9 ms·

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectiv

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, and allow inspection of the actual traffic. What Adobe CC, Google Chrome, MS Office, and macOS/Windows itself do with this background network connectivity is completely out of control and abusive to the user. They get away with it because the vast majority of users are non-technical and don't realize it's happening. I've profiled and decrypted the background traffic on a stock Android install and the volume was also appalling. Getting macOS to 0 background traffic involved blackholing large Apple IP blocks at the router, whereas some of their processes use random IPs from these ranges and don't use DNS. Just as the general public doesn't have the awareness or ability to fight for their privacy rights I doubt any of this will ever be remedied.

Kim_Bruning 4y ago
We could go to our EU representatives and ask for them to make it mandatory. Though I suspect it'll go down the same way as the GDPR, at least at first. (Lessons have already been learned of course)
- account42 4y ago
  We really just need a clarification/ruling that ANY telemetry is not essential to providing a service and thus requires informed consent before it can be collected and consent cannote be required to use the service. And then enforcement against all these applications. I don't think adding technical layers to block these data leaks is going to work long term.
3pt14159 4y ago
> with TLS/SSL inspection built in (you'd need some OS API to enable that). I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis. You'd need to disable HSTS, but other than that I think it should be the solution you're looking for. Oh, and for good measure, ethernet cable instead of wifi.
- Acinyx 4y ago
  Any application that uses certificate pinning would fail in this situation as that's specifically what it is trying to prevent.
  - moviuro 4y ago
    You "just" need the key to the encrypted traffic. You don't have to change the handshake/negotiation, you just want a copy of the key so you can decrypt the traffic. In TLS, the client authenticates server, then they both agree to use a key for the session; the OS can get a hold of this key (this is usually a bad move because then any captured traffic frames could be later decrypted).
- kccqzy 4y ago
  A well-designed OS API doesn't need to do MitM and therefore would work with HSTS or cert pinning enabled. Of course for obvious reasons, few commercial apps would actually use this API unless they have some other incentive.
  - 3pt14159 4y ago
    Well, the original article was about Microsoft. Since they're the OS vendor too, I discounted that as being reliable for this use-case.
g_p 4y ago
I believe the Mac OS networking APIs go a little bit of the way there - in Lulu, an open source alternative to Little Snitch, the connection prompts tend to contain (and let you filter) by the URL visited (including the query after the domain name). This isn't done through TLS interception, but I believe it's through the network extension API on MacOS receiving the URL requested, as long as the request comes through the regular APIs. It's a long time since I looked, but I think some apps (mainly ones not using native APIs) only showed the hostname, rather than full URL/API endpoint path. This also didn't show you the content, or method type (POST vs GET), but to do that you'd really need to start doing proper SSL inspection as you suggested.
msla 4y ago
The Little Snitch would be asking the OS to please tell it about network traffic. Microsoft's OS. It would be asking Microsoft's OS to tell it about traffic Microsoft's software wants to keep secret. I'm sure there's a world where that isn't a laugh line, but I certainly don't live there.
- rrobukef 4y ago
  I disagree. What's a worse look: not having this OR having this and being discovered subverting their own security?
- rougka 4y ago
  OS network filtering APIs don’t work that way and another unrelated and unimportant Microsoft team can’t override it
- giaour 4y ago
  What indication is there that Microsoft wants to keep this traffic secret? The OP was able to detect and inspect this traffic with standard network monitoring software.
nbzso 4y ago
Since 2014 I don't trust my macs. There is no Apple computer without LS installed on in my company. Actually, if LS is not available, I will not use Apple computers at all. Period.
- beermonster 4y ago
  Why don't you trust your macs since 2014. Also why do you still use them if you don't trust them any longer?
  - gtufano 4y ago
    Not OP, but for me the answer to your question is: is a tool I need. I _could_ use Windows, and absolutely not Linux/BSD (for the programs/tools I need for work), and, frankly, I don't think Windows is better. Yes, I know that's not completely true. I _could_ use Linux (I even used Solaris on a notebook for 2 years in the past and I survived) but the cost in terms of effort, lost productivity would be higher than I'm ready to pay. It's a rational choice.
    - account42 4y ago
      > I _could_ use Windows, and absolutely not Linux/BSD (for the programs/tools I need for work) Are you sure of this? Wine (or Proton for graphics stuff) is pretty good.
  - mixmastamyk 4y ago
    Work only allows Mac or Win to log in to their VPN.
    - raxxorraxor 4y ago
      Change your work then. Or use windows in a VM. Always good to separate work and private system anyway.
      - mixmastamyk 4y ago
exceptione 4y ago
What I want is Little Snitch on steroids built into the OS where every process, You cannot trust an OS you cannot build yourself. That's why I see Linux as the only option for professionals and privacy minded people.
- proee 4y ago
  How do you know there are no outside efforts to log linux activities? There's a lot of source code to go through and is it possible there are callbacks even within OSS that most people are not aware of?
