15 ms·

Little Snitch and the deprecation of kernel extensions

339 points by guessmyname 7y ago

shanemhansen 7y ago
It's interesting to compare and contrast community reactions to apple vs google policies, as well as how the companies interface with popular software. Google changes extension model for Chrome, breaking ad blockers, reaction seems to be that it's an obvious power grab. Apple changes extension model, breaking network blocker, reaction seems to be favorable.
- saagarjha 7y ago
  > Google changes extension model for Chrome, breaking ad blockers, reaction seems to be that it's an obvious power grab. Interestingly, Apple made this exact change in Safari first.
  - leokennis 7y ago
    And were shouted at for it.
    - saagarjha 7y ago
      Not really.
  - IAmEveryone 7y ago
    - They have a replacement API and, per the article, are working with the developer to make it a smooth transition. - there isn’t an obvious motive to handicap third-party developers here (applies to Safari adblocking as well) - the stated motive of increased security and stability is entirely plausible FWIW I tend towards assuming good faith in the case of Chrome as well. If we accept the reason given for Safari (because plausible & no obvious other, see above), it wouldn’t make much sense not to see the exact same motivation to be sufficient for Chrome. I’m not sure if Google having another, less user-friendly additional reason should make much of a difference. It’s only if the specifics around the alternative APIs diverge that Google’s ad business might become relevant again.
- tjoff 7y ago
  Maybe because it is not comparable?
greendave 7y ago
Apple has really done a 180 degree turn from back in the early OS X days, when they actually did quite a bit of work to keep existing applications functional. Forget binary compatibility, now even existing APIs are disappearing left and right.
- bognition 7y ago
  That makes sense right though. 15 years ago the number of people using OSX was a fraction of what it is today. They had to be very protective of that customer base. Now the install base is huge and the threats are different.
  - outworlder 7y ago
    > Now the install base is huge and the threats are different. Counterpoint: Microsoft's install base is enormous and has been for decades. They very very rarely intentionally break backwards compatibility.
    - viscanti 7y ago
      Counterpoint: Microsoft's obsession with backward compatibility is why there are so many zero day exploits for their OS. Complexity comes with a cost.
      - bshacklett 7y ago
        One doesn't even have to look that far. They haven't shipped a Windows update on time for years due to bugs pushing the dates back. I can't imagine that their backwards compatibility requirements have been part of the problem. In fact, wasn't there a specific issue that was linked back to compatibility with CP/M not that long ago? Edit: This is what I was thinking of: https://www.itnews.com.au/news/how-a-1974-bug-still-bites-win10-and-azure-users-515102 https://www.itnews.com.au/news/how-a-1974-bug-still-bites-wi...
      - jfkebwjsbx 7y ago
        That is not a counterpoint, just a downside (which can be offset taking several approaches). I would like to see a comparison between recent versions of macOS and Windows 10.
jiripospisil 7y ago
This is good news. Moving to the Network Extension framework means that Little Snitch's filtering will run entirely in user space, which is not only great for security but it will also allow the code to be written in a higher level language such as Swift.
- CameronNemo 7y ago
  What if that has an impact on performance? Kernel-user space communication usually means copying data into different portions of memory, plus a context switch.
  - ancarda 7y ago
    We shouldn't ever trade security for performance. Doing that is how Microsoft ended up putting shit like font rendering into the kernel. Made Windows very fast, but made it so much worse when a bug was found.
    - hayez1 7y ago
      Sometimes it does make sense to trade security for performance.
      - ancarda 7y ago
        I completely disagree. Can you give me an example? Perhaps you can change my mind.
        hayez1 7y ago
        I can't give you an example but it's perfectly plausible that many users don't store volatile data on their computer and/or are not careless with downloading and running programs. These users might prefer the extra speed up.
        scarejunba 7y ago
        We ran a 100-petabyte cluster with all Meltdown/Spectre mitigation turned off because there was no foreign code running on it that didn't have access to the data itself. It's all about the threat model. Engineers at the company were considered trusted actors and they were the only ones permitted to connect. If that layer failed, there is no way cache invalidation errors would be the fastest way in.
beckler 7y ago
Little Snitch 4 is a rather impressive piece of software. The map is my favorite part. It's not always accurate, but it's absolutely wild to see the places apps want to ship data off to. Also if you interface directly to your WAN, you can see all the bots/worms/etc that try to connect to your IP. I got a surprising amount of netbios queries from Iran (I'm assuming from EternalBlue based malware trying to connect), but I highly recommend NOT doing this. It's the wild west outside your firewall.
- 0xff00ffee 7y ago
  I use both Little Snitch and Micro Snitch. The LS proxy completely overwhelmed me. I thought I could be savvy and limit traffic. Yeaaaaah no. Once I started observing what was actually flying around it's... it's just insanity how many requests are made in just a few seconds. What else can I do but throw up my hands and hope for the best? But I guess it won't matter soon.
