12 ms·

This is good news. Moving to the Network Extension framework means that Little Snitch's filtering will run entirely in user space, which is not only great for s

This is good news. Moving to the Network Extension framework means that Little Snitch's filtering will run entirely in user space, which is not only great for security but it will also allow the code to be written in a higher level language such as Swift.

CameronNemo 7y ago
What if that has an impact on performance? Kernel-user space communication usually means copying data into different portions of memory, plus a context switch.
- ancarda 7y ago
  We shouldn't ever trade security for performance. Doing that is how Microsoft ended up putting shit like font rendering into the kernel. Made Windows very fast, but made it so much worse when a bug was found.
  - hayez1 7y ago
    Sometimes it does make sense to trade security for performance.
    - ancarda 7y ago
      I completely disagree. Can you give me an example? Perhaps you can change my mind.
      - hayez1 7y ago
        I can't give you an example but it's perfectly plausible that many users don't store volatile data on their computer and/or are not careless with downloading and running programs. These users might prefer the extra speed up.
      - scarejunba 7y ago
        We ran a 100-petabyte cluster with all Meltdown/Spectre mitigation turned off because there was no foreign code running on it that didn't have access to the data itself. It's all about the threat model. Engineers at the company were considered trusted actors and they were the only ones permitted to connect. If that layer failed, there is no way cache invalidation errors would be the fastest way in.
      - riquito 7y ago
        /dev/random vs /dev/urandom, you could argue that a new seed via /dev/random is somewhat better, but you wouldn't block everything constantly to get new entropy
        saagarjha 7y ago
        /dev/urandom is better than /dev/random in almost every case, so much so that on macOS they are identical.
      - plorkyeran 7y ago
        A machine which is turned off is much slower and more secure than a machine which is turned on, but for some reason people insist on turning their computers on. Security mechanisms which prevent you from doing the thing you're setting out to do are worthless. Making a computer too slow to be useful is one of the ways to do that. In this specific case, if moving Little Snitch's functionality to userland means that the performance hit of running it was large enough that I have to turn it off when doing network performance sensitive things (say, video conferences) then it'd be a net loss in security compared to the status quo of it running in kernel mode.
      - fulafel 7y ago
        Frequently security = correctness.
    - keehun 7y ago
      Agreed. Remember ancarda, it's always about the threat modeling. Every scenario has different business/user needs, and therefore, different tradeoffs that can/will be made. Sometimes, it does make sense to trade performance for security. (N.B. not always, or actually, probably not most of the time.)
  - cortesoft 7y ago
    This is impossible... perfect security would require not having ANY performance. All security is about trade offs, and the answer can't be "trade everything for security"
  - overgard 7y ago
    That's pretty broad. I have a gaming machine with practically no personal data on it, I just want it to be fast. But the tradeoffs for my work machine are way different. Security is ALWAYS a tradeoff. If we wanted perfect airline security we'd fly naked. Also not like limiting vulnerabilities to user space is always a big improvement. If someone hacks my user account on a single user computer, they have access to all the data I care about anyway. They could ransomeware my stuff even without kernel access.
    - philistine 7y ago
      A gaming machine with no personal data on it. We call that a console, and they are indeed built for speed above all else.
      - Hamuko 7y ago
        Consoles are really built for a price point above all else. Hence why they're always lacking in performance compared to contemporary gaming PCs.
        sitkack 7y ago
        They also take security very very seriously.
        StavrosK 7y ago
        Consoles take DRM safety seriously, the fact that that aligns with user security is purely coincidental.
      - m463 7y ago
        Except companies are really quite adept at identifying the person connected to all the "no personal data".
    - rasteau 7y ago
      The trade off is not installing Little Snitch.
  - yjftsjthsd-h 7y ago
    I trust that you're typing your comment from OpenBSD? After all, it's the only modern OS that doesn't compromise against security.
    - ancarda 7y ago
      Not yet, though I am working on replacing proprietary software I use with free software that's Linux/BSD compatible. It's a long journey - started using Windows. macOS is a nice gap-stop, but the long term destination is probably something like OpenBSD or Qubes OS. Perhaps eventually replacing much of the old software on my machine with stuff written in memory safe languages like Rust. There's some far-off efforts like Redox OS that may well end up being an option for me. I keep my eye on security developments and I try to improve my situation as and when I have the time/energy to. EDIT: To say, I have also switched from iOS to Android - after many years of waiting till Android itself became more secure. I've also dumped a lot of non-free software like Google Authenticator for free alternatives like andOTP. I'd like to eventually run something like Replicant or whatever is current/actively developed in the future.
      - GoofballJones 7y ago
