14 ms·
Lulu – Mac open-source firewall that aims to block unknown outgoing connections
- wgx 6y agoInteresting to see this on the front page of HN - I've been using it happily for years, no complaints. It's illuminating to see just how "chatty" certain apps are (or wish to be!).
- thih9 6y agoI guess it’s been submitted here because of the recent v2.1.0 release, which brings Apple M1 compatibility, https://mobile.twitter.com/patrickwardle/status/1348890323175395328 https://mobile.twitter.com/patrickwardle/status/134889032317...
- dmix 6y agoSo this one says to "make sure you're using 11.1" (aka Big Sur) and the first comment on HN warns there are serious (unclosed) issues with Big Sur on their Github. Not sure who to believe but I'll pass for now.
- cutler 6y agoDoes this mean Little Snitch's days are numbered?
- tskulbru 6y agoSnitches get stitches?
- deleted 6y ago[deleted]
- tmikaeld 6y agoLittle snitch does provide some special features, like choosing which network devices shall have which rules and connection maps which shows where each connection goes on a world-map. It also keeps watch on the amount of data each app uses.
- WhoCaresLies 6y agolittle snitch looks way better and has a better UX, so nope
- nhojb 6y agoPersonally I find the LS interface way too complex and intimidating (and I say this as a long time macOS / iOS developer). Lulu has a quirky interface, but it's much clearer. Of course it also helps that it's free and open source.
- WhoCaresLies 6y agoYou are a liar Little Snitch: https://www.obdev.at/Images/littlesnitch/decide-immediately.png https://www.obdev.at/Images/littlesnitch/decide-immediately.... Lulu: https://objective-see.com/images/LL/adAlert.png https://objective-see.com/images/LL/adAlert.png You are a liar
- ngcc_hk 6y agoAny comment about cannot login in the first comment. May give it a try but if ...
- yoz-y 6y agoWhy did something happen with LS? I couldn’t find any damning headline here on HN.
- amjd 6y agoLulu is free and open source, so it could become a go to choice for many users.
- richrichardsson 6y agoI'm curious about this, as it's one of 3 kexts that I get warned about support being withdrawn in a future version of macOS (UAD being one of the others, I forget the 3rd). I could probably live without LS, but the UAD support being withdrawn is quite concerning given the level of investment I have there.
- dewey 6y agoThe latest version of LS doesn't use kernel extensions any more as it's using the new network filter stack provided by the OS.
- richrichardsson 6y agoOK, I see that it's now at version 5, so I guess another paid upgrade required when I finally move my machine to Big Sur.
- FabHK 6y agoIf so, then Little Snitch's days have been numbered for a while, as Lulu came out in 2018. VERSION 1.0.0 (08/09/2018) https://www.objective-see.com/products/changelogs/LuLu.txt https://www.objective-see.com/products/changelogs/LuLu.txt
- shusson 6y agoBe aware there are a few concerning open issues like it blocking all network requests when disabled: https://github.com/objective-see/LuLu/issues/264 https://github.com/objective-see/LuLu/issues/264 or not being able to login after installing (due to security patch needing to be installed) https://github.com/objective-see/LuLu/issues/284 https://github.com/objective-see/LuLu/issues/284
- swiley 6y agoWhat a nice and user friendly operating system.
- ecf 6y agoWhat kind of argument is this? It’s a single app... how can you judge an operating system off of something that a) probably hasn’t been updated to support changes or b) kinda buggy because it happens to be a fairly invasive program.
- a1369209993 6y agoWithout saying anything about OSX in particular, any operating system that requires network access to log in is a user-hostile piece of shit, and the linked bug#284 pretty well implies that that is in fact the case. It's entirely possible that the problem is due to incompatibities with new OS code or bugs in the firewall program (edit: ie, your case a and case b), but evidence in the bug report pretty clearly suggests that the firewall is correctly blocking all non-whitelisted network requests, and the failure to log in is due to the OS maliciously trying to phone home against the user's wishes.
