10 ms·

macOS Free and Open-Source Security Tools by Objective-See

402 points by behnamoh 4y ago

7174n6 4y ago
Some of the best documentation I've ever seen. Click on the "Learn More" for any of the apps (I suggest ransomwhere). Other software developers should take note that this is how it should be done.
shekhar101 4y ago
Very cool! Does anyone know of such OSS tools collection for Windows? Desperately looking for some good solution for a server I run for a small office.
- the_prophet314 4y ago
  I am working on this, https://www.appswithcode.org/?q=windows https://www.appswithcode.org/?q=windows , It is far from ready, but it is meant to solve such problems.
- asicsp 4y ago
  check out https://www.nirsoft.net/ https://www.nirsoft.net/ Discussions: https://hn.algolia.com/?q=nirsoft https://hn.algolia.com/?q=nirsoft
  - sheerun 4y ago
    It's not Open Source, just freeware. I would not trust anything not Open Source to filter my connections.
    - phorkyas82 4y ago
      Somehow the code is not linked in the blog posts, but it seems to be there: https://github.com/objective-see?tab=repositories https://github.com/objective-see?tab=repositories
      - asicsp 4y ago
        Not open source comment was for Nirsoft, not about Objective-See (and I just checked, source code link is present on home page as well as individual articles)
- deleted 4y ago
  [deleted]
- Fnoord 4y ago
  What you can do is run Windows through Proxmox. On Linux, I use OpenSnitch. The name's based on LittleSnitch. Its a layer 7 firewall. Quite polished these days.
chetangoti 4y ago
I'm using LuLu since few months and find it absolutely helpful. When I first installed it, it required quite some efforts to consciously filter/allow traffic from/to for the apps. By the time, all regular apps were properly configured for the rules and now I see notifications for block/allow only when there is uncertain traffic going out. Definitely recommend to give it a try.
sheerun 4y ago
I wish LuLu had some kind of logging though, and asynchronous rule adding (i.e. no need to take decision when connection happens and block by default, and then review this list when I have time), otherwise it at some point you just start accepting connections for all processes without thinking, just to not be distracted too often.
- aasasd 4y ago
  Perhaps a good start would be to habitually deny connections instead of allowing them. Otherwise the need for Lulu is rather unclear.
robinhoodexe 4y ago
How is LuLu compared to littlesnitch? And is it even useful anymore with macOS being increasingly locked down (see https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816).
- sheerun 4y ago
  LuLu you can build yourself. Both protect you from 3rd party apps, not Apple, as Apple can do whathever the ** it wants to your computer through updates.
  - deleted 4y ago
    [deleted]
  - simonh 4y ago
    You can't disable automatic updates?
    - personalidea 4y ago
      You can.
      - deleted 4y ago
        [deleted]
  - sneak 4y ago
    False. Little Snitch can block connections from all processes in the OS, including the Apple factory ones.
- least 4y ago
  This was fixed almost immediately after this came about.
- 8fingerlouie 4y ago
  > How is LuLu compared to littlesnitch? Last i tried LuLu it worked similar to Littlesnitch, though nowhere near as "polished". The basic functionality is more or less the same though, with Littlesnitch offering to automatically unblock known "trusted" services like Apples own services. > And is it even useful anymore with macOS being increasingly locked down It's an application firewall, so even if MacOS is locked down, any app can still roam freely (within it's jail). Suppose some app has access to your contacts, that means it can still upload every contact to a server, and an application firewall can help you detect/block that.
krono 4y ago
These tools send telemetry to Sentry (or at least the ones I evaluated did, which I believe were Lulu and TaskExplorer). Personally I'm not comfortable with this due to the level of access they require and thought it worth to mention.
- fnord123 4y ago
  Lulu setup for Sentry seems to be for crash dumps being sent: https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361bb1052b3c409330a1ec1b05/LuLu/Extension/main.m#L38 https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361... It does seem like a good idea that this could be disabled but now it's hard coded. Issue on the topic: https://github.com/objective-see/LuLu/issues/488 https://github.com/objective-see/LuLu/issues/488
  - krono 4y ago
    This particular line in the developer's response[1] leads me to believe they don't - or at least don't properly - validate third party dependency changes, which is even more worrying if I'm honest: > I will look into why Sentry.io is being contacted so often! This is strange as unless they changed their SDK/framework, is only supposed to happen on a crash report. 1: https://github.com/objective-see/LuLu/issues/488#issuecomment-1257292982 https://github.com/objective-see/LuLu/issues/488#issuecommen...
    - AdamGibbins 4y ago
      That's a poor characterisation, I'm not convinced any developer can say with 100% certainty they've never missed anything in the release notes of their dependencies or had any unexpected behaviour in changes that made it to production. Mistakes happen.
      - krono 4y ago
        The nature and capabilities of these products makes me significantly less forgiving towards these sorts of mistakes, however. Just to be clear I have no ill will towards this developer or their products.
foxbee 4y ago
Ohhh i've never heard of whatsyoursign - awesome list. cheers
delta_p_delta_x 4y ago
> Objective-See Heh, I C what you did there.
- behnamoh 4y ago
  Seems you can C #.
- deleted 4y ago
  [deleted]
agotterer 4y ago
I’ve been using KnockKnock, RansomWhere?, BlockBlock, and OverSight for many years. They are great pieces of software that are simple to use and do what’s advertised. The biggest issue I’ve had is memory consumption issues with OverSight.
Varloom 4y ago
KnockKnock is pretty useful. I run it once a month to make sure nothing out of ordinary is installed on my Mac. I once found out that a VPN that I have uninstalled long time ago still has shady entry in the login items thanks to KnockKnock.
theden 4y ago
Hate to say it, but I used to use their tools, but since moving to little snitch (and micro snitch), I don't really have a need for them. Some of the tools are still useful to have installed though.
- s__s 4y ago
  Little snitch is top notch software. Can’t recommend enough.
davbryn 4y ago
When will websites stop asking me to sign up for a newsletter before I've even seen the content? I closed immediately. Just honest feedback
- ncr100 4y ago
  I know it's a rhetorical question. An answer could possibly be: 1. when our "browsing, and information self-exposure" tools are better (automatic note taking parrot robot that sits on your shoulder and remembers everything you've seen so you don't have to) and 2. when our Internet's base concepts are more equitable to content creators/intellectual property owners. More: For number one, obviously it's handy if you're interested in a website to be reminded of that website latest and greatest successes. Number two, with the Lamina1 news recently it's got me thinking again about the inequitable economy of providing useful advances and information for free, or in this case tools, and then not being respected by the world in a way which the pressures of reality direct you to collapse or shut down your fantastic enterprise .. again in this case of creating macos anti-malware tools. (Social comment: I see identifying a UX problem is one step in responding to someone's work, and the ramification of talking about your frustration is another. There's at least one more you can do, call to action: how would you, Message Poster with the beef against that UX, have offered to solve, or make better, these problems responsibly if you were the owner of the website?)
  - zdragnar 4y ago
    Not OP, but have similar behavior. Maybe I'm overthinking things, but I think you're blowing the gripe out of proportion. Showing me a newsletter signup before I've read the content implies that I'm interested in getting more of what I expect the content will be about, not what it actually is. Asking me to sign up for more interesting sounding titles before I've even had a chance to decide if I enjoy the content within implies that you, the content author, don't actually care if I enjoyed the content. What you're most interested in is pushing more clickbait titles in my face. Put a newsletter sign up button near the end of the content, or in a side bar next to the content- anywhere that makes it seem like I'll get more of the content I am enjoying.
- 4y ago