        I did the opposite, went from Android to iOS because of security. I'd rather live in this "walled garden" instead of the vulnerabilities that pop up in Android now and then, the malware that's always popping up in their app-store, and finally the fact that Google is always looking over your shoulder at everything you do, even despite how much you "turn off" things in the OS, it still phones home. Microsoft is the same. I'm tired of it. Not to mention that Android manufacturers idea of an "update" to the OS means you basically have to buy a newer model, as they often lag months behind on software/security updates from Google, and Apple supports their phones and tablets with updates years after. For instance, Google only provides updates to their Pixel phones for 3 years. Meanwhile, my wife's iPhone 6s is still chugging along with the latest OS after 5 years. But this is just me. Everyone should use what they are comfortable with.
        GoofballJones 7y ago
  - Threeve303 7y ago
    Trading security for performance is never a good idea. In this case the downside might be that traffic is able to pass through undetected as a result of moving to user space. If your goal is security through monitoring, can you really trust monitoring software that can't see everything?
- gok 7y ago
  The whole point of this application is that the information is bounced to user space.
  - saagarjha 7y ago
    Only when necessary.
- GeekyBear 7y ago
  Windows moved basic graphics driver functionality to user space many, many years ago. (Windows Vista) >Badly written device drivers can cause severe damage to a system (e.g., BSoD and data corruption) since all standard drivers have high privileges when accessing the kernel directly. The User-Mode Driver Framework insulates the kernel from the problems of direct driver access, instead providing a new class of driver with a dedicated application programming interface at the user level of interrupts and memory management. If an error occurs, the new framework allows for an immediate driver restart without impacting the system. https://en.m.wikipedia.org/wiki/User-Mode_Driver_Framework https://en.m.wikipedia.org/wiki/User-Mode_Driver_Framework Has Windows suffered from this change or has the added stability of having a graphics stack capable of restarting itself on error instead of blue screening the entire machine been a good thing?
  - wmf 7y ago
    Graphics and network stacks are very different. It sounds like macOS is going to have the entire network stack in the kernel except for extensions; this could be the worst of all worlds for performance.
    - flatiron 7y ago
      Gotta get rid of all my Mac OS network switches.... I think they value the security and reliability from evicting those kernel extensions and nobody dreams of using this in some high performance production switch so I think it’s ok.
      - monocasa 7y ago
        A lot of Macs get used for video editing where they love their SANs. This cuts into video editing perf.
        _rs 7y ago
        Just to clarify, this would only be a problem if the user had network extensions installed (and potentially lots of them, depending on implementation)? It could have negligible impact if the video editing workstation didn't have these installed, if I'm reading this right?
emmelaich 7y ago
> great for security That depends doesn't it? You'll be safe from Little Snitch but Little Snitch will have less power to protect you.
- keehun 7y ago
  That's not necessarily true. The article mentions this. While ObDev still doesn't have all the APIs necessary to implement all the features of Little Snitch using NetworkExtensions, they are working on it with Apple and feature-parity is not expected to be an issue for the 10.16 release.
  - vonseel 7y ago
    Are they a big enough developer to really influence Apples API design? I’d think companies like VMWare etc. are more likely to be able to push and prod Apple to do something than a little guy like the Little Snitch dev.
    - aeontech 7y ago
      I don't think they'd say "we're working with Apple" if that wasn't the case. Also, I wouldn't be surprised if people working on the Network Extension framework were exactly the kind of people who want to be able to continue use Little Snitch themselves.
      - deleted 7y ago
        [deleted]
    - bradgessler 7y ago
      Little Snitch might be the penultimate use case for Apple. If they’re using all the features and are a small highly competent team, they’re probably much easier to work with and can iterate much faster than a huge company the size of VMWare etc.
      - brian-armstrong 7y ago
brianpgordon 7y ago
It may be a technically superior API but even so I'm not thrilled that if I want to stay current with MacOS updates past the phase-out period then I have to pay for a Little Snitch 5 license. v4 works fine for me and without this API deprecation issue I almost certainly wouldn't be interested in upgrading.
m463 7y ago
no. Apple will just slowly write itself into the equation so that little snitch can no longer mess with whatever muddled idea apple seems to think is important. Already with Catalina you have to connect to apple and ask permission before you can even install little snitch. That means little snitch can't protect you from apple, even if you've told apple "my machine doesn't connect to the internet". And your machine contacts apple every bit as often as microsoft machines even though their philosophy is supposed to be different. bottom line: you should not have to ask apple permission to do anything with your machine.
- firstbabylonian 7y ago
  Apple has no reason to care about UNIX philosophy at this point at this point though, do they?
  - pjmlp 7y ago
    UNIX philosophy is a cargo cult worshiped by FOSS followers that never worked with commercial UNIX vendors, or ever bothered reading GNU man pages end to end. From those commercial vendors, I have worked with Xenix, DG/UX, Solaris, Aix, HP-UX, Tru64. None of them ever cared about being philosophers.