  - nathan_compton 4y ago
    At least its possible _in principal_ and many people out there can at least look at the code even if you can't dig through yourself. With Windows or OSX you're just out of luck.
  - LukeShu 4y ago
    OSS is necessary, but (as you point out) not sufficient.
  - dev_hugepages 4y ago
    Well at least with open source, you CAN verify it. There are people and companies who do audit You're replacing a big and unstoppable problem with a smaller one that can be mitigated
  - hutzlibu 4y ago
    It all depends of course on the level of your paranoia/threat model. To prevent standard data leaking or rather stealing like in this case, linux is a quite solid choice. But if you think you are a high profile target, you should probably learn how to deactivate Intels ME and co. And if you are really paranoid, you should assume that there are hardware backdoors. But what do you do then? Build your computer from scratch?
    - smhoff256 4y ago
IceWreck 4y ago
> What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). If you want to you can do that with Linux. Sure you'd need to use the CLI, and a combination of tools but you can pinpoint every packet to an associated process and if you add your self made cert to trusted certs, then you can decrypt TLS as well in most cases.
- twawaaay 4y ago
  Nah, you can't. The issue is the "easy monitor outgoing traffic with TLS/SSL" part. It is not impossible but it is far from easy. If the application uses statically linked SSL client (as it should if it is commercially distributed) then you have to modify the application (for example in memory) to get a copy of everything that gets written to the SSL stream.
  - kibwen 4y ago
    You know how you can do Ctrl+Shift+K in Firefox to open up the browser console and inspect all the bits of the page, see the code (and fuck with it), see all the network traffic, and so on? I dream of being able to do that for arbitrary applications. Imagine having a Super+Ctrl+Shift+K that opened an OS-level GUI showing all the pertinent details of the running program.
    - twawaaay 4y ago
      You know that this only pertains to webapps and there is still a lot of software running on your machine that you have no idea what it does?
      - kibwen 4y ago
        I am specifically referring to the ability to have the same sort of interface with non-webapps as we do with webapps.
smarkov 4y ago
For Windows, check out simplewall, it does (almost) exactly that. https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall
- m0guz 4y ago
  It has built-in support to block Windows Services/Apps/Updates without user interaction.
- M95D 4y ago
  It uses the windows firewall. Do I trust Windows firewall to block itself? NO!
  - noisem4ker 4y ago
    > It uses the windows firewall. No: "simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall"
    - M95D 4y ago
      I was referring to the firewall functionality already present in windows, not the GUI called "windows firewall".
  - hu3 4y ago
    From the README: > Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall. > It works over Windows Filtering Platform (WFP) which is a set of API and system services that provide a platform for creating network filtering applications. Windows Filtering Platform is a development technology and not a firewall itself, but simplewall is the tool that uses this technology.
  - ziml77 4y ago
    Even if it was a wrapper over Windows Firewall, why would that make you trust the filtering less? Like even if it was running fully custom ring 0 code, there's still also Windows kernel code running at the same level. Microsoft could make the kernel interfere however they want.
bergenty 4y ago
I used little snitch for so many years but stopped using it a while ago for some reason. Is it still as good as it used to be?
hmmmmmm111 4y ago
> I doubt any of this will ever be remedied. What if you didn’t use PowerPoint? Seems much simpler. Also, maybe the data makes PowerPoint good? Or better? Alternatives to PowerPoint: won’t all of the viable ones be hosted on the web? What do you want? You can install PowerPoint 97. No one is stopping you.
squarefoot 4y ago
On Linux there is OpenSnitch that does its job nicely, although I experienced some occasional desktop slowdowns even after training it to open everything for trusted programs. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch I still recall the old days of Windows when I tried Kerio Personal Firewall and realized how much software already phoned home two decades ago. That was the last wake up call that pushed me into getting rid of closed source software, possibly also hardware, especially when they connect to the internet.
- elesiuta 4y ago
  The slowdowns are because it still has to hold every connection until it can check which program it is coming from and whether that program is trusted or not, even when the same program creates multiple connections. To get around the slowdowns, I made an alternative program called picosnitch which only monitors connections since I just stop using anything I don't trust or move it to a sandbox. It also uses BPF, has fairly low CPU usage, and some other features for improved reliability and detection of programs.
- Abishek_Muthian 4y ago
  I second OpenSnitch, I haven't face any shutdowns due to it yet. For those coming from LittleSnitch on macOS might have to look into the finer details of the connection in the Allow/Deny dialog on OS to get the best results.
  - squarefoot 4y ago
    Slowdowns, not shutdowns, luckily:) The desktop (XFCE under Debian if that helps) just hung for a while like it was waiting for me to allow some rules, but didn't show the requester to do so, also the timings were random, could have been from 2 seconds to 5 or more.
    - Abishek_Muthian 4y ago
