16 ms·

Little Snitch Mini

784 points by robenkleene 4y ago

mostlysimilar 4y ago
The original/full Little Snitch is the first thing I install on a new Mac. Can't live without it.
liminalsunset 4y ago
How does this compare to the "LuLu" app from Objective-See? IIRC that one was open source, while this isn't. A few years ago there was a concern that Apple was exempting itself from some of these firewalls. Were these concerns ever addressed in any meaningful way by any of these apps since then?
- lapcat 4y ago
  > IIRC that one was open source, while this isn't. Yes. Little Snitch has been around for for a long time, though, something like 20 years. The developer Obdev is trustworthy, and I wholeheartedly recommend Little Snitch (the full version; I haven't tried the Mini version). > A few years ago there was a concern that Apple was exempting itself from some of these firewalls. Were these concerns ever addressed in any meaningful way by any of these apps since then? Apple fixed the issue.
  - dylan604 4y ago
    >Apple fixed the issue. What does that mean? They now play by the same rules as other software, or they just did something else without actually addressing the problem? After Office Space and "we fixed the glitch", simply saying "fixed the issue" leaves a lot to the imagination.
    - lapcat 4y ago
      > What does that mean? They now play by the same rules as other software Yes. Here's the developer of LuLu explaining it: https://www.patreon.com/posts/46179028 https://www.patreon.com/posts/46179028
      - rvnx 4y ago
        I think I saw that Little Snitch itself doesn't show all its own connections as far as I know EDIT: Source was old posts on alt.hackintosh saying that you have to block one specific IP to prevent the call home and another one regarding LS4 saying that you have to nullroute some some Hetzner hosts. My guess was that if you had to add some hosts to prevent LS to check its own license online, that it means that LS has its own way to go around the firewall rules. EDIT2: Genuinely no idea, I guess we have to ask someone who uses a cracked version
        lapcat 4y ago
        > Though Little Snitch itself doesn't show all its own connections as far as I know It does. You can even block the Little Snitch Software Update process if you want.
        deleted 4y ago
        [deleted]
        sneak 4y ago
        Yes, it does.
SamuelAdams 4y ago
How is this different from the traditional version of Little Snitch?
- ladberg 4y ago
  https://obdev.at/products/littlesnitch-mini/compare.html https://obdev.at/products/littlesnitch-mini/compare.html Basically a lot fewer filtering features, and only monitoring for free.
  - distantsounds 4y ago
    Imagine putting IP blocking behind your paid product. And here we have every problem with the Mac software ecosystem summed up.
- jonnat 4y ago
  They have a comparison page: https://obdev.at/products/littlesnitch-mini/compare.html https://obdev.at/products/littlesnitch-mini/compare.html
  - crazygringo 4y ago
    It's remarkably difficult to compare the two with how they describe them in totally different ways. It really makes my wish they had one of those side-by-side charts that tells you which features are in what.
mberning 4y ago
I bought little snitch years ago but could never get into using it consistently. Always seemed like a chore.
- kstrauser 4y ago
  It's most definitely a chore for the first week. Then it disappears from sight until it finds something unusual.
- deleted 4y ago
  [deleted]
ladberg 4y ago
The monitoring is super useful for metered connections (looking at you, Comcast/Xfinity) and I happily paid for the full Little Snitch for that feature. Super glad to hear it’s free now! I’ve tried to recommend it to people and it was a bit of a big purchase for most to stomach just for the monitoring features.
lucideer 4y ago
As someone who's been paying for Little Snitch for a long time this is an odd move, as this seems to do everything I would want. Sure, I've availed of some of the more advanced features in the paid version, but they definitely never seemed essential to me. What I mainly need is the basics they've included in the free version now. I wonder if this is a direct response to Lulu (have been meaning to try it but migration is friction)
- darkstar999 4y ago
  But you don't get connection blocking for free. > The network monitoring functionality, including the real-time connection list, traffic diagrams and the animated map view can be used for free! > The full feature set, including connection blocking, extended traffic history time ranges, advanced display and filtering options and more is available as an in-app purchase.
  - dylan604 4y ago
    I guess if you are just doing an investigation to see if there is any unusual traffic, the free version can be useful. Since it's not actually preventing any of the traffic, it doesn't make the paid for version useless. For those that want to stop the data flow but continue using the chatty software, upgrading to the paid version would still be a thing. If you're the type to just stop/remove chatty software, then this free version will help find them. Seems kind of cool.
  - lucideer 4y ago
    Ah! Ok I did miss that detail. In that case this makes more sense.
ary 4y ago
People are probably going to be confused between this and the "full" version of Little Snitch. My take on it is that Little Snitch Mini is something you can install on a non-technical friend or family member's computer whereas power users may want to stick with the existing offering. I say this as a long time heavy user of Little Snitch. It's very annoying when you first get it installed, but it provides really useful control over what installed software is getting up to. After a time you settle into a natural rule set for your personal patterns and only see alerts when new or updated software tries a network connection that hasn't been seen before. "Mini" strikes me as much more of a fire-and-forget product, which I appreciate but won't personally use.
- dmix 4y ago
  I've always thought this should be a feature in an OS for advanced users. Combined with some OS level security optimizations it could be quite a powerful security feature for the paranoid and at-risk. I haven't tried mini but there's probably plenty of UX gains in between the standard Little Snitch fine control approach and the UBlock Origin style community curated defaults where control/customization is optional/on-demand.
  - ary 4y ago
    Completely agree. Occasionally I run Charles Proxy[1] on my iPhone to analyze network activity and am disturbed by what I see. Software shouldn't be able to open arbitrary network connections without user consent/control, but we're not there yet to a large enough degree on mobile unfortunately. [1] https://www.charlesproxy.com/documentation/ios/ https://www.charlesproxy.com/documentation/ios/
    - KyeRussell 4y ago
      The reality is that this sort of control would only be attractive to a very very small fraction of users, and no, not just because ‘people don’t care about privacy’ or whatever. There are just very few situations where someone is going to be able to look at this sort of data and do anything meaningful with it, especially when a) most apps are justifiably internet-connected, and b) the homogeneity of public cloud infra means you can’t really tell anything apart from endpoint alone.
alad_ 4y ago
Any thoughts on the difference between using this vs DNS (e.g. nextdns) with blocklists? It seems like DNS is more convenient as you don't need to run extra software on your machine and it works on any device.
- lapcat 4y ago
  > Any thoughts on the difference between using this vs DNS (e.g. nextdns) with blocklists? Little Snitch is process-based, so you can block a specific process from connecting to a specific domain while allowing other processes to connect to the domain, whereas with DNS you have to block every process from the domain. And of course Little Snitch gives you process-level info too, which DNS doesn't.
- xp84 4y ago
  Theoretically LS could tell you if some malware was connecting to, say, a strange IP address, which wouldn't ever hit DNS. Obviously a smart/sophisticated Russian hacker wouldn't be connecting directly to a Russian IP, rather using a local-to-you cloud server as an intermediary, but still. I think LS is more oriented toward someone who wants disclosure, as opposed to someone who wants specifically to minimize telemetry and trusts a blocklist to do a good enough job.
dt3ft 4y ago
Is there a Little Snitch alternative for Windows?
- Wistar 4y ago
  A good question. I looked it up. The AlternativeTo site offers a few PC alternatives to Little Snitch: "Little Snitch is not available for Windows but there are plenty of alternatives that runs on Windows with similar functionality. The best Windows alternative is GlassWire, which is free." https://alternativeto.net/software/little-snitch/?platform=windows https://alternativeto.net/software/little-snitch/?platform=w...
  - eviks 4y ago
    It's not free for the most important part - blocking
- oktwtf 4y ago
  simplewall[0] is my #1 install on a new machine. Little different, but it'll still alert you to the requests, allow for timers, per application/route rules etc. [0]: https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall
  - sasas 4y ago
    Can recommend simplewall - only only is it free, it's completely opensource. Works wonderfully - highly recommended.
- dylan604 4y ago
  I'm kind of scared to learn exactly how chatty Windows would be.
  - oktwtf 4y ago
    It's not as bad as the vine says, but one thing that drives me crazy, is widgets.exe seems to get a new hash /often/ and I constantly get prompts for it. It's all the installers that phone home at some point, and video drivers needing access etc. (Wireless displays come at a cost I guess).
jacooper 4y ago
Seems to do the same thing as Safings Postmaster, which is also Free and open source.
