5 ms·

These tools send telemetry to Sentry (or at least the ones I evaluated did, which I believe were Lulu and TaskExplorer). Personally I'm not comfortable with th

by krono 4y ago

These tools send telemetry to Sentry (or at least the ones I evaluated did, which I believe were Lulu and TaskExplorer). Personally I'm not comfortable with this due to the level of access they require and thought it worth to mention.

fnord123 4y ago
Lulu setup for Sentry seems to be for crash dumps being sent: https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361bb1052b3c409330a1ec1b05/LuLu/Extension/main.m#L38 https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361... It does seem like a good idea that this could be disabled but now it's hard coded. Issue on the topic: https://github.com/objective-see/LuLu/issues/488 https://github.com/objective-see/LuLu/issues/488
- krono 4y ago
  This particular line in the developer's response[1] leads me to believe they don't - or at least don't properly - validate third party dependency changes, which is even more worrying if I'm honest: > I will look into why Sentry.io is being contacted so often! This is strange as unless they changed their SDK/framework, is only supposed to happen on a crash report. 1: https://github.com/objective-see/LuLu/issues/488#issuecomment-1257292982 https://github.com/objective-see/LuLu/issues/488#issuecommen...
  - AdamGibbins 4y ago
    That's a poor characterisation, I'm not convinced any developer can say with 100% certainty they've never missed anything in the release notes of their dependencies or had any unexpected behaviour in changes that made it to production. Mistakes happen.
    - krono 4y ago
      The nature and capabilities of these products makes me significantly less forgiving towards these sorts of mistakes, however. Just to be clear I have no ill will towards this developer or their products.
  - fnord123 4y ago
    I agree with sibling: I think you're giving it an uncharitable interpretation. There is an open issue and they are investigating to improve the situation.
  - tinus_hn 4y ago
    You’d think, if they wanted telemetry so badly they are prepared to deal with the fallout, they’d be on top of the information collected by that telemetry.
- webmobdev 4y ago
  You can block Lulu with Lulu. I think by now we should all have learnt to block internet access for every app, and only enable it if it really needs it - that's exactly what an application firewall like Lulu is for.
- cdubzzz 4y ago
  Potentially relevant that the Sentry client is configured in debug mode there. Not sure what the actual impact of that is but maybe it causes additional network traffic to Sentry (outside of crash reports)?
- beauHD 4y ago
  > crash dumps being sent Crash dumps can contain highly sensitive info. I have blocked Crashlytics[0] and Sentry with my pi-hole so nothing gets sent. I'm starting to believe these tools are abused and not even used to improve services. They're basically a MITM so people can violate other's privacy. [0] https://firebase.google.com/products/crashlytics https://firebase.google.com/products/crashlytics
  - obituary_latte 4y ago
    Can the same be done with hosts file (block crashlytics/sentry?) for those of us unable to use pi-holes at work? edit: it looks like it is working, but unknown if there are any negative side-effects at this point. └─[$] <> ping sentry.io PING sentry.io (0.0.0.0): 56 data bytes ping: sendto: Socket is not connected ping: sendto: Socket is not connected Request timeout for icmp_seq 0 ^C --- sentry.io ping statistics --- 2 packets transmitted, 0 packets received, 100.0% packet loss
    - beauHD 4y ago
      You can block the root, but usually the domain contains random (unique) strings as a subdomain, so you need to wildcard block it, which pi-hole supports.
      - obituary_latte 4y ago
        Thanks. Bummer, I figured they probably didn't use the root domain but some amalgamation of letters/number/sub-domains. I have a pi-hole at home which has been working great for 3+ years now, but I mostly run objective-see stuff on my work machine.
liamkearn 4y ago
I sent a message to slack the other day recommending Shortcat (https://shortcat.app/ https://shortcat.app/). I edited the message to mention that I use LuLu and it's worth noting that Shortcat is closed source and does send info out to sentry. Now I have to edit that same message and mention that LuLu also phones home to sentry. Can't blame people for wanting stack traces but wow it's a tricky subject in terms of privacy.
- hirvi74 4y ago
  Thanks for the heads-up. I've been using Shortcat for years, and I thought it was long since abandoned. I was even more surprised to see a new version was released last month. I seriously stopped checking on this project years ago, and just kept a backup .dmg. I am sad to read about sending out info to Sentry, but I guess that is something I am going to have to think about some more.
clairity 4y ago
you can actually use lulu itself to block sentry for all of their tools (this is what i do). i found that the only other connections they'll make is for updates--both software and rulesets (if you have that configured). lulu is not nearly as polished as hands off! (may it rest in peace) or little snitch, but it gets the job done. i also have some rules in pf (via murus gui) to block things like google and facebook on a system-wide level.
sneak 4y ago
It's troublesome that an app designed for blocking telemetry (among other things) is sending telemetry without consent. :( Software that exfiltrates your usage, crashes, or other data from your own machine without advance, opt-in, informed consent is unethical and disrespectful.