- acdha 6y agoYou're making a mistake jumping to the assumption of malice rather than thinking about all of the other possibilities. This class of bugs is pretty common: people sometimes test software without a network connection at all but its far less common to test with one which drops packets but does not return errors. I've had to fix variations of this problem on Windows, Linux, and things like VMware's HA module. My guess would be that it's something like checking for things like application revocation or other updates or, if you have iCloud enabled, something like attempting to synchronize your settings or data.
- bijant 6y agoHas totally replaced Little Snitch for me recently after being increasingly annoyed by it over a decade of using it. This type of software requires lots of trust in the developer and objective-see has earned that trust with the many great projects they provide.
- coldtea 6y agoFor those confused like me: Objective-See are the makers of Lulu. Not to be confused with Objective-Dev, the makers of LittleSnitch.
- leokennis 6y agoWhat made you lose trust in Little Snitch or its developer?
- IndySun 6y ago...increasingly annoyed... What got you annoyed? I use Little Snitch 4. I very much dislike the GUI change in LS5. And it seems to be less user controllable. I do not know anything about Lulu, except the developer seems like a decent sort based on the warmth here.
- d_rc 6y agoI miss how LS was much more granular in allowing specific connections. In Lulu when I approve an app, it's all app's connections by default, unless I am creative with a regex to capture proper connections. That's a major downside compared to LS. Or am I missing something?
- deleted 6y ago[deleted]
- m463 6y agoI wonder how this works with respect to apple's "special exemptions" for its own applications. (bypass NEFilterDataProvider)
- seanieb 6y agoIIRC it was the developer of lulu that first reported those exceptions.
- webmobdev 6y agoThrere are no indications that Apple is willing to compromise and allow application firewalls to block Apple softwares that Apple believes should be able to access the internet, even if the user doesn't want it too. It's a gross invasion of privacy, and a security risk. (By the way, even in Lulu, some Apple system software - apsd, automount, helpd, mDNSResponder, mount_nfs, mount_url, ocspd, sntp, trustd - are whitelisted and cannot be blocked by the user even if they want to, and that's bit disappointing).
- pydry 6y agoDoes this mean Mac users are not really root on their own machines?
- terramex 6y agoUsers can develop and install custom kernel extensions (.kexts) that can access everything, but they first need to disable System Integrity Protection in recovery mode. Over the years Apple expanded their frameworks library to reduce need for custom .kexts, but they are still supported even on M1 Macs (as long as they are compiled for ARM64). So to answer you question - 'root' user on macOS is by default not a true root in unix sense, but can be trivially turned into one by booting computer in recovery mode and running single command in Terminal. Restart into recovery mode is required so that malicious applications cannot change it on their own, even if they would use unknown privilege escalation technique.
- 6y ago
- qwerty456127 6y agoWhat about the same for Linux? I would pay twice the LittleSnitch price for it if it was working really good.
- purrrfect 6y agoYou can use OpenSnitch on Linux. These days it's quite stable, they even have binaries.
- qwerty456127 6y agoOk, thank you for a clue, I'll give it a try. The last time I checked it was clearly very far from production-ready. It still shouts "this software is a work in progress, do not expect it to be bug free and do not rely on it for any type of security" in all caps on its homepage which suggests it still is. Given all the abandoned attempts I've seen in the past I also feel very skeptical this one too.
- phil294 6y agoWould you mind sharing your experience afterwards? The alternatives to SELinux in terms of network filtering seem to be so rare.
- dijit 6y agoI can give you mine, since I use(d) opensnitch for a while. It works quite well but requires a GUI (obviously), it looks like it primarily supports GTK. If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. It is significantly less powerful than LittleSnitch, some options don't exist (like, allowing access to a domain), but you get similar functionality in many cases. Overall, it's definitely worth testing out to see if it works for you.
- qwerty456127 6y ago> It is significantly less powerful than LittleSnitch To make it no-less powerfull somebody has to invest time and expertise into extending the kernel for it - AFAIK LittleSnitch works this way on MacOS.
- pibefision 6y agoWorks great. I replaced Little Snitch with it. I like it's simple interface and simple value proposition.
- high_density 6y agoyou know LuLu and Little Snitch are made by the same company (obj-see ... obj-c ???)