  - e40 7y ago
    This is precisely why I've never installed it, because I figure it would overwhelm me. How does combo help you not be overwhelmed?
    - sprokolopolis 7y ago
      It is really obnoxious when you first install it, but once you have set up your rules for your most frequently used applications, it isn't really an issue for me. You can also export and import your rules if you want to move them to a new system. I haven't used micro snitch, though.
      - actionowl 7y ago
        > once you have set up your rules for your most frequently used applications, it isn't really an issue I can second this, also if you're overwhelmed you probably have a lot of garbage applications making too many outbound network requests to trackers and who knows what else which is actually nice to know about. Chrome-based browsers and Electron based apps seem to be particularly awful about this. My HP printer app tries to connect to Google Analytics, Microsoft RDP phones-home before connecting to a session. I really value that kind of insight and enjoy being able to control it.
danieldk 7y ago
Background: Apple is abolishing (third-party) kernel extension to increase security: https://developer.apple.com/system-extensions/ https://developer.apple.com/system-extensions/
- riazrizvi 7y ago
  And Apple takes another step closer toward a proprietary OS away from UNIX. Perhaps 10.16 will lose certification [1]. [1] https://www.opengroup.org/openbrand/register/ https://www.opengroup.org/openbrand/register/ EDIT: I can't find anything that references kernel extensions in the conformance [2] section of the spec, so maybe 10.16 will adhere to the UNIX03 standard after all. [2] https://pubs.opengroup.org/onlinepubs/009695399/ https://pubs.opengroup.org/onlinepubs/009695399/
  - TazeTSchnitzel 7y ago
    POSIX does not standardise kernel extensions. You can't use Linux kernel extensions on other OSes for example.
    - saagarjha 7y ago
      You can't even use Linux kernel extensions across different versions of Linux…
  - pjmlp 7y ago
    QNX is also a certified UNIX for embedded deployment, yet it is a micro-kernel OS. https://blackberry.qnx.com/en/resource-center/qnx-certifications https://blackberry.qnx.com/en/resource-center/qnx-certificat... UNIX certification doesn't say anything about how a kernel should be implemented, or what kind of driver architecture is used.
  - loeg 7y ago
    Anyone can buy UNIX certification. It just means you set fire to an appropriately sized bundle of cash. In return you get a nice sticker from the trademark holder. It is not especially meaningful.
gumby 7y ago
There are so many people using it at Apple that I can't imagine LS5 not working on 10.16 when it ships to the general public.
- perplex 7y ago
  > Yes. We are going to release an update of Little Snitch that will be compatible with macOS 10.16. At least a future version of LS will work with 10.16.
- jayrhynas 7y ago
  "we are working closely with Apple to fill the remaining gaps" - definitely sounds like it. I think Apple has made the right call tightening security around kernel extensions but I'm glad they're working with 3rd party developers (even if it's only big ones) to ensure the functionality is still there. They also mentioned the existing version will still work, it will just need to be explicitly enabled.
- mroche 7y ago
  From the very end of the article: > When will Little Snitch be updated to the new APIs? > The replacements APIs that are currently available (NetworkExtension framework on macOS 10.15.4) are not yet completely sufficient to implement the full functionality of Little Snitch. But we are working closely with Apple to fill the remaining gaps and we expect that a beta version of macOS 10.16 (most likely available at the next WWDC) or even an upcoming version of 10.15 will provide what is missing. As soon as the APIs allow us, we will complete the transition of Little Snitch to the new NetworkExtension API. It’s our goal to provide a public beta in June 2020 and a stable version in October. If they can (and Apple) can keep to that timeline, I expect they will.
- bredren 7y ago
  I hope this goes over better than the Sign in with Apple deadline that was attempted. That seemed like a pretty big flop.
  - saagarjha 7y ago
djsumdog 7y ago
I guess it will be even more difficult to run Hackintoshes with 10.6
- arm 7y ago
  (Small typo correction: 10.16, 10.6 is Snow Leopard).
- Synaesthesia 7y ago
  I think we will be able to go forward with custom kernels or some hack failing that.
- sudosysgen 7y ago
  If you have hackintosh level access, you would be able to inject kexts anyways.
  - Wowfunhappy 7y ago
    Exactly. In the event that the entire concept of kernel extensions is removed (which seems unlikely), Hackintosh developers could just recompile the kernel. Or have the bootloader patch the kernel binary. (Fun fact: Clover already allows any user to do Find ==> Replace on aribitrary strings or hex sequences in the kernel.) You can do this stuff on a real Mac too btw, as long as SIP is off. Now, if Apple actually put a concerted effort into screwing Hackintosh users, they could probably kill the scene relatively easily. But, they don't seem interested in doing that. Their attitude since the initial Intel release of Tiger has seemingly been indifference.
    - saagarjha 7y ago
      > Hackintosh developers could just recommpile the kernel. No, not really. macOS's kernel, and especially its kernel extensions, are closed source.
      - Wowfunhappy 7y ago