- Thoreandan 4y ago
  TIL! thanks. https://github.com/safing/portmaster https://github.com/safing/portmaster https://safing.io/ https://safing.io/
- jacooper 4y ago
  Portmaster*
obenn 4y ago
Was ready to buy this until I saw it is a subscription, not stand-alone.
- selykg 4y ago
  Price seems fair, honestly. The full blown app is like $70, plus upgrades when those come.
  - latexr 4y ago
    I’d gladly pay 70$ for this, for myself and maybe a couple of friends, if it were a one-time purchase. As a subscription, I just closed the page. Several apps on the Mac App Store have both subscription and lifetime pricing. I’ve bought several.
    - lapcat 4y ago
      The non-Mini version of Little Snitch is a one-time purchase.
      - latexr 4y ago
        The non-Mini version was such a hassle to maintain¹ that I stopped using it². This looked like a great middle ground, until the subscription part. ¹ I don’t want to become a networking expert and babysit everything. I already practice good security regarding what I install and run, I just want a little more control. ² And if it was a bother for me, there’s zero chance any of my non-technical friends would last an hour.
        selykg 4y ago
        I forget what it's called but there's a mode you can put Little Snitch into that it allows whatever goes through and you can monitor it by opening and reviewing when you want. I think that's fairly similar to what mini does. This turns off all the nagging. This is actually what I did last time I used Little Snitch, it helped a lot. When I installed a new app I'd use it for a bit, then review in LS and see what it was doing. From there I could allow or disallow whatever I needed. It's sort of the reverse of "block everything until allowed"
tinglymintyfrsh 4y ago
I use LS. Mini wouldn't work for me at work or home. It's probably targeted and useful for non-developer users. I also use Objective See's LuLu, OverSight, ReiKey, and RansomWhere. https://objective-see.org https://objective-see.org LuLu + LS makes any app using telemetry shriekingly obvious and selectively denyable. Work additionally deploys YARA, MS MDE, Malware Bytes, and an MDM. There are other internal tools for password projection, DLP (anti-exfil), and pre-execution binary allow/denylisting.
- krono 4y ago
  LuLu itself sends telemetry to Sentry by default
  - sneak 4y ago
    This is why I pay for LS. The whole point of the software is to avoid nonconsensual phone-home; if it does it itself, how or why would you ever trust the developer? I'd literally rather pay for proprietary software than maintain a fork of LuLu.
    - Zetice 4y ago
      It's not nonconsensual, you can literally block it with itself.
      - deleted 4y ago
        [deleted]
      - krono 4y ago
        It transmits telemetry non-consensually before you even get a chance to tell it not to. That is, unless you know of this beforehand and are also tech-literate enough to understand this can be circumvented by disabling your internet connection before you first open the application - something you cannot reasonably expect from all users, seeing as how this telemetry gathering is not advertised anywhere and had to be found in the source code.
amelius 4y ago
So, from a user's viewpoint, if your app talks to blah.serv.direct.data.com how do you know whether it actually needs that server for its main functionality or not? I don't see how this snitch tool will not just generate a lot of noise.
- kibwen 4y ago
  Block the request and see what breaks.
  - amelius 4y ago
    The problem is that you have to do it for tens to hundreds of addresses. And they may change too. It's a lot of manual work.
- deleted 4y ago
  [deleted]
- dkjaudyeqooe 4y ago
  It all depends on the application. If there is no reason for it to talk to various servers then blocking them usually is fine. If it actually breaks something then you can proceed to uninstalling it. Most of it is telemetry you didn't agree to, or worse.
npunt 4y ago
Smart move to go for the more casual user, it suggests Obdev has been doing their homework and proactively talking to regular users, rather than just blindly building feature requests. Tools like this so often get sucked into serving the loud minority of expert users with ever more esoteric use cases, which leads to a death spiral of audience capture where the tool gets more and more complicated and harder to approach for casuals. Little Snitch Mini looks great, I'm going to recommend it to friends!
j_crick 4y ago
Not liking the direction Apple took with OS X user interfaces and stuff in the later years, I generally stuck with Mojave on my macs. I wish I could try this without upgrading to ah, what was it, Monterey? but alas, alas.
- deleted 4y ago
  [deleted]
Arch-TK 4y ago
Why does factorio literally perform better on my laptop than websites like these? Is this just firefox on linux being bad at hardware rendering? Is it some crappy API people are forced to use to do these animations? I don't get it.
- pantalaimon 4y ago
  On Linux you can use OpenSnitch [0] instead anyway. [0] https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
  - heybrendan 4y ago
    Thanks for sharing! I suspect many of you are curious about CLI-only support (I was). I spotted this old, closed issue [1]. [1] https://github.com/evilsocket/opensnitch/issues/511 https://github.com/evilsocket/opensnitch/issues/511
- ezfe 4y ago
  This page runs at full speed in Safari
jonpurdy 4y ago
When I first saw the headline I assumed they made an iOS version and worked with Apple to do it. I would’ve insta-bought! Unfortunately just an easier to use Mac version. iOS really needs this functionality.
- lapcat 4y ago
  If you want to see how bad iOS is about phoning home, just run the Xcode iOS simulator on a Mac with Little Snitch. Spoiler: It's bad.
- prime17569 4y ago
  iOS also has the App Privacy Report, which can tell you about the network requests that apps make: https://support.apple.com/en-us/HT212958 https://support.apple.com/en-us/HT212958
donohoe 4y ago
I would happily pay $20 or $30 for a version of this, but I will absolutely not pay a subscription fee for extra features. I have too many subscriptions... I want to support this developer but not this way. Uninstalling :(
- viewtransform 4y ago
  How much is the subscription fee ? - it is not mentioned on their site.
  - simple10 4y ago
    Subscription is $13.49/yr or $1.49/mo for mini according to Mac Store page.
    - lockhouse 4y ago
      In all fairness, you can't even buy a cup of black coffee from a 7-Eleven for that much.
      - latexr 4y ago
        Please let’s stop comparing software subscriptions to coffee. It misses the point about the recurring cost and lock in, and not everyone lives in the USA and pays high prices for coffee every day (or ever). https://news.ycombinator.com/item?id=32738791 https://news.ycombinator.com/item?id=32738791
        lockhouse 4y ago
        I don't like subscriptions either, but what is the sustainable alternative income source for app developers?
        stanmancan 4y ago
        I like Jetbrains licensing. Essentially you pay for updates and once you stop paying you’re locked in at that specific version, but you can use it indefinitely.
snotrockets 4y ago
It seems as if you can only have a single network filter in mac os. And because a DNS profile already counts as one, you can't have both.
asjldkfin 4y ago
"Radio Silence" does the same thing as this- but without subscription. And only $9.
- hit8run 4y ago
  I'm using radio silence for years and it is awesome :) https://radiosilenceapp.com https://radiosilenceapp.com
daneel_w 4y ago
I bought Little Snitch long ago but managed to squander my license a couple of years later. Mini is unfortunately a subscription app, which is something I these days consider a hostile/unfriendly business pattern. I won't be going back. LuLu is a free alternative.
- keyle 4y ago
  Using LuLu for so long I actually forgot that I have it running! +1 for LuLu.
- hayst4ck 4y ago
  I generally agree with you so I looked it up. In-App Purchases: Yearly Subscription $13.49 Monthly Subscription $1.49 That's surprisingly modest. 3-4 years of subscription approximately being equal to a license sounds reasonable. The real question is, is little snitch rent seeking? Given what happened after Catalina, I am giving them the benefit of the doubt at the moment. Paying for updates before receiving them definitely creates a conflict of interest. Having looked at their website and seeing SKU-ification (Cutting a product different ways to try to hit different price points) and other business over product decisions, I am definitely feeling shaky about the future of little snitch. SKU-ification is 10x the red flag that a subscription model is. It's worth considering that viruses now days will check and see if programs like this are running and then delete themselves rather than execute the payload.
  - latexr 4y ago
    > 3-4 years of subscription approximately being equal to a license sounds reasonable. Which is probably why the apps on the App Store which offer both subscription and lifetime pricing tend to have the latter at about 3 times the cost of the former. But Little Snitch Mini does not offer that choice. I’d be willing to pay more than 40$ for a one-time purchase of Little Snitch Mini, but there’s zero chance I’ll do it as a subscription.
    - hayst4ck 4y ago
      I see both sides. This dilemma is capitalist hell. Why is obdev sku-ifying their product? Because the incentive model for selling a license means that the market can saturate and there is a lack of recurring or stable income/income safety for the dev. In order to get new spikes of income, a new product is generated. If the market for a particular license becomes saturated, how will they make more money? Licensed based sales incentivizes creation of new product and disincentivizes incremental improvements on already complete products. On the other hand, subscription models incentivize rent seeking. If money is coming in, there is no reason to do more work. Income is not dependent in any way for work done, except maybe compatibility adjustments. So a license is a wonderful model for the buyer and not so great for the seller. A subscription is awful for the buyer, but too good for the seller. So what kind of payment method/pricing scheme, keeps the developer engaged in improving the product, but doesn't incentivize rent-seeking? How would you price things if you were the seller?
