it really shows.

Nullabillity 8y ago
Transmission's Git repository only goes back to some time before 0.5 in 2005-10-26[0], but GTK support was added 2005-11-18[1], less than a month after the first commit. [0]: https://github.com/transmission/transmission/tree/a6aa88477617ee0c570a3229a220682338834165 https://github.com/transmission/transmission/tree/a6aa884776... [1]: https://github.com/transmission/transmission/tree/aad7bf22cbe85fc30ef7984de606de0df8dbb31e https://github.com/transmission/transmission/tree/aad7bf22cb...
- Wowfunhappy 8y ago
  Yes, the Linux port has been around for forever. It's just... I don't know, every aspect of the UI has always really felt like it was built around the macOS design ethos first and foremost, with Linux tagging along for the ride.