      Oops; Self-reminder to not comment on HN when half sleep. But, I haven't noticed slowdown either; I wonder whether its because I always keep the OS window open?
adrian_b 4y ago
I believe, even if I have not tried yet to do this, that you can do this in Linux if you create one or more virtual network interfaces in some namespaces, and you ensure that only that interface or those interfaces get IP addresses. Then any program that is not run inside the namespace with configured virtual network interfaces can see only unconfigured interfaces, so it will not be able to open and connect sockets. The Internet browser and any other program that needs network access, e.g. a NTP server, DHCP client, e-mail client etc., can be run inside the namespace with an IP-configured network interface. The same could be done in FreeBSD by using a jail for the programs that need network access. Obviously, this would not be enough to prevent network access for a program that would be aware of this configuration and would try to circumvent it, because such a program could list the network namespaces and try to execute itself, or another helping program, inside the network namespace. For complete isolation, all the programs for which network access is not desired would have to be executed inside a distinct namespace. That requires a more complex configuration.
sbuk 4y ago
pf is built into macOS. There is a (paid) frontend - https://www.murusfirewall.com https://www.murusfirewall.com
winstonprivacy 4y ago
What you've described is none other than a Winston Privacy device (no longer available, alas).
chrisgd 4y ago
I was just thinking about this- pair that with a iPad that sits on refrigerator and shows your grocery list and family calendar. Then it blocks your smart tv from sending data out and allows family to keep organized. Does 3 things very well and that’s it
dhaavi 4y ago
Ha, what a timing! Just 2 days ago on HN front page: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall https://news.ycombinator.com/item?id=33481518 https://news.ycombinator.com/item?id=33481518 Disclaimer: I'm the CTO.
sureglymop 4y ago
Would it be possible to develop something like this for Linux using eBPF?
sbf501 4y ago
> Kind of like granular oauth permissions, apps should have to declare which outgoing they have, Just like PayPal. There's a table you can bring up that lists everyone you ever engaged with on paypal for recurring pricing, and deactivate them. I've wanted exactly what you describe for years. Little Snitch taught me that there's just too much data that isn't organized properly. Even if you get down to the app level (like PowerPoint), it is still transceiving a lot of data. How do you tell what is necessary and what is dubious telemetry?
snapplebobapple 4y ago
Isn't this what safing does basically?
- dhaavi 4y ago
  Yes! For reference: https://safing.io/ https://safing.io/
mumumu 4y ago
Have a look at firejail. Does this, and more.
1vuio0pswjnm7 4y ago
Why not just disable the network interface and see what stops working. Why not set the Windows computer's gateway to a computer that the user can properly control, i.e., do not give the Windows computer direct access to the internet. Windows is an OS that was created before the public had access to the internet. It worked just fine "offline", i.e., connected to a LAN but not an internet. Same for the Mac. To be honest, I cannot think of many PowerPoints that needed internet access, at least not in the fields I have worked in. Obviously, "tech" companies want personal computers to be online for every waking moment of their owner's day. Neverthless it is in fact possible to "block", i.e., not assent to, much of this outgoing transfer of personal data/metadata to "tech" companies at the user's expense. I have been doing it for over 20 years. With few exceptions, I inspect all HTTPS traffic that I allow over the networks I control. The "tech" companies gathering this data do not pay for the user's internet or cellular service. The user covers the cost of the data transfer. Change begins with the people who know how to make it. For example, it is not difficult to stop PowerPoint from phoning home. Why go along with it. But when those with the requisite knowledge year after year make statements on HN how it is futile to thwart any personal data mining because it is not 100% "perfect" solution,^1 I have been seeing these comments on HN for many years, then it is arguable this becomes a self-fulfilling prophecy. The "majority of people", "general public", etc., do not know they have a choice. They will use whatever is presented to them. What happens when those who do know there is a choice go along with what "tech" companies present to them. They are in no position to blame "the majority". Certainly, those working at or investing in "tech" companies would welcome a lax attitude toward avoiding data collection. "Nothing is going to change because no one cares." Tell that to Zuckerberg after Apple prsented its customers with the means to "block" some of Facebook's data collection. https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv... 1. All-or-nothing, black-and-white, binary style reasoning.
RileyJames 4y ago
Cool idea. This was posted a few days ago on here, and I was impressed by the UX and capabilities. Tho I didn’t delve too deep. https://news.ycombinator.com/item?id=33481518 https://news.ycombinator.com/item?id=33481518
raxxorraxor 4y ago
That would be nice, but I would hate to see mobile OS with their permission system replicated for PC. Simply because mobile OS are fairly lacking. At some point phoning home was a sin for software. Sadly that changed, also because of the naivete of some developers.
intelVISA 4y ago
Could build it yourself w/ eBPF. I tend to just mitm said talkative devices and drop packets -- it is alarming the amount they want to phone home.