        Darwin is open source. AMD Hackintosh users frequently compile custom Darwin kernels in order for macOS to run (although within the past year or so, this has fallen out of favor compared to binary patches). Many kernel extensions are closed source, but that's not relevant here. What matters are Hackintosh kernel extensions like FakeSMC, which could absolutely be integrated into the kernel if necessary. Edit: I just realized who I was talking too, you're more knowledgeable about iOS and macOS internals than I am! Are you referring to something different? I know absolutely that you can compile custom versions of Darwin, because as I mentioned it's done frequently for Hackintosh stuff.
Isamu 7y ago
I never looked before but "ls /dev/bpf*" shows a lot of Berkeley packet filters. Maybe that reflects a movement toward user-space monitoring?
- wahern 7y ago
  Interesting. I get 256 on Catalina (0-255), as opposed to 4 (0-3) on Mojave. /dev doesn't appear to be dynamic as it is on Linux, so they've chosen to pre-create more device files. More importantly, on Catalina the permissions are now ug=rw (0660) and with a group name of "access_bpf", whereas on Mojave they were u=rw (0600) and "wheel". So, yeah, looks like Catalina was a stepping stone.
- codezero 7y ago
  I think dtrace monitoring can be enabled, but requires removing some system security settings, if I remember correctly, so I guess if they go that route they still need to beef up security.
rlonstein 7y ago
Archive before it gets hugged to death... https://archive.is/7HxHk https://archive.is/7HxHk
milofeynman 7y ago
What's the cleanest way to monitor your entire network similar to little snitch?
- pilsetnieks 7y ago
  The difference is granularity - inside your computer you know which application is doing it. On a network level you only see which device it is. Maybe there's something with a central server and an agent installed on every device connecting but I doubt it's as easy and pretty as LS.
- bashinator 7y ago
  Install a private CA root cert on all the machines in your network, and set up a router that's able to MitM TLS sessions to do deep packet inspection. Palo Alto Networks' kit has this kind of capability.
  - beckler 7y ago
    Most enterprise networks do this, but you'll have major issues with IoT devices and devices/apps that do certificate pinning. You'll probably have to put those on your guest network... Assuming you have one.
ethanpil 7y ago
I think Hackintosh enthusiasts are also an intended target of this phase out... These systems heavily rely on kexts...
- Hamuko 7y ago
  If there's a will, there's a way.
- deleted 7y ago
  [deleted]
leokennis 7y ago
Little Snitch also nicely shows how Google will make increasingly desperate attempts to invisibly update its software in the background. It starts with a request to Google.com from Google Software Updater. But if you block that and the follow ups enough times, in the end it will even try curl’ing directly to IP’s...
- Spivak 7y ago
  Or it just assumes that name resolution is broken for some benign reason.
  - Zenbit_UX 7y ago
    Exactly, that's just good programming.
- hyperbovine 7y ago
  People write exploits that target Google software. What would you like them to do?
tambourine_man 7y ago
What worries me about this move from Apple is that it may stifle creativity on the platform. Apple is working closely with Little Snitch to provide them with APIs with the features they need. Fine. But would Little Snitch exist if there were no Kernel Extensions?
- hyperbovine 7y ago
  Yes? Clearly the market is there. And writing kernel extensions is a major PITA. One benefit of working in user space is that you can (usually) do so in the language of your choosing. Little Snitch 0.0.1alpha would have been a lot easier to prototype in Swift than in C.
  - bspammer 7y ago
    I believe GP is saying that if the transition to kernel extensions had happened before Little Snitch was written, then LS could never be written after that point because they wouldn't have the required leverage to get Apple to expose the API they need. What if we'll be missing out on other groundbreaking future apps that need kernel space information to function?
    - tambourine_man 7y ago
      That’s it.
- m463 7y ago
  They've been taking that direction for years. "Here's to the crazy ones..." Oh wait, there are none left.
test7777 7y ago
Showing the deprecation message before the API that replaces it is actually out? Isn't that a bit of an a-hole move? I know everyone here is a developer and hates code older than a month, but really? Nobody gonna call them out on that?
- minusf 7y ago
  that's exactly what depr. messages are for. it's to call to attention it's going away. once it's gone a deprecation message is useless.
KingOfCoders 7y ago
This article sparked interest into Snitch again and I've tried to upgrade from Snitch 3 - sadly upgrading doesn't work.
unixhero 7y ago
A port to Linux would be nice, just saying!
- m463 7y ago
  there is a project called opensnitch that supposedly does similar things on linux https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch I'm not sure how active it is (no recent activity and there seem to be a lot of forks)
delouvois 7y ago
Snitches get stitches
IOT_Apprentice 7y ago
So will the deprecation break Hackintoshs?
- nutjob2 7y ago
  No. Hackintosh is a hardware and firmware platform, mostly at a lower level than macOS. Barring custom Apple hardware, anything that runs on Apple hardware will run on Hackintosh. Even custom hardware can be worked around as long as it is not critical (eg a custom CPU).
spacepinball 7y ago
So basically they will charge me once more for a compatibility fix.