apimade 4y ago
I've been beta testing Little Snitch Mini for the past 6 weeks and I have to say it's exactly what I wanted. Really happy with it, the development team should be proud of such a great product. It does a few things, and it does them very well. However I don't love the SaaS nature of the product post-release, because tying my security posture to a credit card payment isn't something I love. Sure, I can make it so I only have to worry about it once per year - however what value does this continue to bring me beyond the current capabilities? It seems the last iteration of Little Snitch from 4 to 5 added a CLI, some of the traffic stats we can see in Mini, but was mostly compatibility-related updates. MacOS went through some pretty major changes going to Ventura and all of the Extension-level changes which affected so many security tools, so I feel like the work there was substantial and justified the new license. For $69 (or $30 on-sale) every few years, it definitely makes me question the value the original version provides a power-user or technical user, over a monthly subscription which I'd need to monitor over the years in this new product, LSM. Now I'm unsure what market segment the LSM product addresses. uBlock Origin seems to serve the majority of use-cases for a typical casual user, and network-level filters really don't seem relevant for the everyday user - particularly with the increasing adoption of DoT/DoH, making DNS-level filtering less useful. I originally assumed this product was for power-users who didn't need the full suite of LSM, and liked the MVP-style interface. But just for the sake of not having to worry about an on-going fee - I think I'll be hard-pressed to adopt it. As a workaround - I'd love an option to pre-purchase 3 years up-front.
gumby 4y ago
I know that talking about the site design itself is discouraged, but that was terrible to read. I wanted to see what was new (why is this "mini"?) but as I scrolled down I had to wait as it fetched content and slowly made it appear. Instead I closed the tab and hoped to learn that from the HN discussion page. When I think of little snitch I think of something that makes my computing better. This page was the opposite -- off brand.
guessmyname 4y ago
I've been using Little Snitch for years, and it's probably the most important software on my computer. However, I've noticed a problematic trend in modern software development: developers are using the same hostname to serve both functional and non-functional web APIs. For example, let's say that Apple's Xcode sends harmless data to their telemetry service at telemetry.apple.test. Even though the data is anonymous, I still choose to block it because I believe in protecting my data. But then, I realize that some features of Xcode, such as CI/CD, no longer work. It turns out that Xcode is also using the same domain to host an API for their cloud CI/CD offering. (hypothetical example) I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. I redirect non-functional HTTP requests to /dev/null and functional requests to the corresponding website. It works, but it's not a scalable solution. So, I have a feature request for the Objective Development team. Could they please implement an option to view the raw HTTP request in the alert window, especially if the network connection is to send an HTTP request? Sometimes, it's hard to decide whether to click “Allow” or “Deny” based solely on the hostname and port.
- ramzyo 4y ago
  I think this maybe could indicate potential increased usage of reverse proxies? Total shot in the dark though, not sure.
- paxys 4y ago
  This isn't some new "problematic trend". A website serving all kinds of requests from a single domain name has been how things have worked forever. Pages making cross-origin requests is in fact a new phenomenon, and has been widely adapted by the ad industry simply because the ad server cannot trust the content host to report its own ad view/click-through numbers. If the server doing the data collecting or ad serving is the same as the one providing the content, there's zero reason for them to be on different domains. And for all these cases any kind of network-level blocking is always going to be ineffective.
- antifa 4y ago
  > I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. What do you recommend for someone looking to get started with doing this to their own device(s)?
winstonprivacy 4y ago
Love it. But doomed to failure because it caters to a niche audience who generally believes they shouldn't have to pay for things Ask me how I know!
colordrops 4y ago
Is there an equivalent for Linux?
- elesiuta 4y ago
  I wrote picosnitch [1] which has the same notification and bandwidth monitoring features, however it doesn't block traffic for a couple reasons: avoiding scope creep so I can focus on more reliable detection and do things like hash every executable, which makes it harder to block traffic in a timely fashion. https://github.com/elesiuta/picosnitch https://github.com/elesiuta/picosnitch
  - eviks 4y ago
    Blocking traffic is also the most important part of the scope of such firewall apps
    - elesiuta 4y ago
      What is your threat model, and what type of traffic are you hoping to block? I never claimed picosnitch to be a firewall. My use case involved running it on servers with a minimal OS where all applications are containerized. My goal was purely monitoring to see if any containers had rogue executables, and go from there. Without the containers, it would be trivial for a malicious program to stop or modify picosnitch, and the same goes for firewalls hoping to block programs on Linux due to its security model [1]. You need to use some sort of sandboxing [2]. [1] https://madaidans-insecurities.github.io/linux.html#sandboxing https://madaidans-insecurities.github.io/linux.html#sandboxi... [2] https://blog.privacyguides.org/2022/04/22/linux-application-sandboxing/ https://blog.privacyguides.org/2022/04/22/linux-application-...
      - eviks 4y ago
        I never claimed you claimed it. I was just pointing out the huge deficiency that makes picosnitch not an alternative to the broader use case littlesnitch supports To sidestep the more complicated discussion re. how poor the security architecture of Linux is, let's limit that use case to blocking legitimate apps' connections for privacy reasons
pkulak 4y ago
> You deserve to know to whom your Apps are talking to. Ooo, one word too many.
- fuzzfactor 4y ago
  “This is the sort of English up with which I will not put.”
slimebot80 4y ago
Silly question, but how do we know to trust an app where all internet traffic passes through it? There's a lot of scrutiny of VPN services in this regard, should it be the same here?
- paxys 4y ago
  At some level you have to trust whatever you install on your computer. There's no way to ever prove that it is safe or not. If the developer's reputation, recommendations by the community, quality of the product etc. aren't enough then it's best to just not use it. Beyond that, Little Snitch (and Little Snitch Mini I assume) operates as a network firewall. It can see the domain where the traffic is going, and block it if it wants, but can't see or decrypt the contents of the message. The OS itself will not allow it to.
kylehotchkiss 4y ago
I love Little Snitch (full). This looks like the best parts and easier to use! Big congrats to Objective Dev on the launch. I’ll use this on my slightly slower computers. One of my favorite use cases is making sure when I’m traveling abroad that my computer only connects to work apps over a VPN but blocks them otherwise. The auto profile switching supports vpn connections for this purpose.
JasonZ2 4y ago
I have to download and install the app to see how much it costs? They don't even list the price along with their other products: https://obdev.at/shop/index.html https://obdev.at/shop/index.html
- happybuy 4y ago
  I know from personal experience of making and selling an App Store app [1] that it can be difficult to show accurate pricing on your products website. There can be 175+ different territories that you may sell an app in, each with a different local price point. You also can't expect to simply show a converted $US dollar amount either as you may want to do price discrimination (so that the app is cheaper for regions that cannot afford the exact $US equivalent). Overall options seem to be: 1. Don't show pricing and leave it for the App Store to display - the most common approach 2. Only show $US pricing on the website and let non-US customers manually translate to their local pricing - not a great experience for non-US users 3. Manually or automatically sync pricing on the website display with the actual current App Store pricing. This is quite a labour or integration intensive task and I've only seen this been done by large vendors [1] https://www.magiclasso.co/ https://www.magiclasso.co/
  - JasonZ2 4y ago
    Sounds like an excuse to just not display the price. > 2. Only show $US pricing on the website and let non-US customers manually translate to their local pricing - not a great experience for non-US users It's a worse experience for someone to convert USD to their currency (instant mentally or 2 seconds on Google) compared to launching the app store, installing the app, getting to the purchase menu, and seeing the price?
    - bendiksolheim 4y ago
