5 ms·

After Snowden, we quit our jobs to build privacy software. It reached 1.0

77 points by davegson 4y ago

CommitSyn 4y ago
Does this suffer from the same problem as VPNs, where a valid subpoena can force the companies hand to subvert connection to the safing servers from a specific IP address?
- anotheryou 4y ago
  I think a lot of what this does is blocking everything in the first place, not re-routing. I e.g. really like blocking apps that should not need to connect connect to the internet in the first place.
  - foobazzy 4y ago
    Yeah. This is a feature that caught my eye too. Blocking internet access to certain apps entirely. I do that actively on Android but it's been tough to do that on the laptop. Maybe Portmaster becomes the answer I want.
    - anotheryou 4y ago
      https://www.binisoft.org/wfc https://www.binisoft.org/wfc does it too, but I ran in to complications with windows apps that get mounted weirdly.
- dhaavi 4y ago
  No. The SPN uses multiple hops with onion encryption - just like Tor. Your user/pass is never sent to the network servers, but only to the account server, which gives you blind-signed access tokens, so the servers of the network only knows that you are allowed to access, but not who you are.
gardenhedge 4y ago
Any plans for a mac version?
- KolmogorovComp 4y ago
  From their website[0]: > Currently, we support Windows and Linux. We are planning on supporting Mac and Mobile in the future too, so everybody can enjoy easy privacy with their preferred operating system. [0]: https://safing.io/blog/2020/01/22/how-the-spn-compares-to-tor/ https://safing.io/blog/2020/01/22/how-the-spn-compares-to-to...
  - kelsolaar 4y ago
    That was in 2020 though, be great to have an updated answer.
danrl 4y ago
For everyone trying to find out what the main product is: Portmaster seems to be a local Pihole kind of thing which injects itself into the DNS resolution locally. The website could be better at explaining that and general discoverability. Kudos for full IPv6 support.
- BoppreH 4y ago
  I think the DNS resolution is only one feature. The screenshot shows active connections, including duration and the local process path. That's a lot more powerful and interesting than a local PiHole.
  - m463 4y ago
    I can't tell if it inherits the huge shortcoming of pihole - any app can just use an ip address and go around it. also, is the SPN thing (their per-app version of VPN) part of the free version?
    - dhaavi 4y ago
      Nope. Portmaster is a full fledged application firewall. Bypassing is not trivial, if not impossible. SPN is _not_ part of the free version. If you can pinpoint where you might have gotten this feeling, it would be great if you could tell us - then we can improve!
      - m463 4y ago
        I meant - does it route everything through an SPN (someone else's server). The question arising is not necessarily your fault, more like healthy skepticism because other products turn out to be a service and you don't realize they've made themselves a dependency.
        dhaavi 4y ago
        If you enable the SPN, everything is routed through the SPN by default and will go over at least two hops. You can change this to your preference. Most things can be configured per-app. The SPN is the only service-like feature, all other features are 100% local. The only dependency is that updates - including intelligence data - is downloaded from our servers: Traffic is encrypted and binaries are signed "end-to-end", intel data will be signed soon.
medlazik 4y ago
How do you guarantee the tool itself isn't more dangerous than the threats it's eventually protecting against?
- sschueller 4y ago
  It is at least open source unlike others: https://github.com/safing/portmaster https://github.com/safing/portmaster
nilsb 4y ago
I've been looking at their website for the past 10 minutes or so and I still don't know what _exactly_ this does. It seems like this is a local firewall (remember ZoneAlarm of the '00s with all the alerts about connections it has blocked?) paired with a VPN.
- medlazik 4y ago
  It's like Glasswire and Opensnitch
merricksb 4y ago
Earlier discussion of 1.0 release 3 months ago: https://news.ycombinator.com/item?id=33481518 https://news.ycombinator.com/item?id=33481518 311 points/113 comments
- slim 4y ago
  the highlight of that discussion is that even though it's opensource, you can't really build it by yourself because the build process is not documented and it's not a priority for the developers
rom-antics 4y ago
I'm a happy user of Opensnitch, but there's one important feature I miss: https://github.com/evilsocket/opensnitch/issues/406 https://github.com/evilsocket/opensnitch/issues/406 Suppose `curl` makes an outbound connection. I can add a rule for `curl`, but the rule cannot make use of the parent process hierarchy. Without this, any application could proxy through curl to evade firewall rules. For example if the process tree is git -> perl -> curl, I probably want to allow it, but spotify -> curl I want to deny. Another example is I probably want to allow (explicitly started) bash -> curl, but deny spotify -> bash -> curl. Does Portmaster support this? If so I'll take it for a spin!
- em-bee 4y ago
  isn't that what capabilities can be used for? deny spotify the capability to start other processes? although i don't quite understand your example. spotify needs network access to be useful, doesn't it? so what would blocking spotify -> curl protect against? in general though, if a program doesn't have the capability to start outbound connections, then any child processes won't have it either. there is also a distinction which capabilities are inherited so that you can have a process with networkaccess, but without being able to pass that on to child processes.
- dhaavi 4y ago
  This is exactly the things we are aiming for, as Portmaster is intended to be as easy to use as possible. We currently already have special support for AppImage and Snap packages on Linux and Windows Store apps and "svchost.exe services" on Windows. Additionally, we can detect common interpreters on Linux and correctly match the script file instead of the interpreter. The support for these systems is implemented as "tags", which are attached to a process internally in Portmaster. These tags are then used to match a settings profile. You can find the implementations here: https://github.com/safing/portmaster/tree/develop/process/tags https://github.com/safing/portmaster/tree/develop/process/ta... We almost had an implementation ready for what you want (matching the parent process), but we had to abort due to some difficulties in matching: The questions we could find a good answer for, was where do we put the information whether which binaries are merged into / inherit from the parent? The ideal scenario from a UX perspective would be to declare it on the parent as an "include all sub-processes" option. But this would mean we would need to fully resolve all parent processes including their settings every time we evaluate a process. We deemed this to be too slow and too complex for a quick and clean solution. If you or anyone else has a great idea, I'd be happy to have a call to discuss.
rspoerri 4y ago
I wonder who is running these SPN Nodes? Just as with tor, if a agency runs a large amount of the nodes, woudnt it completely compromise the network? What if people abuse the system and ip's get blacklisted from services.
- q1w2 4y ago
  Given their multiple references to Snowden - I worry that it's Russia.
tejado 4y ago
Kernel-Mode driver? Why not using Windows Filtering Platform (WFP)?