by krono 4y ago

fnord123 4y ago

Lulu setup for Sentry seems to be for crash dumps being sent: https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361bb1052b3c409330a1ec1b05/LuLu/Extension/main.m#L38 https://github.com/objective-see/LuLu/blob/dfe48c2a0f7a86361... It does seem like a good idea that this could be disabled but now it's hard coded. Issue on the topic: https://github.com/objective-see/LuLu/issues/488 https://github.com/objective-see/LuLu/issues/488

krono 4y ago
This particular line in the developer's response[1] leads me to believe they don't - or at least don't properly - validate third party dependency changes, which is even more worrying if I'm honest: > I will look into why Sentry.io is being contacted so often! This is strange as unless they changed their SDK/framework, is only supposed to happen on a crash report. 1: https://github.com/objective-see/LuLu/issues/488#issuecomment-1257292982 https://github.com/objective-see/LuLu/issues/488#issuecommen...
- AdamGibbins 4y ago
  That's a poor characterisation, I'm not convinced any developer can say with 100% certainty they've never missed anything in the release notes of their dependencies or had any unexpected behaviour in changes that made it to production. Mistakes happen.
  - krono 4y ago
    The nature and capabilities of these products makes me significantly less forgiving towards these sorts of mistakes, however. Just to be clear I have no ill will towards this developer or their products.
- fnord123 4y ago
  I agree with sibling: I think you're giving it an uncharitable interpretation. There is an open issue and they are investigating to improve the situation.
- tinus_hn 4y ago
  You’d think, if they wanted telemetry so badly they are prepared to deal with the fallout, they’d be on top of the information collected by that telemetry.
webmobdev 4y ago
You can block Lulu with Lulu. I think by now we should all have learnt to block internet access for every app, and only enable it if it really needs it - that's exactly what an application firewall like Lulu is for.
cdubzzz 4y ago
Potentially relevant that the Sentry client is configured in debug mode there. Not sure what the actual impact of that is but maybe it causes additional network traffic to Sentry (outside of crash reports)?
beauHD 4y ago
> crash dumps being sent Crash dumps can contain highly sensitive info. I have blocked Crashlytics[0] and Sentry with my pi-hole so nothing gets sent. I'm starting to believe these tools are abused and not even used to improve services. They're basically a MITM so people can violate other's privacy. [0] https://firebase.google.com/products/crashlytics https://firebase.google.com/products/crashlytics
- obituary_latte 4y ago
  Can the same be done with hosts file (block crashlytics/sentry?) for those of us unable to use pi-holes at work? edit: it looks like it is working, but unknown if there are any negative side-effects at this point. └─[$] <> ping sentry.io PING sentry.io (0.0.0.0): 56 data bytes ping: sendto: Socket is not connected ping: sendto: Socket is not connected Request timeout for icmp_seq 0 ^C --- sentry.io ping statistics --- 2 packets transmitted, 0 packets received, 100.0% packet loss
  - beauHD 4y ago
    You can block the root, but usually the domain contains random (unique) strings as a subdomain, so you need to wildcard block it, which pi-hole supports.
    - obituary_latte 4y ago
      Thanks. Bummer, I figured they probably didn't use the root domain but some amalgamation of letters/number/sub-domains. I have a pi-hole at home which has been working great for 3+ years now, but I mostly run objective-see stuff on my work machine.

liamkearn 4y ago

I sent a message to slack the other day recommending Shortcat (https://shortcat.app/ https://shortcat.app/). I edited the message to mention that I use LuLu and it's worth noting that Shortcat is closed source and does send info out to sentry. Now I have to edit that same message and mention that LuLu also phones home to sentry. Can't blame people for wanting stack traces but wow it's a tricky subject in terms of privacy.

hirvi74 4y ago
Thanks for the heads-up. I've been using Shortcat for years, and I thought it was long since abandoned. I was even more surprised to see a new version was released last month. I seriously stopped checking on this project years ago, and just kept a backup .dmg. I am sad to read about sending out info to Sentry, but I guess that is something I am going to have to think about some more.

clairity 4y ago

you can actually use lulu itself to block sentry for all of their tools (this is what i do). i found that the only other connections they'll make is for updates--both software and rulesets (if you have that configured). lulu is not nearly as polished as hands off! (may it rest in peace) or little snitch, but it gets the job done. i also have some rules in pf (via murus gui) to block things like google and facebook on a system-wide level.

sneak 4y ago

It's troublesome that an app designed for blocking telemetry (among other things) is sending telemetry without consent. :( Software that exfiltrates your usage, crashes, or other data from your own machine without advance, opt-in, informed consent is unethical and disrespectful.