339 points by guessmyname 7y ago

It's interesting to compare and contrast community reactions to apple vs google policies, as well as how the companies interface with popular software. Google changes extension model for Chrome, breaking ad blockers, reaction seems to be that it's an obvious power grab. Apple changes extension model, breaking network blocker, reaction seems to be favorable.

saagarjha 7y ago
> Google changes extension model for Chrome, breaking ad blockers, reaction seems to be that it's an obvious power grab. Interestingly, Apple made this exact change in Safari first.
- leokennis 7y ago
  And were shouted at for it.
  - saagarjha 7y ago
    Not really.
- IAmEveryone 7y ago
  - They have a replacement API and, per the article, are working with the developer to make it a smooth transition. - there isn’t an obvious motive to handicap third-party developers here (applies to Safari adblocking as well) - the stated motive of increased security and stability is entirely plausible FWIW I tend towards assuming good faith in the case of Chrome as well. If we accept the reason given for Safari (because plausible & no obvious other, see above), it wouldn’t make much sense not to see the exact same motivation to be sufficient for Chrome. I’m not sure if Google having another, less user-friendly additional reason should make much of a difference. It’s only if the specifics around the alternative APIs diverge that Google’s ad business might become relevant again.
tjoff 7y ago
Maybe because it is not comparable?

greendave 7y ago

Apple has really done a 180 degree turn from back in the early OS X days, when they actually did quite a bit of work to keep existing applications functional. Forget binary compatibility, now even existing APIs are disappearing left and right.

