10 ms·

Lockdown: Open-source firewall that blocks app tracking, ads, snooping

254 points by tilt 7y ago

kodablah 7y ago
Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?
- josteink 7y ago
  > With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.
  - winternett 7y ago
    It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/
    - rectang 7y ago
      It's a start. It's good that it's open source, but that's necessary not sufficient to establish trust for something which requires such significant privileges. You also want to be able to know who the authors are, to evaluate them for trustworthiness, and to evaluate their processes to see how well hardened they are against malicious contributions.
    - hosteur 7y ago
      > It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/ Camera and mic? How does it do this as a vpn? I see no requests for such things in iOS settings for the app.
      - winternett 7y ago
        It's an app you install on your phone. That app can use any service on the device if system permissions allow it, also, tracking and libraries or spyware can be embedded in the app itself which could potentially circumvent device security.
  - jangoolie 7y ago
    it uses the `NetworkExtension` framework to intercept all your communications and potentially modify them. https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension
- ignoramous 7y ago
  The source indicates that they check-in DNS blocklists as JSON files [0] and txt files (one of which has Facebook IPv4s) [1]. So, the updates to those would require app updates, I guess, unless there's OTA for the blocklists somewhere in the code that I missed. My experience with running client-side DNS based blockers are they consume additional battery and need a lot of RAM if you block with aggressive lists that have more than 1M+ domains. Besides, DNS based blockers can be circumvented by apps that do their own resolution over DoH or use clever techniques like CNAME cloaking [2]. Some nameservers such as the one run by Cloudflare flatten the CNAMES [3], effectively rendering even nextdns' solution ineffective [4]. I must also note that, Cloudflare does hide origin-IP if they are setup to reverse-proxy the traffic, which then would render IP based blocklists ineffective, too, unless Cloudflare's IPs are blocked, as well. The folks who build the lockdownhq apps are also the makers of https://confirmedvpn.com https://confirmedvpn.com. u/willstrafach's https://guardianapp.com https://guardianapp.com (VPN and ad-blocking), u/poitrus's https://nextdns.io https://nextdns.io (no VPN but imo the best DNS based content-blocker in the market today), and https://adguard.com https://adguard.com (cross platform all-in-one network security suite) are other comparable alternatives. Disclosure: I run a competing ad-blocking service. --- [0] https://github.com/confirmedcode/lockdown-ios/tree/master/Lockdown%20Blocker https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [1] https://github.com/confirmedcode/lockdown-ios/tree/master/LockdowniOS https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [2] https://trackingthetrackers.com/ https://trackingthetrackers.com/ [3] https://blog.cloudflare.com/introducing-cname-flattening-rfc-compliant-cnames-at-a-domains-root/ https://blog.cloudflare.com/introducing-cname-flattening-rfc... [4] https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...
  - clairity 7y ago
    > "The folks who build the lockdownhq apps are also the makers of ...[a bunch of other iOS apps]." are you saying the same group of subcontractors built them all? or that it's the same app repackaged multiple times? or something else? i use adguard on iOS and while i don't like the first-party exposure (to adguard itself), it's better than being completely naked in public to all sorts of shady actors (including telecom/wireless providers). or is it?
mongro1 7y ago
So pihole then.
- pfundstein 7y ago
  No.
- procinct 7y ago
  This is at the device level as opposed to network level of pihole.
egdod 7y ago
For an open source app distributed on the App Store, is there actually any way of verifying that what you get on your phone is the same as the source code you can read?
- rectang 7y ago
  Checksum of a binary package against checksum of a reproducible build?
  - egdod 7y ago
    How do you run a checksum of a binary you download to your phone?
- offmycloud 7y ago
  If Apple keeps pushing their Bitcode LLVM IR trans-compiling, along with magic App Store re-linking, they will kill the possibility of reproducible builds forever. In Apple's world, you are supposed to trust their app vetting process, not the source code on some website.
