5 ms·

CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Por

by dhaavi 4y ago

CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Portmaster was shared on HN and we hit front page [1]. With the help of our testers - many of you! - we were able to mature and develop Portmaster to hit this milestone. We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible for everyone, while hackers and tinkerers should have the tools to customize everything to their needs. So while Portmaster 1.0 is a big milestone, this is just the start! [1]: https://news.ycombinator.com/item?id=29761978 https://news.ycombinator.com/item?id=29761978 [2]: https://star-history.com/#safing/portmaster&Date https://star-history.com/#safing/portmaster&Date

OrvalWintermute 4y ago
Looks intriguing. A few questions: (1) Are you planning on having support for more than 5 devices at a future point? (2) Will you have any features to support parents protection of their children? (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? (5) Is this coming for iOS & MacOS? Thanks for pushing the privacy front.
- dhaavi 4y ago
  Thanks for your interest. (1) Are you planning on having support for more than 5 devices at a future point? 5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). (2) Will you have any features to support parents protection of their children? We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? We had a couple lifetime plans on our Kickstarter (years ago). Right now, we don't have any plans for this. You can pay in advance though - up to 4 years. (5) Is this coming for iOS & MacOS? Yes. Or, at least we will attempt. Going to be "fun" if Apple continues their locking down strategy. Maybe the EU will force them to open up until then. Expect at least 1-2 years for this to land though.
  - mdip 4y ago
    Rather insightful on (2) with regard to: > ... we need to start protecting against the person in front of the device My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original state, they won't touch it again. :o). But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?
    - dhaavi 4y ago
      Yes. Good points. Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast. (I also think the original question was more about blocking features and the likes.) Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.
  - OrvalWintermute 4y ago
    >(1) Are you planning on having support for more than 5 devices at a future point? >5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). I'd estimate for a family plan (my case) we'd have 5 users. Given that I am on HN and part of the technocrati collective we have a ton of devices, particularly once your iOS & Mac OS coverage kicks in too. >(2) Will you have any features to support parents protection of their children? >We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! I think it would be person in front of the device, but a NSFW filter list is the min requirement, sounds like you already meet that. >(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? >Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. Aggregating logs across all devices protected. I don't know if syslog would be best, as there are options Unified console for centralized control of all instances would be a stretch goal
runlevel1 4y ago
Congrats on releasing 1.0! It looks very cool. A few questions about Portmaster Unlimited and SPN: 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?
- dhaavi 4y ago
  Thanks! 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? Everyone can join. We also plan to compensate in some way in the future. Docs: https://docs.safing.io/spn/hosting-a-community-node https://docs.safing.io/spn/hosting-a-community-node 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. We rent servers. If you have the SPN, you can click on every server on the map and check where it is hosted. Currently mainly Hetzner, OVH, Katamera, HostHatch. We regularly try new providers, rent a couple servers and see how it goes. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual? The client "pins" destination domains/IPs to an exit for an hour (scoped per app) in order to get more stability here. We had issues in the past.
csdvrx 4y ago
Congrats! Just one question: In the past, postmaster had problems with WSL2. I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_breaks_wsl2_in_windows_11_a_guide_to/ https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b... Is it fixed now?
- dhaavi 4y ago
  We still don't have first-class support for VMs, but it will come.
  - csdvrx 4y ago
    Did you read the link? Just add a PowerShell script at install time to exempt the virtual network interfaces from Windows Firewall if WSL is detected and the user agrees! It's super simple and easy.
slurpmaker 4y ago
Looks like a nice project! What library are you using for a front end here?
- dhaavi 4y ago
  Angular with TailwindCSS. Currently running in an electron instance, with the plan to switch (back) to a webview provided by the OS. UI is served by the background process, so you can also open it in the browser at 127.0.0.1:817 - if you have development mode enabled.
maxloh 4y ago
Hi. After a quick look, I found that the codebase spread across several repos. e.g. safing/portmaster, safing/portmaster-ui and safing/portmaster-packaging. I didn't found any guides regarding building from source. How can I build the app/installer by myself?
- dhaavi 4y ago
  Yes, we definitely want to improve here. The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension. Can you elaborate on your use case? [0] https://docs.safing.io/portmaster/architecture/update-system#resources-explained https://docs.safing.io/portmaster/architecture/update-system...
  - maxloh 4y ago
    It is not about use cases. Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time. Is compiling locally not possible without the signing cert?
    - dhaavi 4y ago
      I understand. Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions. Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate. As I said, this is an area where we need to improve.
borissk 4y ago
Which versions of Windows do you support? Also what happens with the firewall that ships with Windows when you install Safing?
- dhaavi 4y ago
  Q: Which versions of Windows do you support? Windows 10+11 full. Windows 7+8 without desktop notifications. Q: Also what happens with the firewall that ships with Windows when you install Safing? Currently nothing. It stays there and active as it is.
  - borissk 4y ago
    Thanks for the answers. Would you recommend to manually disable the Windows firewall?

