5 ms·

Unfortunately without sandboxing, these sorts of tools just add an extra layer of maintenance to your system for a false sense of security [1, 2]. This can act

by Elyra 4y ago

Unfortunately without sandboxing, these sorts of tools just add an extra layer of maintenance to your system for a false sense of security [1, 2]. This can actually be harmful for less experienced Linux users who may trust something like this to keep them safe for running random scripts, especially since I see this tool often recommended for such a use case. [1] https://news.ycombinator.com/item?id=22208223 https://news.ycombinator.com/item?id=22208223 [2] https://news.ycombinator.com/item?id=14254679 https://news.ycombinator.com/item?id=14254679

GekkePrutser 4y ago
It's not just to avoid scripts. Sometimes I just what to control what a program can do. Eg not call home but connect to ftp servers I want to use it with.
- Elyra 4y ago
  I'm sorry, I should have clarified that my criticism was that these sorts of tools often get recommended as a security tool that can protect you from malware/spyware. There are still valid use cases for it like what TripMode for Mac is marketed towards. Also if you're using it to prevent an app not to phone home, you still have to trust it not to do anything more nefarious than that, or simply spawn a program like curl (which you've probably allowed) to phone home for it.
nathants 4y ago
the issue is that libnetfilterqueue doesn’t have pid information, and so that must be looked up or joined to another data stream at runtime. this can fail. flakes at this point can be dangerous, and can reduce confidence in the system. they can also encourage you to add rules at both system and program level, which is annoying. one alternative is to specify rules at system level instead of program level. that’s the approach i ended up landing on[1]. i wish i had finer granularity, but i’m glad i don’t have flakes. it’s hard to imagine that monitoring network exfil isn’t THE best way to secure any system. at the least, it’s an important and necessary step. 1. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch
Pakdef 4y ago
Firewalls have not much to do with running untrusted executables... You are confused about what a firewall is for (it's for managing network connections, not prevent virus, etc)...

by Elyra 4y ago

GekkePrutser 4y ago

It's not just to avoid scripts. Sometimes I just what to control what a program can do. Eg not call home but connect to ftp servers I want to use it with.

Elyra 4y ago
I'm sorry, I should have clarified that my criticism was that these sorts of tools often get recommended as a security tool that can protect you from malware/spyware. There are still valid use cases for it like what TripMode for Mac is marketed towards. Also if you're using it to prevent an app not to phone home, you still have to trust it not to do anything more nefarious than that, or simply spawn a program like curl (which you've probably allowed) to phone home for it.

nathants 4y ago

the issue is that libnetfilterqueue doesn’t have pid information, and so that must be looked up or joined to another data stream at runtime. this can fail. flakes at this point can be dangerous, and can reduce confidence in the system. they can also encourage you to add rules at both system and program level, which is annoying. one alternative is to specify rules at system level instead of program level. that’s the approach i ended up landing on[1]. i wish i had finer granularity, but i’m glad i don’t have flakes. it’s hard to imagine that monitoring network exfil isn’t THE best way to secure any system. at the least, it’s an important and necessary step. 1. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch

Pakdef 4y ago

Firewalls have not much to do with running untrusted executables... You are confused about what a firewall is for (it's for managing network connections, not prevent virus, etc)...