Perizors 7y ago
Seems to operate the same way adguard from mac/android does?
ropiwqefjnpoa 7y ago
It's functions similar to other mobile ad-blockers in that it can route all your phones traffic over a VPN tunnel it establishes. But the ad-blocking vpn server is 127.0.0.1, so perhaps, like it says all the blocking happens right on your phone. This is what I've been waiting for if this works. Still getting ads on instagram though.
- vageli 7y ago
  On Android, DNS66 does exactly this, available on F-Droid. https://f-droid.org/en/packages/org.jak_linux.dns66/ https://f-droid.org/en/packages/org.jak_linux.dns66/
  - flavor8 7y ago
    Blokada seems to be very similar to DNS66, and is more actively maintained. Any reason to prefer DNS66?
    - ignoramous 7y ago
      Blokada doesn't DoH or DoT the last time I checked, but they have added a wireguard-based paid VPN service, which is nice. Intra [0] can DoH (but no on-device custom blocklists) and Nebulo [1] can DoH and DoT (with on-device blocklists). Personally, I see better latencies with DoH. Ref: https://news.ycombinator.com/item?id=21598413 https://news.ycombinator.com/item?id=21598413 -- [0] https://getintra.org https://getintra.org + adguard-dns or nextdns [1] https://play.google.com/store/apps/details?id=com.frostnerd.smokescreen https://play.google.com/store/apps/details?id=com.frostnerd.... + adguard-dns or nextdns or hostfiles
      - dmix 7y ago
        For those unfamiliar with the acronyms. DoH = DNS over HTTPS DoT = DNS over TLS Very useful apps!
    - vageli 7y ago
      > Blokada seems to be very similar to DNS66, and is more actively maintained. Any reason to prefer DNS66? No, I've never heard of blokada. Thanks for the tip.
whalesalad 7y ago
Looks like the core of this is done via https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension some cool stuff here: - Content Filter Providers: https://developer.apple.com/documentation/networkextension/content_filter_providers https://developer.apple.com/documentation/networkextension/c... - DNS Proxy Provider: https://developer.apple.com/documentation/networkextension/dns_proxy_provider https://developer.apple.com/documentation/networkextension/d...
- twodayslate 7y ago
  This application is not using either of those APIs (Content Filter or DNS Proxy). > Content filter providers are only supported on supervised iOS devices. > DNS proxy providers are only supported on supervised iOS devices.
pgl 7y ago
It's "open source", but there's only been 5 commits since August last year? Where do the updates to blocking rules etc come from? Also, the homepage states "Over 1 Billion Trackers Blocked", but that really feels misleading. I'd say Guardian Firewall is a much better choice: https://twitter.com/guardianiosapp https://twitter.com/guardianiosapp
- eugeniub 7y ago
  $10/month is a lot for a firewall.
  - criddell 7y ago
    If you use a pay-as-you-go network like Google Fi, and it saves you more than 1 GB, then it saves you money.
    - OJFord 7y ago
      $10 for 1GB?!
      - Spivak 7y ago
        $10/GB is pretty much the going rate for a la carte data on all major US carriers. You typically get better rates for your monthly plan but if you go over you're flipped back to the a la carte pricing.
        OJFord 7y ago
        Eesh. My monthly plan in the UK is about $10 (£7), for 2GB, unlimited texts, 500 calls. I suppose an Indian commenter would 'Eesh' at that too though!
  - willstrafach 7y ago
    Important to note, our app is a VPN as well. This way, with the bulk of our business logic on the server-side, device battery is saved and we can do real-time block list updates rather than the app needing to pull down a new rule set. The $1/day / $10/month / $100/year has been fairly well received, but may not be for everyone, especially those who enjoy running their own VPN server and/or curating their own block lists.
StopHammoTime 7y ago
I did a test of this. uBlock Origin blocked all the calls before it made it to the firewall. IMO why would you use anything else.
- rcMgD2BwE72F 7y ago
  Apps.
- newscracker 7y ago
  There is no uBlock Origin for iOS, and never will be because of Apple’s list based content blocking mechanism where the blocker doesn’t intercept and process requests. It just provides the block list to Safari, which is also the only rendering engine (that can be) used by every browser on iOS.
rubyfan 7y ago
Wish I could use this AND 1.1.1.1 Warp. iPhone doesn’t seem to be able to do both.
