6 ms·

Little Snitch 4 is a rather impressive piece of software. The map is my favorite part. It's not always accurate, but it's absolutely wild to see the places apps

Little Snitch 4 is a rather impressive piece of software. The map is my favorite part. It's not always accurate, but it's absolutely wild to see the places apps want to ship data off to. Also if you interface directly to your WAN, you can see all the bots/worms/etc that try to connect to your IP. I got a surprising amount of netbios queries from Iran (I'm assuming from EternalBlue based malware trying to connect), but I highly recommend NOT doing this. It's the wild west outside your firewall.

0xff00ffee 7y ago
I use both Little Snitch and Micro Snitch. The LS proxy completely overwhelmed me. I thought I could be savvy and limit traffic. Yeaaaaah no. Once I started observing what was actually flying around it's... it's just insanity how many requests are made in just a few seconds. What else can I do but throw up my hands and hope for the best? But I guess it won't matter soon.
- e40 7y ago
  This is precisely why I've never installed it, because I figure it would overwhelm me. How does combo help you not be overwhelmed?
  - sprokolopolis 7y ago
    It is really obnoxious when you first install it, but once you have set up your rules for your most frequently used applications, it isn't really an issue for me. You can also export and import your rules if you want to move them to a new system. I haven't used micro snitch, though.
    - actionowl 7y ago
      > once you have set up your rules for your most frequently used applications, it isn't really an issue I can second this, also if you're overwhelmed you probably have a lot of garbage applications making too many outbound network requests to trackers and who knows what else which is actually nice to know about. Chrome-based browsers and Electron based apps seem to be particularly awful about this. My HP printer app tries to connect to Google Analytics, Microsoft RDP phones-home before connecting to a session. I really value that kind of insight and enjoy being able to control it.
  - 0xff00ffee 7y ago
    I removed little snitch. :) Micro snitch just alerts me when my mic or camera are activated. I can live with that.
    - buzzerbetrayed 7y ago
      Are they ever activated at times you aren’t expecting them to be? I assume I would have a noticed the little green light on my mbp if the camera was being activated against my wishes.
- malandrew 7y ago
  Little Snitch definitely needs a social feature where you can crowdsource good rules from other people and see what rules are common within the communities for certain apps.
  - capableweb 7y ago
    Back when I was using OSX and Little Snitch, first user experience was horrible. I reinstalled OSX and installed Little Snitch first, and went to install app by app after running it, and got a slightly better experience. But, requires a reinstall of your OS (or maybe creating a new user will be enough)
  - jumarm 7y ago
    While the social part is not there, the technology is. I subscribe to rule groups through hostblocker.app, which pulls HOSTS files from different known websites and compile them into a .lsrules file which Little Snitch can use. While I cannot vouch for the website's underlying code-I did not write it and I can not find an open source implementation-It only provides rules and I can edit any rule group to my liking after subscribing to it.
  - jedberg 7y ago
    That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.
    - jfkebwjsbx 7y ago
      No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.
      - jedberg 7y ago
        I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host. If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.
zomg 7y ago
I've been using Little Snitch since 2.0 and I agree, it's very impressive software. I had the same reaction to seeing the map features -- eye opening to say the least and a very, very interesting feature!
qwerty456127 7y ago
> It's the wild west outside your firewall. You mean outside my $5 NAT WiFi router last updated 6 years ago (because the manufacturer won't maintain it any more and the ISP never gave me the admin password anyway)?
- booi 7y ago
  better than nothing... arguably...
- philjohn 7y ago
  This right here is the very reason OpenWRT exists. I never trust ISP provided equipment to do my routing, if I can't use it in modem mode (or provide my own modem) then a DMZ and port forwarding have to do ... but I'd sooner just choose another provider.
  - qwerty456127 7y ago
    At least you need to know the settings for this. I tried attaching my laptop directly to the cable and that didn't work (I would put my own router if it did). There probably is some sort of PPPoE over a statically-configured network.
odysseus 7y ago
I'd like to see a similar map built into pihole. Seems like a natural fit. This way you could get a map for connections made by various apps on your phone too.
jzl 7y ago
https://en.wikipedia.org/wiki/Internet_background_noise https://en.wikipedia.org/wiki/Internet_background_noise
tomc1985 7y ago
It's kind of peaceful watching attacks crash against your webserver/firewall, like waves at shore.