Kim_Bruning 4y ago

We could go to our EU representatives and ask for them to make it mandatory. Though I suspect it'll go down the same way as the GDPR, at least at first. (Lessons have already been learned of course)

account42 4y ago
We really just need a clarification/ruling that ANY telemetry is not essential to providing a service and thus requires informed consent before it can be collected and consent cannote be required to use the service. And then enforcement against all these applications. I don't think adding technical layers to block these data leaks is going to work long term.

3pt14159 4y ago

> with TLS/SSL inspection built in (you'd need some OS API to enable that). I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis. You'd need to disable HSTS, but other than that I think it should be the solution you're looking for. Oh, and for good measure, ethernet cable instead of wifi.

Acinyx 4y ago
Any application that uses certificate pinning would fail in this situation as that's specifically what it is trying to prevent.
- moviuro 4y ago
  You "just" need the key to the encrypted traffic. You don't have to change the handshake/negotiation, you just want a copy of the key so you can decrypt the traffic. In TLS, the client authenticates server, then they both agree to use a key for the session; the OS can get a hold of this key (this is usually a bad move because then any captured traffic frames could be later decrypted).
kccqzy 4y ago
A well-designed OS API doesn't need to do MitM and therefore would work with HSTS or cert pinning enabled. Of course for obvious reasons, few commercial apps would actually use this API unless they have some other incentive.
- 3pt14159 4y ago
  Well, the original article was about Microsoft. Since they're the OS vendor too, I discounted that as being reliable for this use-case.