      You don’t need to install the app, the prices are displayed on the product page in the App Store, towards the bottom. It’s listed automatically for all apps.
travisporter 4y ago
Does anyone else remember zonealarm
- glennos 4y ago
  Yes! Does anyone remember BlackICE?
  - satysin 4y ago
    Ahh BlackICE, Kerio Personal Firewall and ZoneAlarm Pro. Those were the days! Plus the rise of the anti-spyware applications such as GIANT AntiSpyware which Microsoft bought and is now known as Windows Defender (although I don't much if any of the GIANT code is still around). Sure was a fun time in the late 90s and early 00s for client side security software. When Microsoft introduced the Windows Firewall with XP SP2 a lot of things sort of died out and then we had a rise in things like CCleaner for system "cleaning". While things like CCleaner started out with a few useful features they long ago turned into crap and should be avoided. One of the things I do enjoy about Little Snitch is it gives me that early 2000s nostaltia every now and then when I new pop-up reminds of me ZoneAlarm :)
- Whatarethese 4y ago
  Miss those red and green bars!
footlose_3815 4y ago
why not make piehole rules for what little snitch covers?
- gorbypark 4y ago
  While Little Snitch can do general blocking from a block file, its main use is per-process blocking. With PiHole, you can't see what process on your computer is making the request, just that your computer's IP is making it. Little Snitch (and LuLu) are great, because you can see what program is actually making the request, and block/allow/setup rules for it.
joanne123 4y ago
[dead]
Terretta 4y ago
"The full feature set, including connection blocking, extended traffic history time ranges, advanced display and filtering options and more is available as an in-app purchase." So this means as a company using MDM, I cannot purchase it for all my employees. MacOS devs who see IAP and subscriptions as the only purchase paths are leaving corporate purchases on the table. We choose software we can pay for. We are fine if it's priced fairly to support the developer and the work to get to the next version. We are fine paying for the next version too. But IAP or subs paid for by company? Apple itself doesn't support that on Macs managed using their corp device management. (And no, the user cannot buy it and expense it either, IAP/subs are disallowed on managed Apple IDs.) Indie MacOS devs, all you have to do is also list a full retail version. You will have buyers. $2.99/month sub also sold $79 full price and a major update each 2 years with a new full retail version number? You will still have buyers, and you'll have the cash now, instead of over the 2 years.
- jiveturkey 4y ago
  https://www.obdev.at/products/littlesnitch/order.html https://www.obdev.at/products/littlesnitch/order.html
  - mattl 4y ago
    This doesn’t contain the mini product
    - memsom 4y ago
      The UI does look different, but functionality looks the same.
    - jiveturkey 4y ago
      The parent didn't want the mini product. He wanted the full paid version (what you get if you do the IAP in the mini product).
      - mattl 4y ago
owaislone 4y ago
This page is somewhat misleading. It pretends Little Snitch Mini supports blocking but that is not true and only works in the paid version. It does clarify this at the very bottom but weird to have your free app's landing page list features from the paid version. At least put a "premium" sticker on those screenshots or something.
yosito 4y ago
I like this app. It's very similar to an app I already use to restrict which apps are using data called Trip Mode. With Trip Mode, I can automatically block all connections by default and only allow whitelisted apps. I don't see that mode for Little Snitch Mini, but if it had that mode, I might completely replace Trip Mode with it.
kccqzy 4y ago
I used to use Little Snitch quite a lot, but eventually I gave up. Two things contributed to it: (a) a lot of apps started using nsurlsessiond to load URLs, obscuring the real originator; (b) a lot of apps started making requests to ec2-xx-xxx-x-xx.us-west-2.compute.amazonaws.com and making the server essentially anonymous except that it's hosted on AWS. Have things improved in the past few years?
ar9av 4y ago
I use Little Snitch on my MacBook Pro and love it. I’m a privacy nut and don’t relish the idea of behemoth corporations making money off me by exploiting my computer. It can be a pain to check every connection your browser tries to make but it’s worth it. Yesterday I shopped on three sites. None of them were Amazon. In that 24 hour period Amazon attempted to connect 259 times.- not their web services. To a lesser degree Google and then the social media sites. Facebook was the worst. I use an IP identification site to look up each IP that attempts to connect on Firefox and see what company it belongs to. After awhile you learn which sites the first 2-5 numbers belong to. It is one of the finest security programs on the market and well worth the money. Last week I did some holiday shopping for my granddaughter on the GAP site on my iPad and within 48 hours ads for GAP and all of their affiliated sites started showing up in my Twitter feed. I only use Firefox in private browsing mode now. Hope this helps!
- quesera 4y ago
  > within 48 hours ads for GAP and all of their affiliated sites started showing up in my Twitter feed That's called "retargeting". The advertising network tracks your web activity across multiple sites, and advertisers pay extra to target you because you've visited their site previously. Ad blockers break the code that tracks you around the web and the display of ads, whether new or retargeted. There are some decent options for iOS.
vaxman 4y ago
Will not help if you use Parallels. (Read the Privacy Policy of Parallels to see why.) Realtime connection info, logfiles and control arefeature of Murus, a frontend to the BSD pf that is included in macOS. This kind of tool really belongs in your routers not your Max though. Any VC on here should consider writing a check to a startup making coreboot/linuxboot or libreboot routers using hardware that doesn’t originate in China’s sphere of influence. (Even some routers recently sold at Walmart retail have been shown to have CCP backdoors!) [The ability to Notify a consumer’s Apple devices from their routers (using APNS command line utilities or CURL) has been around for a while so they can just as easily alert when That Guy in St Petersberg is launching a DDOS attack or whatever from the consumer’s p0wnd smartbulbs (as well as whatever trust is being violated by devs on their interactive computers) just like LittleSnitch/SOB/etc.] Peace
- hda111 4y ago
  What do you mean with Parallels?
rsync 4y ago
Two questions from someone who genuinely considering paying for "Little Snitch Mini": 1) Can I install this myself, without the app store ? Is there a binary or .dmg (or whatever) with published checksums that I can just download ? I assume the answer is "no" but ... surprise me. 2) What network traffic does LSM itself send home to LSM developers ? Can I disable all traffic as a specific preference or do I need to configure LSM to watch LSM itself ? (A specific preference would, in my mind, be preferable).
make2 4y ago
is https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html a viable alternative?
- gorbypark 4y ago
  LuLu works great. It's not quite as "polished" as Little Snitch (and LS Mini), but functionality wise it's pretty feature complete, IMO.
November-Echo 4y ago
Does anybody have a memory comparison between Little Snitch Mini and Little Snitch? What's the memory footprint of the Mini version? Regards, 8 GB MacBook Air
jachee 4y ago
Copy edit suggestion: > know to whom your Apps are talking to. Pick one instance of ‘to’ and delete the other. :)
bartkappenburg 4y ago
Love this tool! I upgraded to premium so that I could see which apps are the most chattiest... it turns out to be Tailscale. It connects to a lot of random places across the whole(!) world. See: https://imgur.com/a/Gc5pnih https://imgur.com/a/Gc5pnih Any reason for this behaviour?
- jachee 4y ago
  My semi-educated guess is verifying server status to know which endpoints are available.
- slhck 4y ago
  See https://tailscale.com/kb/1232/derp-servers/ https://tailscale.com/kb/1232/derp-servers/ They use those relay servers for handling NAT issues, and figuring out which one has the lowest latency requires them to ping them all. That said you can run your own one if you need to.
leokennis 4y ago
Unfortunately, if you're on a multi-user computer, MacOS networking (as far as I know) prevents Little Snitch to pass the "wife acceptance factor". Every rule/block I set in LS, applies to all users on the computer.
jonaswouters 4y ago
I hope they migrate some of the design from mini to the normal version. The mini version looks good with better use of space.
bit2pixel 4y ago
For people who don't want to or can't pay the subscription fee, you can install Pi-Hole on a Docker container on your local machine and get almost the same functionality with the cost of a little more battery usage.
rpgbr 4y ago
Does this add up for someone using NextDNS/Pi-Hole?
massysett 4y ago
Any thoughts on using this (or software like it) to beef up the security of old MacOS versions? I have an old MacBook Pro that can’t run the latest macOS anymore. I would rather not toss the machine but I’m skittish to use it without security updates. But I might be willing to use it if I could secure it “enough” by monitoring what it does on the Internet, and by not putting sensitive data on it - for example I wouldn’t log it in to my iCloud and would only use it for some non-sensitive tasks (I use TaskWarrior as a task tracker. This works fine on an old Thinkpad but that thing has a miserable screen.)
berdon 4y ago
Most people interested in the non-mini should buy a normal, non-subscription license: https://www.obdev.at/products/littlesnitch/order.html https://www.obdev.at/products/littlesnitch/order.html