77 points by davegson 4y ago

Does this suffer from the same problem as VPNs, where a valid subpoena can force the companies hand to subvert connection to the safing servers from a specific IP address?

anotheryou 4y ago
I think a lot of what this does is blocking everything in the first place, not re-routing. I e.g. really like blocking apps that should not need to connect connect to the internet in the first place.
- foobazzy 4y ago
  Yeah. This is a feature that caught my eye too. Blocking internet access to certain apps entirely. I do that actively on Android but it's been tough to do that on the laptop. Maybe Portmaster becomes the answer I want.
  - anotheryou 4y ago
    https://www.binisoft.org/wfc https://www.binisoft.org/wfc does it too, but I ran in to complications with windows apps that get mounted weirdly.
dhaavi 4y ago
No. The SPN uses multiple hops with onion encryption - just like Tor. Your user/pass is never sent to the network servers, but only to the account server, which gives you blind-signed access tokens, so the servers of the network only knows that you are allowed to access, but not who you are.

gardenhedge 4y ago

Any plans for a mac version?

KolmogorovComp 4y ago
From their website[0]: > Currently, we support Windows and Linux. We are planning on supporting Mac and Mobile in the future too, so everybody can enjoy easy privacy with their preferred operating system. [0]: https://safing.io/blog/2020/01/22/how-the-spn-compares-to-tor/ https://safing.io/blog/2020/01/22/how-the-spn-compares-to-to...
- kelsolaar 4y ago
  That was in 2020 though, be great to have an updated answer.

danrl 4y ago

For everyone trying to find out what the main product is: Portmaster seems to be a local Pihole kind of thing which injects itself into the DNS resolution locally. The website could be better at explaining that and general discoverability. Kudos for full IPv6 support.