402 points by behnamoh 4y ago

Some of the best documentation I've ever seen. Click on the "Learn More" for any of the apps (I suggest ransomwhere). Other software developers should take note that this is how it should be done.

shekhar101 4y ago

Very cool! Does anyone know of such OSS tools collection for Windows? Desperately looking for some good solution for a server I run for a small office.

the_prophet314 4y ago
I am working on this, https://www.appswithcode.org/?q=windows https://www.appswithcode.org/?q=windows , It is far from ready, but it is meant to solve such problems.
asicsp 4y ago
check out https://www.nirsoft.net/ https://www.nirsoft.net/ Discussions: https://hn.algolia.com/?q=nirsoft https://hn.algolia.com/?q=nirsoft
- sheerun 4y ago
  It's not Open Source, just freeware. I would not trust anything not Open Source to filter my connections.
  - phorkyas82 4y ago
    Somehow the code is not linked in the blog posts, but it seems to be there: https://github.com/objective-see?tab=repositories https://github.com/objective-see?tab=repositories
    - asicsp 4y ago
      Not open source comment was for Nirsoft, not about Objective-See (and I just checked, source code link is present on home page as well as individual articles)
deleted 4y ago
[deleted]
Fnoord 4y ago
What you can do is run Windows through Proxmox. On Linux, I use OpenSnitch. The name's based on LittleSnitch. Its a layer 7 firewall. Quite polished these days.

chetangoti 4y ago

I'm using LuLu since few months and find it absolutely helpful. When I first installed it, it required quite some efforts to consciously filter/allow traffic from/to for the apps. By the time, all regular apps were properly configured for the rules and now I see notifications for block/allow only when there is uncertain traffic going out. Definitely recommend to give it a try.

sheerun 4y ago

I wish LuLu had some kind of logging though, and asynchronous rule adding (i.e. no need to take decision when connection happens and block by default, and then review this list when I have time), otherwise it at some point you just start accepting connections for all processes without thinking, just to not be distracted too often.

aasasd 4y ago
Perhaps a good start would be to habitually deny connections instead of allowing them. Otherwise the need for Lulu is rather unclear.

robinhoodexe 4y ago

How is LuLu compared to littlesnitch? And is it even useful anymore with macOS being increasingly locked down (see https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816).