784 points by robenkleene 4y ago

The original/full Little Snitch is the first thing I install on a new Mac. Can't live without it.

How does this compare to the "LuLu" app from Objective-See? IIRC that one was open source, while this isn't. A few years ago there was a concern that Apple was exempting itself from some of these firewalls. Were these concerns ever addressed in any meaningful way by any of these apps since then?

lapcat 4y ago
> IIRC that one was open source, while this isn't. Yes. Little Snitch has been around for for a long time, though, something like 20 years. The developer Obdev is trustworthy, and I wholeheartedly recommend Little Snitch (the full version; I haven't tried the Mini version). > A few years ago there was a concern that Apple was exempting itself from some of these firewalls. Were these concerns ever addressed in any meaningful way by any of these apps since then? Apple fixed the issue.
- dylan604 4y ago
  >Apple fixed the issue. What does that mean? They now play by the same rules as other software, or they just did something else without actually addressing the problem? After Office Space and "we fixed the glitch", simply saying "fixed the issue" leaves a lot to the imagination.
  - lapcat 4y ago
    > What does that mean? They now play by the same rules as other software Yes. Here's the developer of LuLu explaining it: https://www.patreon.com/posts/46179028 https://www.patreon.com/posts/46179028
    - rvnx 4y ago
      I think I saw that Little Snitch itself doesn't show all its own connections as far as I know EDIT: Source was old posts on alt.hackintosh saying that you have to block one specific IP to prevent the call home and another one regarding LS4 saying that you have to nullroute some some Hetzner hosts. My guess was that if you had to add some hosts to prevent LS to check its own license online, that it means that LS has its own way to go around the firewall rules. EDIT2: Genuinely no idea, I guess we have to ask someone who uses a cracked version
      - lapcat 4y ago
        > Though Little Snitch itself doesn't show all its own connections as far as I know It does. You can even block the Little Snitch Software Update process if you want.
        deleted 4y ago
        [deleted]
      - sneak 4y ago
        Yes, it does.

SamuelAdams 4y ago

How is this different from the traditional version of Little Snitch?

ladberg 4y ago
https://obdev.at/products/littlesnitch-mini/compare.html https://obdev.at/products/littlesnitch-mini/compare.html Basically a lot fewer filtering features, and only monitoring for free.
- distantsounds 4y ago
  Imagine putting IP blocking behind your paid product. And here we have every problem with the Mac software ecosystem summed up.
jonnat 4y ago
They have a comparison page: https://obdev.at/products/littlesnitch-mini/compare.html https://obdev.at/products/littlesnitch-mini/compare.html
- crazygringo 4y ago
  It's remarkably difficult to compare the two with how they describe them in totally different ways. It really makes my wish they had one of those side-by-side charts that tells you which features are in what.

mberning 4y ago

I bought little snitch years ago but could never get into using it consistently. Always seemed like a chore.

kstrauser 4y ago
It's most definitely a chore for the first week. Then it disappears from sight until it finds something unusual.
deleted 4y ago
[deleted]

ladberg 4y ago

The monitoring is super useful for metered connections (looking at you, Comcast/Xfinity) and I happily paid for the full Little Snitch for that feature. Super glad to hear it’s free now! I’ve tried to recommend it to people and it was a bit of a big purchase for most to stomach just for the monitoring features.