BoppreH 4y ago
I think the DNS resolution is only one feature. The screenshot shows active connections, including duration and the local process path. That's a lot more powerful and interesting than a local PiHole.
- m463 4y ago
  I can't tell if it inherits the huge shortcoming of pihole - any app can just use an ip address and go around it. also, is the SPN thing (their per-app version of VPN) part of the free version?
  - dhaavi 4y ago
    Nope. Portmaster is a full fledged application firewall. Bypassing is not trivial, if not impossible. SPN is _not_ part of the free version. If you can pinpoint where you might have gotten this feeling, it would be great if you could tell us - then we can improve!
    - m463 4y ago
      I meant - does it route everything through an SPN (someone else's server). The question arising is not necessarily your fault, more like healthy skepticism because other products turn out to be a service and you don't realize they've made themselves a dependency.
      - dhaavi 4y ago
        If you enable the SPN, everything is routed through the SPN by default and will go over at least two hops. You can change this to your preference. Most things can be configured per-app. The SPN is the only service-like feature, all other features are 100% local. The only dependency is that updates - including intelligence data - is downloaded from our servers: Traffic is encrypted and binaries are signed "end-to-end", intel data will be signed soon.

medlazik 4y ago

How do you guarantee the tool itself isn't more dangerous than the threats it's eventually protecting against?

sschueller 4y ago
It is at least open source unlike others: https://github.com/safing/portmaster https://github.com/safing/portmaster

nilsb 4y ago

I've been looking at their website for the past 10 minutes or so and I still don't know what _exactly_ this does. It seems like this is a local firewall (remember ZoneAlarm of the '00s with all the alerts about connections it has blocked?) paired with a VPN.

medlazik 4y ago
It's like Glasswire and Opensnitch

merricksb 4y ago

Earlier discussion of 1.0 release 3 months ago: https://news.ycombinator.com/item?id=33481518 https://news.ycombinator.com/item?id=33481518 311 points/113 comments

slim 4y ago
the highlight of that discussion is that even though it's opensource, you can't really build it by yourself because the build process is not documented and it's not a priority for the developers

rom-antics 4y ago

I'm a happy user of Opensnitch, but there's one important feature I miss: https://github.com/evilsocket/opensnitch/issues/406 https://github.com/evilsocket/opensnitch/issues/406 Suppose `curl` makes an outbound connection. I can add a rule for `curl`, but the rule cannot make use of the parent process hierarchy. Without this, any application could proxy through curl to evade firewall rules. For example if the process tree is git -> perl -> curl, I probably want to allow it, but spotify -> curl I want to deny. Another example is I probably want to allow (explicitly started) bash -> curl, but deny spotify -> bash -> curl. Does Portmaster support this? If so I'll take it for a spin!

em-bee 4y ago
isn't that what capabilities can be used for? deny spotify the capability to start other processes? although i don't quite understand your example. spotify needs network access to be useful, doesn't it? so what would blocking spotify -> curl protect against? in general though, if a program doesn't have the capability to start outbound connections, then any child processes won't have it either. there is also a distinction which capabilities are inherited so that you can have a process with networkaccess, but without being able to pass that on to child processes.
dhaavi 4y ago
This is exactly the things we are aiming for, as Portmaster is intended to be as easy to use as possible. We currently already have special support for AppImage and Snap packages on Linux and Windows Store apps and "svchost.exe services" on Windows. Additionally, we can detect common interpreters on Linux and correctly match the script file instead of the interpreter. The support for these systems is implemented as "tags", which are attached to a process internally in Portmaster. These tags are then used to match a settings profile. You can find the implementations here: https://github.com/safing/portmaster/tree/develop/process/tags https://github.com/safing/portmaster/tree/develop/process/ta... We almost had an implementation ready for what you want (matching the parent process), but we had to abort due to some difficulties in matching: The questions we could find a good answer for, was where do we put the information whether which binaries are merged into / inherit from the parent? The ideal scenario from a UX perspective would be to declare it on the parent as an "include all sub-processes" option. But this would mean we would need to fully resolve all parent processes including their settings every time we evaluate a process. We deemed this to be too slow and too complex for a quick and clean solution. If you or anyone else has a great idea, I'd be happy to have a call to discuss.

rspoerri 4y ago

I wonder who is running these SPN Nodes? Just as with tor, if a agency runs a large amount of the nodes, woudnt it completely compromise the network? What if people abuse the system and ip's get blacklisted from services.

q1w2 4y ago
Given their multiple references to Snowden - I worry that it's Russia.

tejado 4y ago

Kernel-Mode driver? Why not using Windows Filtering Platform (WFP)?