- newscracker 7y ago
  That was my observation too. They’re both classified as the same class of “VPN” services. So you’d have to choose one or the other. Other VPN apps and services, such as ProtonVPN and Guardian Firewall, can be enabled while using 1.1.1.1 or DNSCloak.
mrtweetyhack 7y ago
AMD willing gives it to China
throwaway3157 7y ago
I use Firefox Focus and this looks similar for mobile (though they add MacOS too). Has anyone evaluated the difference?
- twodayslate 7y ago
  Firefox Focus does not block ads the same was as Lockdown does. Lockdown uses the [Packet Tunnel Provider](https://developer.apple.com/documentation/networkextension/packet_tunnel_provider https://developer.apple.com/documentation/networkextension/p...) API which has the added benefit of "protecting" the entire device (not just your browser).
mirimir 7y ago
Does Apple ban apps that interfere with other apps? Or is it Google that does that?
GeoffIsTheBest 7y ago
As a pihole user for years I recently bought a firewalla blue. Installed pihole on the firewalla, turned off firewalla ad blocking, and done. I can VPN to my home ad blocking network from anywhere, have more insights into my home network shenanigans, and still use my personal block list built over years. Super easy and most importantly, done.
- newscracker 7y ago
  Did you research if the Pi could be setup with additional software (apart from pi-hole) to handle all that (or most of what) the Firewalla provides? Seems like that’d be a lot cheaper if one doesn’t need very high network performance.
- pbhjpbhj 7y ago
  I'm not sure I get it? Why not run OpenVPN on your pihole's RPi, forward the port on your router, bingo-bango-bongo?? What extra are you getting with the firewalla? Is it 'just' ease of administration (which is probably worth the price!)?
WarOnPrivacy 7y ago
Headline might want to note IT'S MAC ONLY
rudedogg 7y ago
I gave this a try on macOS, but I still see all the ads I'm used to. It looks like the block lists are really short (https://github.com/confirmedcode/Lockdown-Mac/tree/master/Block%20Lists https://github.com/confirmedcode/Lockdown-Mac/tree/master/Bl...).
Fnoord 7y ago
On macOS, we got a port of OpenBSD pf (probably not up to date though). I've been able to convert hosts files to OpenBSD pf format in, when was it, 2002? What you'd need to do is create an anchor. Perhaps there's a GUI for it as well for those who prefer. There's at least pfBlockerNG which basically does that for PfSense. [1] FWIW, all of this existed before Pi-Hole (or Raspberry Pi for that matter). IIRC there was also a converter script for hosts files to IPTables rules. Is it possible to import such rules to Little Snitch? That's the go to firewall on macOS, though it is proprietary. There's also LuLu, a FOSS firewall for macOS. [2] Now, from my memory, these block lists did cost quite some memory on a machine with 512 MB RAM. Even though it'd do dedup. What one could also do is build up a VPN with a remote server (in the cloud, or at home) and use say use WireGuard to have a secure connection while using a remote DNS on the VPN to get ads blocked. [1] https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/ https://www.linuxincluded.com/block-ads-malvertising-on-pfse... [2] https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
- salzig 7y ago
  On the product page[1] of little snitch you‘ll find a mention of a „blocklist“ feature. [1] https://www.obdev.at/en/products/littlesnitch/index.html https://www.obdev.at/en/products/littlesnitch/index.html
  - Fnoord 7y ago
    Sweet, it was added in 4.1. Thanks for the heads up! I found this list (by Peter Lowe) for Little Snitch [1]. There's also a shell script to convert to Little Snitch rules [2] [1] https://pgl.yoyo.org/adservers/serverlist.php?hostformat=littlesnitch-rule-group-subscriptions&mimetype=plaintext https://pgl.yoyo.org/adservers/serverlist.php?hostformat=lit... [2] https://gist.github.com/SethCalkins/1ac3bee593b37067b489cd6e275b60ff https://gist.github.com/SethCalkins/1ac3bee593b37067b489cd6e...
Bellamy 7y ago
Block this! For Android. https://block-this.com/ https://block-this.com/
newscracker 7y ago
Unfortunately, the Mac version requires 10.15 (Catalina) or later. I won't be touching that for quite sometime to come.
DavideNL 7y ago
The unfortunate truth is, Apple does not allow us to use a firewall on iOS. This is a DNS-sinkhole, which can be easily circumvented by apps (for example by using hard coded IPs.) I would say it's rather dishonest to state your app is a Firewall on the front page, when in fact it is not.