0xff00ffee 7y ago

I use both Little Snitch and Micro Snitch. The LS proxy completely overwhelmed me. I thought I could be savvy and limit traffic. Yeaaaaah no. Once I started observing what was actually flying around it's... it's just insanity how many requests are made in just a few seconds. What else can I do but throw up my hands and hope for the best? But I guess it won't matter soon.

e40 7y ago
This is precisely why I've never installed it, because I figure it would overwhelm me. How does combo help you not be overwhelmed?
- sprokolopolis 7y ago
  It is really obnoxious when you first install it, but once you have set up your rules for your most frequently used applications, it isn't really an issue for me. You can also export and import your rules if you want to move them to a new system. I haven't used micro snitch, though.
  - actionowl 7y ago
    > once you have set up your rules for your most frequently used applications, it isn't really an issue I can second this, also if you're overwhelmed you probably have a lot of garbage applications making too many outbound network requests to trackers and who knows what else which is actually nice to know about. Chrome-based browsers and Electron based apps seem to be particularly awful about this. My HP printer app tries to connect to Google Analytics, Microsoft RDP phones-home before connecting to a session. I really value that kind of insight and enjoy being able to control it.
- 0xff00ffee 7y ago
  I removed little snitch. :) Micro snitch just alerts me when my mic or camera are activated. I can live with that.
  - buzzerbetrayed 7y ago
    Are they ever activated at times you aren’t expecting them to be? I assume I would have a noticed the little green light on my mbp if the camera was being activated against my wishes.
malandrew 7y ago
Little Snitch definitely needs a social feature where you can crowdsource good rules from other people and see what rules are common within the communities for certain apps.
- capableweb 7y ago
  Back when I was using OSX and Little Snitch, first user experience was horrible. I reinstalled OSX and installed Little Snitch first, and went to install app by app after running it, and got a slightly better experience. But, requires a reinstall of your OS (or maybe creating a new user will be enough)
- jumarm 7y ago
  While the social part is not there, the technology is. I subscribe to rule groups through hostblocker.app, which pulls HOSTS files from different known websites and compile them into a .lsrules file which Little Snitch can use. While I cannot vouch for the website's underlying code-I did not write it and I can not find an open source implementation-It only provides rules and I can edit any rule group to my liking after subscribing to it.
- jedberg 7y ago
  That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.
  - jfkebwjsbx 7y ago
    No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.
    - jedberg 7y ago
      I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host. If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.

zomg 7y ago

I've been using Little Snitch since 2.0 and I agree, it's very impressive software. I had the same reaction to seeing the map features -- eye opening to say the least and a very, very interesting feature!

qwerty456127 7y ago

> It's the wild west outside your firewall. You mean outside my $5 NAT WiFi router last updated 6 years ago (because the manufacturer won't maintain it any more and the ISP never gave me the admin password anyway)?

booi 7y ago
better than nothing... arguably...
philjohn 7y ago
This right here is the very reason OpenWRT exists. I never trust ISP provided equipment to do my routing, if I can't use it in modem mode (or provide my own modem) then a DMZ and port forwarding have to do ... but I'd sooner just choose another provider.
- qwerty456127 7y ago
  At least you need to know the settings for this. I tried attaching my laptop directly to the cable and that didn't work (I would put my own router if it did). There probably is some sort of PPPoE over a statically-configured network.

odysseus 7y ago

I'd like to see a similar map built into pihole. Seems like a natural fit. This way you could get a map for connections made by various apps on your phone too.

jzl 7y ago

https://en.wikipedia.org/wiki/Internet_background_noise https://en.wikipedia.org/wiki/Internet_background_noise

tomc1985 7y ago

It's kind of peaceful watching attacks crash against your webserver/firewall, like waves at shore.