by dhaavi 4y ago

OrvalWintermute 4y ago

Looks intriguing. A few questions: (1) Are you planning on having support for more than 5 devices at a future point? (2) Will you have any features to support parents protection of their children? (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? (5) Is this coming for iOS & MacOS? Thanks for pushing the privacy front.

dhaavi 4y ago
Thanks for your interest. (1) Are you planning on having support for more than 5 devices at a future point? 5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). (2) Will you have any features to support parents protection of their children? We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? We had a couple lifetime plans on our Kickstarter (years ago). Right now, we don't have any plans for this. You can pay in advance though - up to 4 years. (5) Is this coming for iOS & MacOS? Yes. Or, at least we will attempt. Going to be "fun" if Apple continues their locking down strategy. Maybe the EU will force them to open up until then. Expect at least 1-2 years for this to land though.
- mdip 4y ago
  Rather insightful on (2) with regard to: > ... we need to start protecting against the person in front of the device My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original state, they won't touch it again. :o). But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?
  - dhaavi 4y ago
    Yes. Good points. Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast. (I also think the original question was more about blocking features and the likes.) Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.
- OrvalWintermute 4y ago
  >(1) Are you planning on having support for more than 5 devices at a future point? >5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). I'd estimate for a family plan (my case) we'd have 5 users. Given that I am on HN and part of the technocrati collective we have a ton of devices, particularly once your iOS & Mac OS coverage kicks in too. >(2) Will you have any features to support parents protection of their children? >We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! I think it would be person in front of the device, but a NSFW filter list is the min requirement, sounds like you already meet that. >(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? >Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. Aggregating logs across all devices protected. I don't know if syslog would be best, as there are options Unified console for centralized control of all instances would be a stretch goal

runlevel1 4y ago

Congrats on releasing 1.0! It looks very cool. A few questions about Portmaster Unlimited and SPN: 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?

dhaavi 4y ago
Thanks! 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? Everyone can join. We also plan to compensate in some way in the future. Docs: https://docs.safing.io/spn/hosting-a-community-node https://docs.safing.io/spn/hosting-a-community-node 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. We rent servers. If you have the SPN, you can click on every server on the map and check where it is hosted. Currently mainly Hetzner, OVH, Katamera, HostHatch. We regularly try new providers, rent a couple servers and see how it goes. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual? The client "pins" destination domains/IPs to an exit for an hour (scoped per app) in order to get more stability here. We had issues in the past.

csdvrx 4y ago

Congrats! Just one question: In the past, postmaster had problems with WSL2. I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_breaks_wsl2_in_windows_11_a_guide_to/ https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b... Is it fixed now?

dhaavi 4y ago
We still don't have first-class support for VMs, but it will come.
- csdvrx 4y ago
  Did you read the link? Just add a PowerShell script at install time to exempt the virtual network interfaces from Windows Firewall if WSL is detected and the user agrees! It's super simple and easy.

slurpmaker 4y ago

Looks like a nice project! What library are you using for a front end here?

dhaavi 4y ago
Angular with TailwindCSS. Currently running in an electron instance, with the plan to switch (back) to a webview provided by the OS. UI is served by the background process, so you can also open it in the browser at 127.0.0.1:817 - if you have development mode enabled.

maxloh 4y ago

Hi. After a quick look, I found that the codebase spread across several repos. e.g. safing/portmaster, safing/portmaster-ui and safing/portmaster-packaging. I didn't found any guides regarding building from source. How can I build the app/installer by myself?

dhaavi 4y ago
Yes, we definitely want to improve here. The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension. Can you elaborate on your use case? [0] https://docs.safing.io/portmaster/architecture/update-system#resources-explained https://docs.safing.io/portmaster/architecture/update-system...
- maxloh 4y ago
  It is not about use cases. Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time. Is compiling locally not possible without the signing cert?
  - dhaavi 4y ago
    I understand. Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions. Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate. As I said, this is an area where we need to improve.

borissk 4y ago

Which versions of Windows do you support? Also what happens with the firewall that ships with Windows when you install Safing?

dhaavi 4y ago
Q: Which versions of Windows do you support? Windows 10+11 full. Windows 7+8 without desktop notifications. Q: Also what happens with the firewall that ships with Windows when you install Safing? Currently nothing. It stays there and active as it is.
- borissk 4y ago
  Thanks for the answers. Would you recommend to manually disable the Windows firewall?