254 points by tilt 7y ago

Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?

josteink 7y ago
> With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.
- winternett 7y ago
  It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/
  - rectang 7y ago
    It's a start. It's good that it's open source, but that's necessary not sufficient to establish trust for something which requires such significant privileges. You also want to be able to know who the authors are, to evaluate them for trustworthiness, and to evaluate their processes to see how well hardened they are against malicious contributions.
  - hosteur 7y ago
    > It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/ Camera and mic? How does it do this as a vpn? I see no requests for such things in iOS settings for the app.
    - winternett 7y ago
      It's an app you install on your phone. That app can use any service on the device if system permissions allow it, also, tracking and libraries or spyware can be embedded in the app itself which could potentially circumvent device security.
- jangoolie 7y ago
  it uses the `NetworkExtension` framework to intercept all your communications and potentially modify them. https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension
ignoramous 7y ago
The source indicates that they check-in DNS blocklists as JSON files [0] and txt files (one of which has Facebook IPv4s) [1]. So, the updates to those would require app updates, I guess, unless there's OTA for the blocklists somewhere in the code that I missed. My experience with running client-side DNS based blockers are they consume additional battery and need a lot of RAM if you block with aggressive lists that have more than 1M+ domains. Besides, DNS based blockers can be circumvented by apps that do their own resolution over DoH or use clever techniques like CNAME cloaking [2]. Some nameservers such as the one run by Cloudflare flatten the CNAMES [3], effectively rendering even nextdns' solution ineffective [4]. I must also note that, Cloudflare does hide origin-IP if they are setup to reverse-proxy the traffic, which then would render IP based blocklists ineffective, too, unless Cloudflare's IPs are blocked, as well. The folks who build the lockdownhq apps are also the makers of https://confirmedvpn.com https://confirmedvpn.com. u/willstrafach's https://guardianapp.com https://guardianapp.com (VPN and ad-blocking), u/poitrus's https://nextdns.io https://nextdns.io (no VPN but imo the best DNS based content-blocker in the market today), and https://adguard.com https://adguard.com (cross platform all-in-one network security suite) are other comparable alternatives. Disclosure: I run a competing ad-blocking service. --- [0] https://github.com/confirmedcode/lockdown-ios/tree/master/Lockdown%20Blocker https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [1] https://github.com/confirmedcode/lockdown-ios/tree/master/LockdowniOS https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [2] https://trackingthetrackers.com/ https://trackingthetrackers.com/ [3] https://blog.cloudflare.com/introducing-cname-flattening-rfc-compliant-cnames-at-a-domains-root/ https://blog.cloudflare.com/introducing-cname-flattening-rfc... [4] https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...
- clairity 7y ago
  > "The folks who build the lockdownhq apps are also the makers of ...[a bunch of other iOS apps]." are you saying the same group of subcontractors built them all? or that it's the same app repackaged multiple times? or something else? i use adguard on iOS and while i don't like the first-party exposure (to adguard itself), it's better than being completely naked in public to all sorts of shady actors (including telecom/wireless providers). or is it?

mongro1 7y ago

So pihole then.

pfundstein 7y ago
No.
procinct 7y ago
This is at the device level as opposed to network level of pihole.

egdod 7y ago

For an open source app distributed on the App Store, is there actually any way of verifying that what you get on your phone is the same as the source code you can read?

rectang 7y ago
Checksum of a binary package against checksum of a reproducible build?
- egdod 7y ago
  How do you run a checksum of a binary you download to your phone?
offmycloud 7y ago
If Apple keeps pushing their Bitcode LLVM IR trans-compiling, along with magic App Store re-linking, they will kill the possibility of reproducible builds forever. In Apple's world, you are supposed to trust their app vetting process, not the source code on some website.