bognition 7y ago
That makes sense right though. 15 years ago the number of people using OSX was a fraction of what it is today. They had to be very protective of that customer base. Now the install base is huge and the threats are different.
- outworlder 7y ago
  > Now the install base is huge and the threats are different. Counterpoint: Microsoft's install base is enormous and has been for decades. They very very rarely intentionally break backwards compatibility.
  - viscanti 7y ago
    Counterpoint: Microsoft's obsession with backward compatibility is why there are so many zero day exploits for their OS. Complexity comes with a cost.
    - bshacklett 7y ago
      One doesn't even have to look that far. They haven't shipped a Windows update on time for years due to bugs pushing the dates back. I can't imagine that their backwards compatibility requirements have been part of the problem. In fact, wasn't there a specific issue that was linked back to compatibility with CP/M not that long ago? Edit: This is what I was thinking of: https://www.itnews.com.au/news/how-a-1974-bug-still-bites-win10-and-azure-users-515102 https://www.itnews.com.au/news/how-a-1974-bug-still-bites-wi...
    - jfkebwjsbx 7y ago
      That is not a counterpoint, just a downside (which can be offset taking several approaches). I would like to see a comparison between recent versions of macOS and Windows 10.

jiripospisil 7y ago

This is good news. Moving to the Network Extension framework means that Little Snitch's filtering will run entirely in user space, which is not only great for security but it will also allow the code to be written in a higher level language such as Swift.

CameronNemo 7y ago
What if that has an impact on performance? Kernel-user space communication usually means copying data into different portions of memory, plus a context switch.
- ancarda 7y ago
  We shouldn't ever trade security for performance. Doing that is how Microsoft ended up putting shit like font rendering into the kernel. Made Windows very fast, but made it so much worse when a bug was found.
  - hayez1 7y ago
    Sometimes it does make sense to trade security for performance.
    - ancarda 7y ago
      I completely disagree. Can you give me an example? Perhaps you can change my mind.
      - hayez1 7y ago
        I can't give you an example but it's perfectly plausible that many users don't store volatile data on their computer and/or are not careless with downloading and running programs. These users might prefer the extra speed up.
      - scarejunba 7y ago
        We ran a 100-petabyte cluster with all Meltdown/Spectre mitigation turned off because there was no foreign code running on it that didn't have access to the data itself. It's all about the threat model. Engineers at the company were considered trusted actors and they were the only ones permitted to connect. If that layer failed, there is no way cache invalidation errors would be the fastest way in.

beckler 7y ago

Little Snitch 4 is a rather impressive piece of software. The map is my favorite part. It's not always accurate, but it's absolutely wild to see the places apps want to ship data off to. Also if you interface directly to your WAN, you can see all the bots/worms/etc that try to connect to your IP. I got a surprising amount of netbios queries from Iran (I'm assuming from EternalBlue based malware trying to connect), but I highly recommend NOT doing this. It's the wild west outside your firewall.

0xff00ffee 7y ago
I use both Little Snitch and Micro Snitch. The LS proxy completely overwhelmed me. I thought I could be savvy and limit traffic. Yeaaaaah no. Once I started observing what was actually flying around it's... it's just insanity how many requests are made in just a few seconds. What else can I do but throw up my hands and hope for the best? But I guess it won't matter soon.
- e40 7y ago
  This is precisely why I've never installed it, because I figure it would overwhelm me. How does combo help you not be overwhelmed?
  - sprokolopolis 7y ago
    It is really obnoxious when you first install it, but once you have set up your rules for your most frequently used applications, it isn't really an issue for me. You can also export and import your rules if you want to move them to a new system. I haven't used micro snitch, though.
    - actionowl 7y ago
      > once you have set up your rules for your most frequently used applications, it isn't really an issue I can second this, also if you're overwhelmed you probably have a lot of garbage applications making too many outbound network requests to trackers and who knows what else which is actually nice to know about. Chrome-based browsers and Electron based apps seem to be particularly awful about this. My HP printer app tries to connect to Google Analytics, Microsoft RDP phones-home before connecting to a session. I really value that kind of insight and enjoy being able to control it.