CameronNemo 7y ago

What if that has an impact on performance? Kernel-user space communication usually means copying data into different portions of memory, plus a context switch.

ancarda 7y ago
We shouldn't ever trade security for performance. Doing that is how Microsoft ended up putting shit like font rendering into the kernel. Made Windows very fast, but made it so much worse when a bug was found.
- hayez1 7y ago
  Sometimes it does make sense to trade security for performance.
  - ancarda 7y ago
    I completely disagree. Can you give me an example? Perhaps you can change my mind.
    - hayez1 7y ago
      I can't give you an example but it's perfectly plausible that many users don't store volatile data on their computer and/or are not careless with downloading and running programs. These users might prefer the extra speed up.
    - scarejunba 7y ago
      We ran a 100-petabyte cluster with all Meltdown/Spectre mitigation turned off because there was no foreign code running on it that didn't have access to the data itself. It's all about the threat model. Engineers at the company were considered trusted actors and they were the only ones permitted to connect. If that layer failed, there is no way cache invalidation errors would be the fastest way in.
    - riquito 7y ago
      /dev/random vs /dev/urandom, you could argue that a new seed via /dev/random is somewhat better, but you wouldn't block everything constantly to get new entropy
      - saagarjha 7y ago
        /dev/urandom is better than /dev/random in almost every case, so much so that on macOS they are identical.
    - plorkyeran 7y ago
      A machine which is turned off is much slower and more secure than a machine which is turned on, but for some reason people insist on turning their computers on. Security mechanisms which prevent you from doing the thing you're setting out to do are worthless. Making a computer too slow to be useful is one of the ways to do that. In this specific case, if moving Little Snitch's functionality to userland means that the performance hit of running it was large enough that I have to turn it off when doing network performance sensitive things (say, video conferences) then it'd be a net loss in security compared to the status quo of it running in kernel mode.
    - fulafel 7y ago
      Frequently security = correctness.
  - keehun 7y ago
    Agreed. Remember ancarda, it's always about the threat modeling. Every scenario has different business/user needs, and therefore, different tradeoffs that can/will be made. Sometimes, it does make sense to trade performance for security. (N.B. not always, or actually, probably not most of the time.)
- cortesoft 7y ago
  This is impossible... perfect security would require not having ANY performance. All security is about trade offs, and the answer can't be "trade everything for security"
- overgard 7y ago
  That's pretty broad. I have a gaming machine with practically no personal data on it, I just want it to be fast. But the tradeoffs for my work machine are way different. Security is ALWAYS a tradeoff. If we wanted perfect airline security we'd fly naked. Also not like limiting vulnerabilities to user space is always a big improvement. If someone hacks my user account on a single user computer, they have access to all the data I care about anyway. They could ransomeware my stuff even without kernel access.
  - philistine 7y ago
    A gaming machine with no personal data on it. We call that a console, and they are indeed built for speed above all else.
    - Hamuko 7y ago
      Consoles are really built for a price point above all else. Hence why they're always lacking in performance compared to contemporary gaming PCs.
      - sitkack 7y ago
        They also take security very very seriously.
        StavrosK 7y ago
        Consoles take DRM safety seriously, the fact that that aligns with user security is purely coincidental.
    - m463 7y ago
      Except companies are really quite adept at identifying the person connected to all the "no personal data".
  - rasteau 7y ago
    The trade off is not installing Little Snitch.
- yjftsjthsd-h 7y ago
  I trust that you're typing your comment from OpenBSD? After all, it's the only modern OS that doesn't compromise against security.
  - ancarda 7y ago
    Not yet, though I am working on replacing proprietary software I use with free software that's Linux/BSD compatible. It's a long journey - started using Windows. macOS is a nice gap-stop, but the long term destination is probably something like OpenBSD or Qubes OS. Perhaps eventually replacing much of the old software on my machine with stuff written in memory safe languages like Rust. There's some far-off efforts like Redox OS that may well end up being an option for me. I keep my eye on security developments and I try to improve my situation as and when I have the time/energy to. EDIT: To say, I have also switched from iOS to Android - after many years of waiting till Android itself became more secure. I've also dumped a lot of non-free software like Google Authenticator for free alternatives like andOTP. I'd like to eventually run something like Replicant or whatever is current/actively developed in the future.
    - GoofballJones 7y ago
      I did the opposite, went from Android to iOS because of security. I'd rather live in this "walled garden" instead of the vulnerabilities that pop up in Android now and then, the malware that's always popping up in their app-store, and finally the fact that Google is always looking over your shoulder at everything you do, even despite how much you "turn off" things in the OS, it still phones home. Microsoft is the same. I'm tired of it. Not to mention that Android manufacturers idea of an "update" to the OS means you basically have to buy a newer model, as they often lag months behind on software/security updates from Google, and Apple supports their phones and tablets with updates years after. For instance, Google only provides updates to their Pixel phones for 3 years. Meanwhile, my wife's iPhone 6s is still chugging along with the latest OS after 5 years. But this is just me. Everyone should use what they are comfortable with.
      - GoofballJones 7y ago
- Threeve303 7y ago
  Trading security for performance is never a good idea. In this case the downside might be that traffic is able to pass through undetected as a result of moving to user space. If your goal is security through monitoring, can you really trust monitoring software that can't see everything?
gok 7y ago
The whole point of this application is that the information is bounced to user space.
- saagarjha 7y ago
  Only when necessary.
GeekyBear 7y ago
Windows moved basic graphics driver functionality to user space many, many years ago. (Windows Vista) >Badly written device drivers can cause severe damage to a system (e.g., BSoD and data corruption) since all standard drivers have high privileges when accessing the kernel directly. The User-Mode Driver Framework insulates the kernel from the problems of direct driver access, instead providing a new class of driver with a dedicated application programming interface at the user level of interrupts and memory management. If an error occurs, the new framework allows for an immediate driver restart without impacting the system. https://en.m.wikipedia.org/wiki/User-Mode_Driver_Framework https://en.m.wikipedia.org/wiki/User-Mode_Driver_Framework Has Windows suffered from this change or has the added stability of having a graphics stack capable of restarting itself on error instead of blue screening the entire machine been a good thing?
- wmf 7y ago
  Graphics and network stacks are very different. It sounds like macOS is going to have the entire network stack in the kernel except for extensions; this could be the worst of all worlds for performance.
  - flatiron 7y ago
    Gotta get rid of all my Mac OS network switches.... I think they value the security and reliability from evicting those kernel extensions and nobody dreams of using this in some high performance production switch so I think it’s ok.
    - monocasa 7y ago
      A lot of Macs get used for video editing where they love their SANs. This cuts into video editing perf.
      - _rs 7y ago
        Just to clarify, this would only be a problem if the user had network extensions installed (and potentially lots of them, depending on implementation)? It could have negligible impact if the video editing workstation didn't have these installed, if I'm reading this right?