Perizors 7y ago

Seems to operate the same way adguard from mac/android does?

ropiwqefjnpoa 7y ago

It's functions similar to other mobile ad-blockers in that it can route all your phones traffic over a VPN tunnel it establishes. But the ad-blocking vpn server is 127.0.0.1, so perhaps, like it says all the blocking happens right on your phone. This is what I've been waiting for if this works. Still getting ads on instagram though.

vageli 7y ago
On Android, DNS66 does exactly this, available on F-Droid. https://f-droid.org/en/packages/org.jak_linux.dns66/ https://f-droid.org/en/packages/org.jak_linux.dns66/
- flavor8 7y ago
  Blokada seems to be very similar to DNS66, and is more actively maintained. Any reason to prefer DNS66?
  - ignoramous 7y ago
    Blokada doesn't DoH or DoT the last time I checked, but they have added a wireguard-based paid VPN service, which is nice. Intra [0] can DoH (but no on-device custom blocklists) and Nebulo [1] can DoH and DoT (with on-device blocklists). Personally, I see better latencies with DoH. Ref: https://news.ycombinator.com/item?id=21598413 https://news.ycombinator.com/item?id=21598413 -- [0] https://getintra.org https://getintra.org + adguard-dns or nextdns [1] https://play.google.com/store/apps/details?id=com.frostnerd.smokescreen https://play.google.com/store/apps/details?id=com.frostnerd.... + adguard-dns or nextdns or hostfiles
    - dmix 7y ago
      For those unfamiliar with the acronyms. DoH = DNS over HTTPS DoT = DNS over TLS Very useful apps!
  - vageli 7y ago
    > Blokada seems to be very similar to DNS66, and is more actively maintained. Any reason to prefer DNS66? No, I've never heard of blokada. Thanks for the tip.

whalesalad 7y ago

Looks like the core of this is done via https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension some cool stuff here: - Content Filter Providers: https://developer.apple.com/documentation/networkextension/content_filter_providers https://developer.apple.com/documentation/networkextension/c... - DNS Proxy Provider: https://developer.apple.com/documentation/networkextension/dns_proxy_provider https://developer.apple.com/documentation/networkextension/d...

twodayslate 7y ago
This application is not using either of those APIs (Content Filter or DNS Proxy). > Content filter providers are only supported on supervised iOS devices. > DNS proxy providers are only supported on supervised iOS devices.

pgl 7y ago

It's "open source", but there's only been 5 commits since August last year? Where do the updates to blocking rules etc come from? Also, the homepage states "Over 1 Billion Trackers Blocked", but that really feels misleading. I'd say Guardian Firewall is a much better choice: https://twitter.com/guardianiosapp https://twitter.com/guardianiosapp

eugeniub 7y ago
$10/month is a lot for a firewall.
- criddell 7y ago
  If you use a pay-as-you-go network like Google Fi, and it saves you more than 1 GB, then it saves you money.
  - OJFord 7y ago
    $10 for 1GB?!
    - Spivak 7y ago
      $10/GB is pretty much the going rate for a la carte data on all major US carriers. You typically get better rates for your monthly plan but if you go over you're flipped back to the a la carte pricing.
      - OJFord 7y ago
        Eesh. My monthly plan in the UK is about $10 (£7), for 2GB, unlimited texts, 500 calls. I suppose an Indian commenter would 'Eesh' at that too though!
- willstrafach 7y ago
  Important to note, our app is a VPN as well. This way, with the bulk of our business logic on the server-side, device battery is saved and we can do real-time block list updates rather than the app needing to pull down a new rule set. The $1/day / $10/month / $100/year has been fairly well received, but may not be for everyone, especially those who enjoy running their own VPN server and/or curating their own block lists.

StopHammoTime 7y ago

I did a test of this. uBlock Origin blocked all the calls before it made it to the firewall. IMO why would you use anything else.

rcMgD2BwE72F 7y ago
Apps.
newscracker 7y ago
There is no uBlock Origin for iOS, and never will be because of Apple’s list based content blocking mechanism where the blocker doesn’t intercept and process requests. It just provides the block list to Safari, which is also the only rendering engine (that can be) used by every browser on iOS.

rubyfan 7y ago

Wish I could use this AND 1.1.1.1 Warp. iPhone doesn’t seem to be able to do both.

newscracker 7y ago
That was my observation too. They’re both classified as the same class of “VPN” services. So you’d have to choose one or the other. Other VPN apps and services, such as ProtonVPN and Guardian Firewall, can be enabled while using 1.1.1.1 or DNSCloak.

mrtweetyhack 7y ago

AMD willing gives it to China

throwaway3157 7y ago

I use Firefox Focus and this looks similar for mobile (though they add MacOS too). Has anyone evaluated the difference?

twodayslate 7y ago
Firefox Focus does not block ads the same was as Lockdown does. Lockdown uses the [Packet Tunnel Provider](https://developer.apple.com/documentation/networkextension/packet_tunnel_provider https://developer.apple.com/documentation/networkextension/p...) API which has the added benefit of "protecting" the entire device (not just your browser).

mirimir 7y ago

Does Apple ban apps that interfere with other apps? Or is it Google that does that?