danieldk 7y ago

Background: Apple is abolishing (third-party) kernel extension to increase security: https://developer.apple.com/system-extensions/ https://developer.apple.com/system-extensions/

riazrizvi 7y ago
And Apple takes another step closer toward a proprietary OS away from UNIX. Perhaps 10.16 will lose certification [1]. [1] https://www.opengroup.org/openbrand/register/ https://www.opengroup.org/openbrand/register/ EDIT: I can't find anything that references kernel extensions in the conformance [2] section of the spec, so maybe 10.16 will adhere to the UNIX03 standard after all. [2] https://pubs.opengroup.org/onlinepubs/009695399/ https://pubs.opengroup.org/onlinepubs/009695399/
- TazeTSchnitzel 7y ago
  POSIX does not standardise kernel extensions. You can't use Linux kernel extensions on other OSes for example.
  - saagarjha 7y ago
    You can't even use Linux kernel extensions across different versions of Linux…
- pjmlp 7y ago
  QNX is also a certified UNIX for embedded deployment, yet it is a micro-kernel OS. https://blackberry.qnx.com/en/resource-center/qnx-certifications https://blackberry.qnx.com/en/resource-center/qnx-certificat... UNIX certification doesn't say anything about how a kernel should be implemented, or what kind of driver architecture is used.
- loeg 7y ago
  Anyone can buy UNIX certification. It just means you set fire to an appropriately sized bundle of cash. In return you get a nice sticker from the trademark holder. It is not especially meaningful.

gumby 7y ago

There are so many people using it at Apple that I can't imagine LS5 not working on 10.16 when it ships to the general public.

perplex 7y ago
> Yes. We are going to release an update of Little Snitch that will be compatible with macOS 10.16. At least a future version of LS will work with 10.16.
jayrhynas 7y ago
"we are working closely with Apple to fill the remaining gaps" - definitely sounds like it. I think Apple has made the right call tightening security around kernel extensions but I'm glad they're working with 3rd party developers (even if it's only big ones) to ensure the functionality is still there. They also mentioned the existing version will still work, it will just need to be explicitly enabled.
mroche 7y ago
From the very end of the article: > When will Little Snitch be updated to the new APIs? > The replacements APIs that are currently available (NetworkExtension framework on macOS 10.15.4) are not yet completely sufficient to implement the full functionality of Little Snitch. But we are working closely with Apple to fill the remaining gaps and we expect that a beta version of macOS 10.16 (most likely available at the next WWDC) or even an upcoming version of 10.15 will provide what is missing. As soon as the APIs allow us, we will complete the transition of Little Snitch to the new NetworkExtension API. It’s our goal to provide a public beta in June 2020 and a stable version in October. If they can (and Apple) can keep to that timeline, I expect they will.
bredren 7y ago
I hope this goes over better than the Sign in with Apple deadline that was attempted. That seemed like a pretty big flop.
- saagarjha 7y ago

djsumdog 7y ago

I guess it will be even more difficult to run Hackintoshes with 10.6

arm 7y ago
(Small typo correction: 10.16, 10.6 is Snow Leopard).
Synaesthesia 7y ago
I think we will be able to go forward with custom kernels or some hack failing that.
sudosysgen 7y ago
If you have hackintosh level access, you would be able to inject kexts anyways.
- Wowfunhappy 7y ago
  Exactly. In the event that the entire concept of kernel extensions is removed (which seems unlikely), Hackintosh developers could just recompile the kernel. Or have the bootloader patch the kernel binary. (Fun fact: Clover already allows any user to do Find ==> Replace on aribitrary strings or hex sequences in the kernel.) You can do this stuff on a real Mac too btw, as long as SIP is off. Now, if Apple actually put a concerted effort into screwing Hackintosh users, they could probably kill the scene relatively easily. But, they don't seem interested in doing that. Their attitude since the initial Intel release of Tiger has seemingly been indifference.
  - saagarjha 7y ago
    > Hackintosh developers could just recommpile the kernel. No, not really. macOS's kernel, and especially its kernel extensions, are closed source.
    - Wowfunhappy 7y ago
      Darwin is open source. AMD Hackintosh users frequently compile custom Darwin kernels in order for macOS to run (although within the past year or so, this has fallen out of favor compared to binary patches). Many kernel extensions are closed source, but that's not relevant here. What matters are Hackintosh kernel extensions like FakeSMC, which could absolutely be integrated into the kernel if necessary. Edit: I just realized who I was talking too, you're more knowledgeable about iOS and macOS internals than I am! Are you referring to something different? I know absolutely that you can compile custom versions of Darwin, because as I mentioned it's done frequently for Hackintosh stuff.