g_p 4y ago

I believe the Mac OS networking APIs go a little bit of the way there - in Lulu, an open source alternative to Little Snitch, the connection prompts tend to contain (and let you filter) by the URL visited (including the query after the domain name). This isn't done through TLS interception, but I believe it's through the network extension API on MacOS receiving the URL requested, as long as the request comes through the regular APIs. It's a long time since I looked, but I think some apps (mainly ones not using native APIs) only showed the hostname, rather than full URL/API endpoint path. This also didn't show you the content, or method type (POST vs GET), but to do that you'd really need to start doing proper SSL inspection as you suggested.

msla 4y ago

The Little Snitch would be asking the OS to please tell it about network traffic. Microsoft's OS. It would be asking Microsoft's OS to tell it about traffic Microsoft's software wants to keep secret. I'm sure there's a world where that isn't a laugh line, but I certainly don't live there.

rrobukef 4y ago
I disagree. What's a worse look: not having this OR having this and being discovered subverting their own security?
rougka 4y ago
OS network filtering APIs don’t work that way and another unrelated and unimportant Microsoft team can’t override it
giaour 4y ago
What indication is there that Microsoft wants to keep this traffic secret? The OP was able to detect and inspect this traffic with standard network monitoring software.

nbzso 4y ago

Since 2014 I don't trust my macs. There is no Apple computer without LS installed on in my company. Actually, if LS is not available, I will not use Apple computers at all. Period.

beermonster 4y ago
Why don't you trust your macs since 2014. Also why do you still use them if you don't trust them any longer?
- gtufano 4y ago
  Not OP, but for me the answer to your question is: is a tool I need. I _could_ use Windows, and absolutely not Linux/BSD (for the programs/tools I need for work), and, frankly, I don't think Windows is better. Yes, I know that's not completely true. I _could_ use Linux (I even used Solaris on a notebook for 2 years in the past and I survived) but the cost in terms of effort, lost productivity would be higher than I'm ready to pay. It's a rational choice.
  - account42 4y ago
    > I _could_ use Windows, and absolutely not Linux/BSD (for the programs/tools I need for work) Are you sure of this? Wine (or Proton for graphics stuff) is pretty good.
- mixmastamyk 4y ago
  Work only allows Mac or Win to log in to their VPN.
  - raxxorraxor 4y ago
    Change your work then. Or use windows in a VM. Always good to separate work and private system anyway.
    - mixmastamyk 4y ago

exceptione 4y ago

What I want is Little Snitch on steroids built into the OS where every process, You cannot trust an OS you cannot build yourself. That's why I see Linux as the only option for professionals and privacy minded people.

proee 4y ago
How do you know there are no outside efforts to log linux activities? There's a lot of source code to go through and is it possible there are callbacks even within OSS that most people are not aware of?
- nathan_compton 4y ago
  At least its possible _in principal_ and many people out there can at least look at the code even if you can't dig through yourself. With Windows or OSX you're just out of luck.
- LukeShu 4y ago
  OSS is necessary, but (as you point out) not sufficient.
- dev_hugepages 4y ago
  Well at least with open source, you CAN verify it. There are people and companies who do audit You're replacing a big and unstoppable problem with a smaller one that can be mitigated
- hutzlibu 4y ago
  It all depends of course on the level of your paranoia/threat model. To prevent standard data leaking or rather stealing like in this case, linux is a quite solid choice. But if you think you are a high profile target, you should probably learn how to deactivate Intels ME and co. And if you are really paranoid, you should assume that there are hardware backdoors. But what do you do then? Build your computer from scratch?
  - smhoff256 4y ago

IceWreck 4y ago

> What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). If you want to you can do that with Linux. Sure you'd need to use the CLI, and a combination of tools but you can pinpoint every packet to an associated process and if you add your self made cert to trusted certs, then you can decrypt TLS as well in most cases.