lucideer 4y ago

As someone who's been paying for Little Snitch for a long time this is an odd move, as this seems to do everything I would want. Sure, I've availed of some of the more advanced features in the paid version, but they definitely never seemed essential to me. What I mainly need is the basics they've included in the free version now. I wonder if this is a direct response to Lulu (have been meaning to try it but migration is friction)

darkstar999 4y ago
But you don't get connection blocking for free. > The network monitoring functionality, including the real-time connection list, traffic diagrams and the animated map view can be used for free! > The full feature set, including connection blocking, extended traffic history time ranges, advanced display and filtering options and more is available as an in-app purchase.
- dylan604 4y ago
  I guess if you are just doing an investigation to see if there is any unusual traffic, the free version can be useful. Since it's not actually preventing any of the traffic, it doesn't make the paid for version useless. For those that want to stop the data flow but continue using the chatty software, upgrading to the paid version would still be a thing. If you're the type to just stop/remove chatty software, then this free version will help find them. Seems kind of cool.
- lucideer 4y ago
  Ah! Ok I did miss that detail. In that case this makes more sense.

ary 4y ago

People are probably going to be confused between this and the "full" version of Little Snitch. My take on it is that Little Snitch Mini is something you can install on a non-technical friend or family member's computer whereas power users may want to stick with the existing offering. I say this as a long time heavy user of Little Snitch. It's very annoying when you first get it installed, but it provides really useful control over what installed software is getting up to. After a time you settle into a natural rule set for your personal patterns and only see alerts when new or updated software tries a network connection that hasn't been seen before. "Mini" strikes me as much more of a fire-and-forget product, which I appreciate but won't personally use.

dmix 4y ago
I've always thought this should be a feature in an OS for advanced users. Combined with some OS level security optimizations it could be quite a powerful security feature for the paranoid and at-risk. I haven't tried mini but there's probably plenty of UX gains in between the standard Little Snitch fine control approach and the UBlock Origin style community curated defaults where control/customization is optional/on-demand.
- ary 4y ago
  Completely agree. Occasionally I run Charles Proxy[1] on my iPhone to analyze network activity and am disturbed by what I see. Software shouldn't be able to open arbitrary network connections without user consent/control, but we're not there yet to a large enough degree on mobile unfortunately. [1] https://www.charlesproxy.com/documentation/ios/ https://www.charlesproxy.com/documentation/ios/
  - KyeRussell 4y ago
    The reality is that this sort of control would only be attractive to a very very small fraction of users, and no, not just because ‘people don’t care about privacy’ or whatever. There are just very few situations where someone is going to be able to look at this sort of data and do anything meaningful with it, especially when a) most apps are justifiably internet-connected, and b) the homogeneity of public cloud infra means you can’t really tell anything apart from endpoint alone.

alad_ 4y ago

Any thoughts on the difference between using this vs DNS (e.g. nextdns) with blocklists? It seems like DNS is more convenient as you don't need to run extra software on your machine and it works on any device.

lapcat 4y ago
> Any thoughts on the difference between using this vs DNS (e.g. nextdns) with blocklists? Little Snitch is process-based, so you can block a specific process from connecting to a specific domain while allowing other processes to connect to the domain, whereas with DNS you have to block every process from the domain. And of course Little Snitch gives you process-level info too, which DNS doesn't.
xp84 4y ago
Theoretically LS could tell you if some malware was connecting to, say, a strange IP address, which wouldn't ever hit DNS. Obviously a smart/sophisticated Russian hacker wouldn't be connecting directly to a Russian IP, rather using a local-to-you cloud server as an intermediary, but still. I think LS is more oriented toward someone who wants disclosure, as opposed to someone who wants specifically to minimize telemetry and trusts a blocklist to do a good enough job.

dt3ft 4y ago

Is there a Little Snitch alternative for Windows?

Wistar 4y ago
A good question. I looked it up. The AlternativeTo site offers a few PC alternatives to Little Snitch: "Little Snitch is not available for Windows but there are plenty of alternatives that runs on Windows with similar functionality. The best Windows alternative is GlassWire, which is free." https://alternativeto.net/software/little-snitch/?platform=windows https://alternativeto.net/software/little-snitch/?platform=w...
- eviks 4y ago
  It's not free for the most important part - blocking
oktwtf 4y ago
simplewall[0] is my #1 install on a new machine. Little different, but it'll still alert you to the requests, allow for timers, per application/route rules etc. [0]: https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall
- sasas 4y ago
  Can recommend simplewall - only only is it free, it's completely opensource. Works wonderfully - highly recommended.
dylan604 4y ago
I'm kind of scared to learn exactly how chatty Windows would be.
- oktwtf 4y ago
  It's not as bad as the vine says, but one thing that drives me crazy, is widgets.exe seems to get a new hash /often/ and I constantly get prompts for it. It's all the installers that phone home at some point, and video drivers needing access etc. (Wireless displays come at a cost I guess).

jacooper 4y ago

Seems to do the same thing as Safings Postmaster, which is also Free and open source.

Thoreandan 4y ago
TIL! thanks. https://github.com/safing/portmaster https://github.com/safing/portmaster https://safing.io/ https://safing.io/
jacooper 4y ago
Portmaster*

obenn 4y ago

Was ready to buy this until I saw it is a subscription, not stand-alone.

selykg 4y ago
Price seems fair, honestly. The full blown app is like $70, plus upgrades when those come.
- latexr 4y ago
  I’d gladly pay 70$ for this, for myself and maybe a couple of friends, if it were a one-time purchase. As a subscription, I just closed the page. Several apps on the Mac App Store have both subscription and lifetime pricing. I’ve bought several.
  - lapcat 4y ago
    The non-Mini version of Little Snitch is a one-time purchase.
    - latexr 4y ago
      The non-Mini version was such a hassle to maintain¹ that I stopped using it². This looked like a great middle ground, until the subscription part. ¹ I don’t want to become a networking expert and babysit everything. I already practice good security regarding what I install and run, I just want a little more control. ² And if it was a bother for me, there’s zero chance any of my non-technical friends would last an hour.
      - selykg 4y ago
        I forget what it's called but there's a mode you can put Little Snitch into that it allows whatever goes through and you can monitor it by opening and reviewing when you want. I think that's fairly similar to what mini does. This turns off all the nagging. This is actually what I did last time I used Little Snitch, it helped a lot. When I installed a new app I'd use it for a bit, then review in LS and see what it was doing. From there I could allow or disallow whatever I needed. It's sort of the reverse of "block everything until allowed"

tinglymintyfrsh 4y ago

I use LS. Mini wouldn't work for me at work or home. It's probably targeted and useful for non-developer users. I also use Objective See's LuLu, OverSight, ReiKey, and RansomWhere. https://objective-see.org https://objective-see.org LuLu + LS makes any app using telemetry shriekingly obvious and selectively denyable. Work additionally deploys YARA, MS MDE, Malware Bytes, and an MDM. There are other internal tools for password projection, DLP (anti-exfil), and pre-execution binary allow/denylisting.

krono 4y ago
LuLu itself sends telemetry to Sentry by default
- sneak 4y ago
  This is why I pay for LS. The whole point of the software is to avoid nonconsensual phone-home; if it does it itself, how or why would you ever trust the developer? I'd literally rather pay for proprietary software than maintain a fork of LuLu.
  - Zetice 4y ago
    It's not nonconsensual, you can literally block it with itself.
    - deleted 4y ago
      [deleted]
    - krono 4y ago
      It transmits telemetry non-consensually before you even get a chance to tell it not to. That is, unless you know of this beforehand and are also tech-literate enough to understand this can be circumvented by disabling your internet connection before you first open the application - something you cannot reasonably expect from all users, seeing as how this telemetry gathering is not advertised anywhere and had to be found in the source code.