Isamu 7y ago

I never looked before but "ls /dev/bpf*" shows a lot of Berkeley packet filters. Maybe that reflects a movement toward user-space monitoring?

wahern 7y ago
Interesting. I get 256 on Catalina (0-255), as opposed to 4 (0-3) on Mojave. /dev doesn't appear to be dynamic as it is on Linux, so they've chosen to pre-create more device files. More importantly, on Catalina the permissions are now ug=rw (0660) and with a group name of "access_bpf", whereas on Mojave they were u=rw (0600) and "wheel". So, yeah, looks like Catalina was a stepping stone.
codezero 7y ago
I think dtrace monitoring can be enabled, but requires removing some system security settings, if I remember correctly, so I guess if they go that route they still need to beef up security.

rlonstein 7y ago

Archive before it gets hugged to death... https://archive.is/7HxHk https://archive.is/7HxHk

milofeynman 7y ago

What's the cleanest way to monitor your entire network similar to little snitch?

pilsetnieks 7y ago
The difference is granularity - inside your computer you know which application is doing it. On a network level you only see which device it is. Maybe there's something with a central server and an agent installed on every device connecting but I doubt it's as easy and pretty as LS.
bashinator 7y ago
Install a private CA root cert on all the machines in your network, and set up a router that's able to MitM TLS sessions to do deep packet inspection. Palo Alto Networks' kit has this kind of capability.
- beckler 7y ago
  Most enterprise networks do this, but you'll have major issues with IoT devices and devices/apps that do certificate pinning. You'll probably have to put those on your guest network... Assuming you have one.

ethanpil 7y ago

I think Hackintosh enthusiasts are also an intended target of this phase out... These systems heavily rely on kexts...

Hamuko 7y ago
If there's a will, there's a way.
deleted 7y ago
[deleted]

leokennis 7y ago

Little Snitch also nicely shows how Google will make increasingly desperate attempts to invisibly update its software in the background. It starts with a request to Google.com from Google Software Updater. But if you block that and the follow ups enough times, in the end it will even try curl’ing directly to IP’s...

Spivak 7y ago
Or it just assumes that name resolution is broken for some benign reason.
- Zenbit_UX 7y ago
  Exactly, that's just good programming.
hyperbovine 7y ago
People write exploits that target Google software. What would you like them to do?

tambourine_man 7y ago

What worries me about this move from Apple is that it may stifle creativity on the platform. Apple is working closely with Little Snitch to provide them with APIs with the features they need. Fine. But would Little Snitch exist if there were no Kernel Extensions?

hyperbovine 7y ago
Yes? Clearly the market is there. And writing kernel extensions is a major PITA. One benefit of working in user space is that you can (usually) do so in the language of your choosing. Little Snitch 0.0.1alpha would have been a lot easier to prototype in Swift than in C.
- bspammer 7y ago
  I believe GP is saying that if the transition to kernel extensions had happened before Little Snitch was written, then LS could never be written after that point because they wouldn't have the required leverage to get Apple to expose the API they need. What if we'll be missing out on other groundbreaking future apps that need kernel space information to function?
  - tambourine_man 7y ago
    That’s it.
m463 7y ago
They've been taking that direction for years. "Here's to the crazy ones..." Oh wait, there are none left.

test7777 7y ago

Showing the deprecation message before the API that replaces it is actually out? Isn't that a bit of an a-hole move? I know everyone here is a developer and hates code older than a month, but really? Nobody gonna call them out on that?

minusf 7y ago
that's exactly what depr. messages are for. it's to call to attention it's going away. once it's gone a deprecation message is useless.

KingOfCoders 7y ago

This article sparked interest into Snitch again and I've tried to upgrade from Snitch 3 - sadly upgrading doesn't work.

unixhero 7y ago

A port to Linux would be nice, just saying!

m463 7y ago
there is a project called opensnitch that supposedly does similar things on linux https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch I'm not sure how active it is (no recent activity and there seem to be a lot of forks)

delouvois 7y ago

Snitches get stitches

IOT_Apprentice 7y ago

So will the deprecation break Hackintoshs?

nutjob2 7y ago
No. Hackintosh is a hardware and firmware platform, mostly at a lower level than macOS. Barring custom Apple hardware, anything that runs on Apple hardware will run on Hackintosh. Even custom hardware can be worked around as long as it is not critical (eg a custom CPU).

spacepinball 7y ago

So basically they will charge me once more for a compatibility fix.