twawaaay 4y ago
Nah, you can't. The issue is the "easy monitor outgoing traffic with TLS/SSL" part. It is not impossible but it is far from easy. If the application uses statically linked SSL client (as it should if it is commercially distributed) then you have to modify the application (for example in memory) to get a copy of everything that gets written to the SSL stream.
- kibwen 4y ago
  You know how you can do Ctrl+Shift+K in Firefox to open up the browser console and inspect all the bits of the page, see the code (and fuck with it), see all the network traffic, and so on? I dream of being able to do that for arbitrary applications. Imagine having a Super+Ctrl+Shift+K that opened an OS-level GUI showing all the pertinent details of the running program.
  - twawaaay 4y ago
    You know that this only pertains to webapps and there is still a lot of software running on your machine that you have no idea what it does?
    - kibwen 4y ago
      I am specifically referring to the ability to have the same sort of interface with non-webapps as we do with webapps.

smarkov 4y ago

For Windows, check out simplewall, it does (almost) exactly that. https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall

m0guz 4y ago
It has built-in support to block Windows Services/Apps/Updates without user interaction.
M95D 4y ago
It uses the windows firewall. Do I trust Windows firewall to block itself? NO!
- noisem4ker 4y ago
  > It uses the windows firewall. No: "simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall"
  - M95D 4y ago
    I was referring to the firewall functionality already present in windows, not the GUI called "windows firewall".
- hu3 4y ago
  From the README: > Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall. > It works over Windows Filtering Platform (WFP) which is a set of API and system services that provide a platform for creating network filtering applications. Windows Filtering Platform is a development technology and not a firewall itself, but simplewall is the tool that uses this technology.
- ziml77 4y ago
  Even if it was a wrapper over Windows Firewall, why would that make you trust the filtering less? Like even if it was running fully custom ring 0 code, there's still also Windows kernel code running at the same level. Microsoft could make the kernel interfere however they want.

bergenty 4y ago

I used little snitch for so many years but stopped using it a while ago for some reason. Is it still as good as it used to be?

hmmmmmm111 4y ago

> I doubt any of this will ever be remedied. What if you didn’t use PowerPoint? Seems much simpler. Also, maybe the data makes PowerPoint good? Or better? Alternatives to PowerPoint: won’t all of the viable ones be hosted on the web? What do you want? You can install PowerPoint 97. No one is stopping you.

squarefoot 4y ago

On Linux there is OpenSnitch that does its job nicely, although I experienced some occasional desktop slowdowns even after training it to open everything for trusted programs. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch I still recall the old days of Windows when I tried Kerio Personal Firewall and realized how much software already phoned home two decades ago. That was the last wake up call that pushed me into getting rid of closed source software, possibly also hardware, especially when they connect to the internet.

elesiuta 4y ago
The slowdowns are because it still has to hold every connection until it can check which program it is coming from and whether that program is trusted or not, even when the same program creates multiple connections. To get around the slowdowns, I made an alternative program called picosnitch which only monitors connections since I just stop using anything I don't trust or move it to a sandbox. It also uses BPF, has fairly low CPU usage, and some other features for improved reliability and detection of programs.
Abishek_Muthian 4y ago
I second OpenSnitch, I haven't face any shutdowns due to it yet. For those coming from LittleSnitch on macOS might have to look into the finer details of the connection in the Allow/Deny dialog on OS to get the best results.
- squarefoot 4y ago
  Slowdowns, not shutdowns, luckily:) The desktop (XFCE under Debian if that helps) just hung for a while like it was waiting for me to allow some rules, but didn't show the requester to do so, also the timings were random, could have been from 2 seconds to 5 or more.
  - Abishek_Muthian 4y ago
    Oops; Self-reminder to not comment on HN when half sleep. But, I haven't noticed slowdown either; I wonder whether its because I always keep the OS window open?

adrian_b 4y ago

I believe, even if I have not tried yet to do this, that you can do this in Linux if you create one or more virtual network interfaces in some namespaces, and you ensure that only that interface or those interfaces get IP addresses. Then any program that is not run inside the namespace with configured virtual network interfaces can see only unconfigured interfaces, so it will not be able to open and connect sockets. The Internet browser and any other program that needs network access, e.g. a NTP server, DHCP client, e-mail client etc., can be run inside the namespace with an IP-configured network interface. The same could be done in FreeBSD by using a jail for the programs that need network access. Obviously, this would not be enough to prevent network access for a program that would be aware of this configuration and would try to circumvent it, because such a program could list the network namespaces and try to execute itself, or another helping program, inside the network namespace. For complete isolation, all the programs for which network access is not desired would have to be executed inside a distinct namespace. That requires a more complex configuration.