GeoffIsTheBest 7y ago

As a pihole user for years I recently bought a firewalla blue. Installed pihole on the firewalla, turned off firewalla ad blocking, and done. I can VPN to my home ad blocking network from anywhere, have more insights into my home network shenanigans, and still use my personal block list built over years. Super easy and most importantly, done.

newscracker 7y ago
Did you research if the Pi could be setup with additional software (apart from pi-hole) to handle all that (or most of what) the Firewalla provides? Seems like that’d be a lot cheaper if one doesn’t need very high network performance.
pbhjpbhj 7y ago
I'm not sure I get it? Why not run OpenVPN on your pihole's RPi, forward the port on your router, bingo-bango-bongo?? What extra are you getting with the firewalla? Is it 'just' ease of administration (which is probably worth the price!)?

WarOnPrivacy 7y ago

Headline might want to note IT'S MAC ONLY

rudedogg 7y ago

I gave this a try on macOS, but I still see all the ads I'm used to. It looks like the block lists are really short (https://github.com/confirmedcode/Lockdown-Mac/tree/master/Block%20Lists https://github.com/confirmedcode/Lockdown-Mac/tree/master/Bl...).

Fnoord 7y ago

On macOS, we got a port of OpenBSD pf (probably not up to date though). I've been able to convert hosts files to OpenBSD pf format in, when was it, 2002? What you'd need to do is create an anchor. Perhaps there's a GUI for it as well for those who prefer. There's at least pfBlockerNG which basically does that for PfSense. [1] FWIW, all of this existed before Pi-Hole (or Raspberry Pi for that matter). IIRC there was also a converter script for hosts files to IPTables rules. Is it possible to import such rules to Little Snitch? That's the go to firewall on macOS, though it is proprietary. There's also LuLu, a FOSS firewall for macOS. [2] Now, from my memory, these block lists did cost quite some memory on a machine with 512 MB RAM. Even though it'd do dedup. What one could also do is build up a VPN with a remote server (in the cloud, or at home) and use say use WireGuard to have a secure connection while using a remote DNS on the VPN to get ads blocked. [1] https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/ https://www.linuxincluded.com/block-ads-malvertising-on-pfse... [2] https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu

salzig 7y ago
On the product page[1] of little snitch you‘ll find a mention of a „blocklist“ feature. [1] https://www.obdev.at/en/products/littlesnitch/index.html https://www.obdev.at/en/products/littlesnitch/index.html
- Fnoord 7y ago
  Sweet, it was added in 4.1. Thanks for the heads up! I found this list (by Peter Lowe) for Little Snitch [1]. There's also a shell script to convert to Little Snitch rules [2] [1] https://pgl.yoyo.org/adservers/serverlist.php?hostformat=littlesnitch-rule-group-subscriptions&mimetype=plaintext https://pgl.yoyo.org/adservers/serverlist.php?hostformat=lit... [2] https://gist.github.com/SethCalkins/1ac3bee593b37067b489cd6e275b60ff https://gist.github.com/SethCalkins/1ac3bee593b37067b489cd6e...

Bellamy 7y ago

Block this! For Android. https://block-this.com/ https://block-this.com/

newscracker 7y ago

Unfortunately, the Mac version requires 10.15 (Catalina) or later. I won't be touching that for quite sometime to come.

DavideNL 7y ago

The unfortunate truth is, Apple does not allow us to use a firewall on iOS. This is a DNS-sinkhole, which can be easily circumvented by apps (for example by using hard coded IPs.) I would say it's rather dishonest to state your app is a Firewall on the front page, when in fact it is not.