emmelaich 7y ago

> great for security That depends doesn't it? You'll be safe from Little Snitch but Little Snitch will have less power to protect you.

keehun 7y ago
That's not necessarily true. The article mentions this. While ObDev still doesn't have all the APIs necessary to implement all the features of Little Snitch using NetworkExtensions, they are working on it with Apple and feature-parity is not expected to be an issue for the 10.16 release.
- vonseel 7y ago
  Are they a big enough developer to really influence Apples API design? I’d think companies like VMWare etc. are more likely to be able to push and prod Apple to do something than a little guy like the Little Snitch dev.
  - aeontech 7y ago
    I don't think they'd say "we're working with Apple" if that wasn't the case. Also, I wouldn't be surprised if people working on the Network Extension framework were exactly the kind of people who want to be able to continue use Little Snitch themselves.
    - deleted 7y ago
      [deleted]
  - bradgessler 7y ago
    Little Snitch might be the penultimate use case for Apple. If they’re using all the features and are a small highly competent team, they’re probably much easier to work with and can iterate much faster than a huge company the size of VMWare etc.
    - brian-armstrong 7y ago

brianpgordon 7y ago

It may be a technically superior API but even so I'm not thrilled that if I want to stay current with MacOS updates past the phase-out period then I have to pay for a Little Snitch 5 license. v4 works fine for me and without this API deprecation issue I almost certainly wouldn't be interested in upgrading.

m463 7y ago

no. Apple will just slowly write itself into the equation so that little snitch can no longer mess with whatever muddled idea apple seems to think is important. Already with Catalina you have to connect to apple and ask permission before you can even install little snitch. That means little snitch can't protect you from apple, even if you've told apple "my machine doesn't connect to the internet". And your machine contacts apple every bit as often as microsoft machines even though their philosophy is supposed to be different. bottom line: you should not have to ask apple permission to do anything with your machine.

firstbabylonian 7y ago
Apple has no reason to care about UNIX philosophy at this point at this point though, do they?
- pjmlp 7y ago
  UNIX philosophy is a cargo cult worshiped by FOSS followers that never worked with commercial UNIX vendors, or ever bothered reading GNU man pages end to end. From those commercial vendors, I have worked with Xenix, DG/UX, Solaris, Aix, HP-UX, Tru64. None of them ever cared about being philosophers.