sbuk 4y ago

pf is built into macOS. There is a (paid) frontend - https://www.murusfirewall.com https://www.murusfirewall.com

winstonprivacy 4y ago

What you've described is none other than a Winston Privacy device (no longer available, alas).

chrisgd 4y ago

I was just thinking about this- pair that with a iPad that sits on refrigerator and shows your grocery list and family calendar. Then it blocks your smart tv from sending data out and allows family to keep organized. Does 3 things very well and that’s it

dhaavi 4y ago

Ha, what a timing! Just 2 days ago on HN front page: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall https://news.ycombinator.com/item?id=33481518 https://news.ycombinator.com/item?id=33481518 Disclaimer: I'm the CTO.

sureglymop 4y ago

Would it be possible to develop something like this for Linux using eBPF?

sbf501 4y ago

> Kind of like granular oauth permissions, apps should have to declare which outgoing they have, Just like PayPal. There's a table you can bring up that lists everyone you ever engaged with on paypal for recurring pricing, and deactivate them. I've wanted exactly what you describe for years. Little Snitch taught me that there's just too much data that isn't organized properly. Even if you get down to the app level (like PowerPoint), it is still transceiving a lot of data. How do you tell what is necessary and what is dubious telemetry?

snapplebobapple 4y ago

Isn't this what safing does basically?

dhaavi 4y ago
Yes! For reference: https://safing.io/ https://safing.io/

mumumu 4y ago

Have a look at firejail. Does this, and more.

1vuio0pswjnm7 4y ago

Why not just disable the network interface and see what stops working. Why not set the Windows computer's gateway to a computer that the user can properly control, i.e., do not give the Windows computer direct access to the internet. Windows is an OS that was created before the public had access to the internet. It worked just fine "offline", i.e., connected to a LAN but not an internet. Same for the Mac. To be honest, I cannot think of many PowerPoints that needed internet access, at least not in the fields I have worked in. Obviously, "tech" companies want personal computers to be online for every waking moment of their owner's day. Neverthless it is in fact possible to "block", i.e., not assent to, much of this outgoing transfer of personal data/metadata to "tech" companies at the user's expense. I have been doing it for over 20 years. With few exceptions, I inspect all HTTPS traffic that I allow over the networks I control. The "tech" companies gathering this data do not pay for the user's internet or cellular service. The user covers the cost of the data transfer. Change begins with the people who know how to make it. For example, it is not difficult to stop PowerPoint from phoning home. Why go along with it. But when those with the requisite knowledge year after year make statements on HN how it is futile to thwart any personal data mining because it is not 100% "perfect" solution,^1 I have been seeing these comments on HN for many years, then it is arguable this becomes a self-fulfilling prophecy. The "majority of people", "general public", etc., do not know they have a choice. They will use whatever is presented to them. What happens when those who do know there is a choice go along with what "tech" companies present to them. They are in no position to blame "the majority". Certainly, those working at or investing in "tech" companies would welcome a lax attitude toward avoiding data collection. "Nothing is going to change because no one cares." Tell that to Zuckerberg after Apple prsented its customers with the means to "block" some of Facebook's data collection. https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-priv... 1. All-or-nothing, black-and-white, binary style reasoning.

RileyJames 4y ago

Cool idea. This was posted a few days ago on here, and I was impressed by the UX and capabilities. Tho I didn’t delve too deep. https://news.ycombinator.com/item?id=33481518 https://news.ycombinator.com/item?id=33481518

raxxorraxor 4y ago

That would be nice, but I would hate to see mobile OS with their permission system replicated for PC. Simply because mobile OS are fairly lacking. At some point phoning home was a sin for software. Sadly that changed, also because of the naivete of some developers.

intelVISA 4y ago

Could build it yourself w/ eBPF. I tend to just mitm said talkative devices and drop packets -- it is alarming the amount they want to phone home.