amelius 4y ago

So, from a user's viewpoint, if your app talks to blah.serv.direct.data.com how do you know whether it actually needs that server for its main functionality or not? I don't see how this snitch tool will not just generate a lot of noise.

kibwen 4y ago
Block the request and see what breaks.
- amelius 4y ago
  The problem is that you have to do it for tens to hundreds of addresses. And they may change too. It's a lot of manual work.
deleted 4y ago
[deleted]
dkjaudyeqooe 4y ago
It all depends on the application. If there is no reason for it to talk to various servers then blocking them usually is fine. If it actually breaks something then you can proceed to uninstalling it. Most of it is telemetry you didn't agree to, or worse.

npunt 4y ago

Smart move to go for the more casual user, it suggests Obdev has been doing their homework and proactively talking to regular users, rather than just blindly building feature requests. Tools like this so often get sucked into serving the loud minority of expert users with ever more esoteric use cases, which leads to a death spiral of audience capture where the tool gets more and more complicated and harder to approach for casuals. Little Snitch Mini looks great, I'm going to recommend it to friends!

j_crick 4y ago

Not liking the direction Apple took with OS X user interfaces and stuff in the later years, I generally stuck with Mojave on my macs. I wish I could try this without upgrading to ah, what was it, Monterey? but alas, alas.

deleted 4y ago
[deleted]

Arch-TK 4y ago

Why does factorio literally perform better on my laptop than websites like these? Is this just firefox on linux being bad at hardware rendering? Is it some crappy API people are forced to use to do these animations? I don't get it.

pantalaimon 4y ago
On Linux you can use OpenSnitch [0] instead anyway. [0] https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
- heybrendan 4y ago
  Thanks for sharing! I suspect many of you are curious about CLI-only support (I was). I spotted this old, closed issue [1]. [1] https://github.com/evilsocket/opensnitch/issues/511 https://github.com/evilsocket/opensnitch/issues/511
ezfe 4y ago
This page runs at full speed in Safari

jonpurdy 4y ago

When I first saw the headline I assumed they made an iOS version and worked with Apple to do it. I would’ve insta-bought! Unfortunately just an easier to use Mac version. iOS really needs this functionality.

lapcat 4y ago
If you want to see how bad iOS is about phoning home, just run the Xcode iOS simulator on a Mac with Little Snitch. Spoiler: It's bad.
prime17569 4y ago
iOS also has the App Privacy Report, which can tell you about the network requests that apps make: https://support.apple.com/en-us/HT212958 https://support.apple.com/en-us/HT212958

donohoe 4y ago

I would happily pay $20 or $30 for a version of this, but I will absolutely not pay a subscription fee for extra features. I have too many subscriptions... I want to support this developer but not this way. Uninstalling :(

viewtransform 4y ago
How much is the subscription fee ? - it is not mentioned on their site.
- simple10 4y ago
  Subscription is $13.49/yr or $1.49/mo for mini according to Mac Store page.
  - lockhouse 4y ago
    In all fairness, you can't even buy a cup of black coffee from a 7-Eleven for that much.
    - latexr 4y ago
      Please let’s stop comparing software subscriptions to coffee. It misses the point about the recurring cost and lock in, and not everyone lives in the USA and pays high prices for coffee every day (or ever). https://news.ycombinator.com/item?id=32738791 https://news.ycombinator.com/item?id=32738791
      - lockhouse 4y ago
        I don't like subscriptions either, but what is the sustainable alternative income source for app developers?
        stanmancan 4y ago
        I like Jetbrains licensing. Essentially you pay for updates and once you stop paying you’re locked in at that specific version, but you can use it indefinitely.

snotrockets 4y ago

It seems as if you can only have a single network filter in mac os. And because a DNS profile already counts as one, you can't have both.

asjldkfin 4y ago

"Radio Silence" does the same thing as this- but without subscription. And only $9.

hit8run 4y ago
I'm using radio silence for years and it is awesome :) https://radiosilenceapp.com https://radiosilenceapp.com

daneel_w 4y ago

I bought Little Snitch long ago but managed to squander my license a couple of years later. Mini is unfortunately a subscription app, which is something I these days consider a hostile/unfriendly business pattern. I won't be going back. LuLu is a free alternative.

keyle 4y ago
Using LuLu for so long I actually forgot that I have it running! +1 for LuLu.
hayst4ck 4y ago
I generally agree with you so I looked it up. In-App Purchases: Yearly Subscription $13.49 Monthly Subscription $1.49 That's surprisingly modest. 3-4 years of subscription approximately being equal to a license sounds reasonable. The real question is, is little snitch rent seeking? Given what happened after Catalina, I am giving them the benefit of the doubt at the moment. Paying for updates before receiving them definitely creates a conflict of interest. Having looked at their website and seeing SKU-ification (Cutting a product different ways to try to hit different price points) and other business over product decisions, I am definitely feeling shaky about the future of little snitch. SKU-ification is 10x the red flag that a subscription model is. It's worth considering that viruses now days will check and see if programs like this are running and then delete themselves rather than execute the payload.
- latexr 4y ago
  > 3-4 years of subscription approximately being equal to a license sounds reasonable. Which is probably why the apps on the App Store which offer both subscription and lifetime pricing tend to have the latter at about 3 times the cost of the former. But Little Snitch Mini does not offer that choice. I’d be willing to pay more than 40$ for a one-time purchase of Little Snitch Mini, but there’s zero chance I’ll do it as a subscription.
  - hayst4ck 4y ago
    I see both sides. This dilemma is capitalist hell. Why is obdev sku-ifying their product? Because the incentive model for selling a license means that the market can saturate and there is a lack of recurring or stable income/income safety for the dev. In order to get new spikes of income, a new product is generated. If the market for a particular license becomes saturated, how will they make more money? Licensed based sales incentivizes creation of new product and disincentivizes incremental improvements on already complete products. On the other hand, subscription models incentivize rent seeking. If money is coming in, there is no reason to do more work. Income is not dependent in any way for work done, except maybe compatibility adjustments. So a license is a wonderful model for the buyer and not so great for the seller. A subscription is awful for the buyer, but too good for the seller. So what kind of payment method/pricing scheme, keeps the developer engaged in improving the product, but doesn't incentivize rent-seeking? How would you price things if you were the seller?

apimade 4y ago

I've been beta testing Little Snitch Mini for the past 6 weeks and I have to say it's exactly what I wanted. Really happy with it, the development team should be proud of such a great product. It does a few things, and it does them very well. However I don't love the SaaS nature of the product post-release, because tying my security posture to a credit card payment isn't something I love. Sure, I can make it so I only have to worry about it once per year - however what value does this continue to bring me beyond the current capabilities? It seems the last iteration of Little Snitch from 4 to 5 added a CLI, some of the traffic stats we can see in Mini, but was mostly compatibility-related updates. MacOS went through some pretty major changes going to Ventura and all of the Extension-level changes which affected so many security tools, so I feel like the work there was substantial and justified the new license. For $69 (or $30 on-sale) every few years, it definitely makes me question the value the original version provides a power-user or technical user, over a monthly subscription which I'd need to monitor over the years in this new product, LSM. Now I'm unsure what market segment the LSM product addresses. uBlock Origin seems to serve the majority of use-cases for a typical casual user, and network-level filters really don't seem relevant for the everyday user - particularly with the increasing adoption of DoT/DoH, making DNS-level filtering less useful. I originally assumed this product was for power-users who didn't need the full suite of LSM, and liked the MVP-style interface. But just for the sake of not having to worry about an on-going fee - I think I'll be hard-pressed to adopt it. As a workaround - I'd love an option to pre-purchase 3 years up-front.