sheerun 4y ago
LuLu you can build yourself. Both protect you from 3rd party apps, not Apple, as Apple can do whathever the ** it wants to your computer through updates.
- deleted 4y ago
  [deleted]
- simonh 4y ago
  You can't disable automatic updates?
  - personalidea 4y ago
    You can.
    - deleted 4y ago
      [deleted]
- sneak 4y ago
  False. Little Snitch can block connections from all processes in the OS, including the Apple factory ones.
least 4y ago
This was fixed almost immediately after this came about.
8fingerlouie 4y ago
> How is LuLu compared to littlesnitch? Last i tried LuLu it worked similar to Littlesnitch, though nowhere near as "polished". The basic functionality is more or less the same though, with Littlesnitch offering to automatically unblock known "trusted" services like Apples own services. > And is it even useful anymore with macOS being increasingly locked down It's an application firewall, so even if MacOS is locked down, any app can still roam freely (within it's jail). Suppose some app has access to your contacts, that means it can still upload every contact to a server, and an application firewall can help you detect/block that.

krono 4y ago

These tools send telemetry to Sentry (or at least the ones I evaluated did, which I believe were Lulu and TaskExplorer). Personally I'm not comfortable with this due to the level of access they require and thought it worth to mention.

fnord123 4y ago
Lulu setup for Sentry seems to be for crash dumps being sent: https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361bb1052b3c409330a1ec1b05/LuLu/Extension/main.m#L38 https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361... It does seem like a good idea that this could be disabled but now it's hard coded. Issue on the topic: https://github.com/objective-see/LuLu/issues/488 https://github.com/objective-see/LuLu/issues/488
- krono 4y ago
  This particular line in the developer's response[1] leads me to believe they don't - or at least don't properly - validate third party dependency changes, which is even more worrying if I'm honest: > I will look into why Sentry.io is being contacted so often! This is strange as unless they changed their SDK/framework, is only supposed to happen on a crash report. 1: https://github.com/objective-see/LuLu/issues/488#issuecomment-1257292982 https://github.com/objective-see/LuLu/issues/488#issuecommen...
  - AdamGibbins 4y ago
    That's a poor characterisation, I'm not convinced any developer can say with 100% certainty they've never missed anything in the release notes of their dependencies or had any unexpected behaviour in changes that made it to production. Mistakes happen.
    - krono 4y ago
      The nature and capabilities of these products makes me significantly less forgiving towards these sorts of mistakes, however. Just to be clear I have no ill will towards this developer or their products.

foxbee 4y ago

Ohhh i've never heard of whatsyoursign - awesome list. cheers

delta_p_delta_x 4y ago

> Objective-See Heh, I C what you did there.

behnamoh 4y ago
Seems you can C #.
deleted 4y ago
[deleted]

agotterer 4y ago

I’ve been using KnockKnock, RansomWhere?, BlockBlock, and OverSight for many years. They are great pieces of software that are simple to use and do what’s advertised. The biggest issue I’ve had is memory consumption issues with OverSight.

Varloom 4y ago

KnockKnock is pretty useful. I run it once a month to make sure nothing out of ordinary is installed on my Mac. I once found out that a VPN that I have uninstalled long time ago still has shady entry in the login items thanks to KnockKnock.

theden 4y ago

Hate to say it, but I used to use their tools, but since moving to little snitch (and micro snitch), I don't really have a need for them. Some of the tools are still useful to have installed though.

s__s 4y ago
Little snitch is top notch software. Can’t recommend enough.

davbryn 4y ago

When will websites stop asking me to sign up for a newsletter before I've even seen the content? I closed immediately. Just honest feedback

ncr100 4y ago
I know it's a rhetorical question. An answer could possibly be: 1. when our "browsing, and information self-exposure" tools are better (automatic note taking parrot robot that sits on your shoulder and remembers everything you've seen so you don't have to) and 2. when our Internet's base concepts are more equitable to content creators/intellectual property owners. More: For number one, obviously it's handy if you're interested in a website to be reminded of that website latest and greatest successes. Number two, with the Lamina1 news recently it's got me thinking again about the inequitable economy of providing useful advances and information for free, or in this case tools, and then not being respected by the world in a way which the pressures of reality direct you to collapse or shut down your fantastic enterprise .. again in this case of creating macos anti-malware tools. (Social comment: I see identifying a UX problem is one step in responding to someone's work, and the ramification of talking about your frustration is another. There's at least one more you can do, call to action: how would you, Message Poster with the beef against that UX, have offered to solve, or make better, these problems responsibly if you were the owner of the website?)
- zdragnar 4y ago
  Not OP, but have similar behavior. Maybe I'm overthinking things, but I think you're blowing the gripe out of proportion. Showing me a newsletter signup before I've read the content implies that I'm interested in getting more of what I expect the content will be about, not what it actually is. Asking me to sign up for more interesting sounding titles before I've even had a chance to decide if I enjoy the content within implies that you, the content author, don't actually care if I enjoyed the content. What you're most interested in is pushing more clickbait titles in my face. Put a newsletter sign up button near the end of the content, or in a side bar next to the content- anywhere that makes it seem like I'll get more of the content I am enjoying.
4y ago