- miskin 6y agoNo, Little Snitch is made by Objective Development - https://obdev.at/ https://obdev.at/
- _qulr 6y ago"Objective-C" is the name of a programming language used for Mac development, previously the primary programming language before Swift and still popular among Mac developers. "Objective-See", the name of the maker of LuLu, is a pun on Objective-C. "Objective Development", the name of the maker of Little Snitch, is likely also based on Objective-C.
- webmobdev 6y agoLittle Snitch is more powerful though.
- webmobdev 6y agoLittle Snitch is quite powerful. A more affordable, and simpler alternative to Little Snitch is Radio Silence (https://radiosilenceapp.com/ https://radiosilenceapp.com/) and TripMode (https://tripmode.ch/ https://tripmode.ch/).
- deleted 6y ago[deleted]
- ValentineC 6y ago> I replaced Little Snitch with it. Did you purchase a Little Snitch licence? I wonder why someone would go with LuLu if they've already paid for Little Snitch, when LuLu has fewer features.
- IndySun 6y agoCan Lulu block both outgoing and incoming, like Little Snitch?
- sublimefire 6y agoawd
- sublimefire 6y agoI'm gonna be the thick one. What advantages does it give me when I have something like pi-hole as my DNS server on the internal network? Surely majority of connections need a DNS resolution. Would love to see some stats showing the amount of blocked connections that bypassed DNS.
- webmobdev 6y agoPi-hole has its advantages. But this is also an application firewall. It's a little more convenient to block a whole app then try and figure out which ip it is trying to connect and block that.
- sneak 6y agoThis allows you to block the connections per-app, and before they happen for the first time.
- swiftcoder 6y agoMalware (and I include in this definition several services shipped by the OS vendor) typically doesn't rely exclusively on DNS lookups. Many will fallback to hardcoded lists of IPv6 addresses if you blackhole DNS.
- frusciante19 6y agowhat happened to the UI? i think the fonts look just awful.
- johnjungles 6y agoI wish they made this at a router level
- sneak 6y agoThis really should be built into every OS or DE at this point. I don't put sim cards in my phones anymore, and instead use a portable LTE VPN travel router (which runs OpenWRT, on which I have root) because of the things I learned over the last decade from apps like this. There should be per-host, per-app permissions in any OS that claims to care about privacy, just as Apple recently added per-directory, per-app permissions to fight ransomware.
- seddin 6y agoIs there something like this but for Windows?
- webmobdev 6y agoYes, I used to use TinyWall ( https://tinywall.pados.hu/ https://tinywall.pados.hu/ ), which is light and simple. But, if I remember right, it uses Windows built in firewall and so I don't know if it can completely block some Windows 10 system software from contacting Microsoft. ZoneAlarm also used to be good, but used more resources and is not free - https://www.zonealarm.com/software/firewall https://www.zonealarm.com/software/firewall (note that you do not need their crap browser extensions that it will ask you to install).
- johnwalkr 6y agoI use malwarebytes after trying several options. It's merely a good interface to leverage windows firewall with a block-until allow dialogue box. For whatever reason, it's hard to find a firewall for windows that doesn't use a scammy freemium model.
- dhaavi 6y agoWe're working on a powerful (also FOSS!) alternative for Windows. It includes DNS-over-TLS and extensive firewall features. See https://safing.io/portmaster/ https://safing.io/portmaster/ It's not completely stable yet, but we are making great progress. We'd love feedback!
- hivacruz 6y agoI use it for a long time now, nice piece of software. The only problem I have is related to requests per app. For example, a Sublime Text plug-in (TabNine), even if I allow permanently outgoing connections the plug-in has to make, LuLu will keep asking me for permissions next time. There is an issue open for that matter but no fix yet apparently: https://github.com/objective-see/LuLu/issues/147 https://github.com/objective-see/LuLu/issues/147
- sloshnmosh 6y agoI have LuLu installed on an old MacBook Pro and it does work well. It comes with preset rules to allow most of the essential apps communicate with Apple but they can be overridden to stop my computer from even getting the NPT time.
- birdyrooster 6y agoNTP*