gumby 4y ago

I know that talking about the site design itself is discouraged, but that was terrible to read. I wanted to see what was new (why is this "mini"?) but as I scrolled down I had to wait as it fetched content and slowly made it appear. Instead I closed the tab and hoped to learn that from the HN discussion page. When I think of little snitch I think of something that makes my computing better. This page was the opposite -- off brand.

guessmyname 4y ago

I've been using Little Snitch for years, and it's probably the most important software on my computer. However, I've noticed a problematic trend in modern software development: developers are using the same hostname to serve both functional and non-functional web APIs. For example, let's say that Apple's Xcode sends harmless data to their telemetry service at telemetry.apple.test. Even though the data is anonymous, I still choose to block it because I believe in protecting my data. But then, I realize that some features of Xcode, such as CI/CD, no longer work. It turns out that Xcode is also using the same domain to host an API for their cloud CI/CD offering. (hypothetical example) I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. I redirect non-functional HTTP requests to /dev/null and functional requests to the corresponding website. It works, but it's not a scalable solution. So, I have a feature request for the Objective Development team. Could they please implement an option to view the raw HTTP request in the alert window, especially if the network connection is to send an HTTP request? Sometimes, it's hard to decide whether to click “Allow” or “Deny” based solely on the hostname and port.

ramzyo 4y ago
I think this maybe could indicate potential increased usage of reverse proxies? Total shot in the dark though, not sure.
paxys 4y ago
This isn't some new "problematic trend". A website serving all kinds of requests from a single domain name has been how things have worked forever. Pages making cross-origin requests is in fact a new phenomenon, and has been widely adapted by the ad industry simply because the ad server cannot trust the content host to report its own ad view/click-through numbers. If the server doing the data collecting or ad serving is the same as the one providing the content, there's zero reason for them to be on different domains. And for all these cases any kind of network-level blocking is always going to be ineffective.
antifa 4y ago
> I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. What do you recommend for someone looking to get started with doing this to their own device(s)?

winstonprivacy 4y ago

Love it. But doomed to failure because it caters to a niche audience who generally believes they shouldn't have to pay for things Ask me how I know!

colordrops 4y ago

Is there an equivalent for Linux?

elesiuta 4y ago
I wrote picosnitch [1] which has the same notification and bandwidth monitoring features, however it doesn't block traffic for a couple reasons: avoiding scope creep so I can focus on more reliable detection and do things like hash every executable, which makes it harder to block traffic in a timely fashion. https://github.com/elesiuta/picosnitch https://github.com/elesiuta/picosnitch
- eviks 4y ago
  Blocking traffic is also the most important part of the scope of such firewall apps
  - elesiuta 4y ago
    What is your threat model, and what type of traffic are you hoping to block? I never claimed picosnitch to be a firewall. My use case involved running it on servers with a minimal OS where all applications are containerized. My goal was purely monitoring to see if any containers had rogue executables, and go from there. Without the containers, it would be trivial for a malicious program to stop or modify picosnitch, and the same goes for firewalls hoping to block programs on Linux due to its security model [1]. You need to use some sort of sandboxing [2]. [1] https://madaidans-insecurities.github.io/linux.html#sandboxing https://madaidans-insecurities.github.io/linux.html#sandboxi... [2] https://blog.privacyguides.org/2022/04/22/linux-application-sandboxing/ https://blog.privacyguides.org/2022/04/22/linux-application-...
    - eviks 4y ago
      I never claimed you claimed it. I was just pointing out the huge deficiency that makes picosnitch not an alternative to the broader use case littlesnitch supports To sidestep the more complicated discussion re. how poor the security architecture of Linux is, let's limit that use case to blocking legitimate apps' connections for privacy reasons

pkulak 4y ago

> You deserve to know to whom your Apps are talking to. Ooo, one word too many.

fuzzfactor 4y ago
“This is the sort of English up with which I will not put.”

slimebot80 4y ago

Silly question, but how do we know to trust an app where all internet traffic passes through it? There's a lot of scrutiny of VPN services in this regard, should it be the same here?

paxys 4y ago
At some level you have to trust whatever you install on your computer. There's no way to ever prove that it is safe or not. If the developer's reputation, recommendations by the community, quality of the product etc. aren't enough then it's best to just not use it. Beyond that, Little Snitch (and Little Snitch Mini I assume) operates as a network firewall. It can see the domain where the traffic is going, and block it if it wants, but can't see or decrypt the contents of the message. The OS itself will not allow it to.

kylehotchkiss 4y ago

I love Little Snitch (full). This looks like the best parts and easier to use! Big congrats to Objective Dev on the launch. I’ll use this on my slightly slower computers. One of my favorite use cases is making sure when I’m traveling abroad that my computer only connects to work apps over a VPN but blocks them otherwise. The auto profile switching supports vpn connections for this purpose.

JasonZ2 4y ago

I have to download and install the app to see how much it costs? They don't even list the price along with their other products: https://obdev.at/shop/index.html https://obdev.at/shop/index.html

happybuy 4y ago
I know from personal experience of making and selling an App Store app [1] that it can be difficult to show accurate pricing on your products website. There can be 175+ different territories that you may sell an app in, each with a different local price point. You also can't expect to simply show a converted $US dollar amount either as you may want to do price discrimination (so that the app is cheaper for regions that cannot afford the exact $US equivalent). Overall options seem to be: 1. Don't show pricing and leave it for the App Store to display - the most common approach 2. Only show $US pricing on the website and let non-US customers manually translate to their local pricing - not a great experience for non-US users 3. Manually or automatically sync pricing on the website display with the actual current App Store pricing. This is quite a labour or integration intensive task and I've only seen this been done by large vendors [1] https://www.magiclasso.co/ https://www.magiclasso.co/
- JasonZ2 4y ago
  Sounds like an excuse to just not display the price. > 2. Only show $US pricing on the website and let non-US customers manually translate to their local pricing - not a great experience for non-US users It's a worse experience for someone to convert USD to their currency (instant mentally or 2 seconds on Google) compared to launching the app store, installing the app, getting to the purchase menu, and seeing the price?
  - bendiksolheim 4y ago
    You don’t need to install the app, the prices are displayed on the product page in the App Store, towards the bottom. It’s listed automatically for all apps.

travisporter 4y ago

Does anyone else remember zonealarm

glennos 4y ago
Yes! Does anyone remember BlackICE?
- satysin 4y ago
  Ahh BlackICE, Kerio Personal Firewall and ZoneAlarm Pro. Those were the days! Plus the rise of the anti-spyware applications such as GIANT AntiSpyware which Microsoft bought and is now known as Windows Defender (although I don't much if any of the GIANT code is still around). Sure was a fun time in the late 90s and early 00s for client side security software. When Microsoft introduced the Windows Firewall with XP SP2 a lot of things sort of died out and then we had a rise in things like CCleaner for system "cleaning". While things like CCleaner started out with a few useful features they long ago turned into crap and should be avoided. One of the things I do enjoy about Little Snitch is it gives me that early 2000s nostaltia every now and then when I new pop-up reminds of me ZoneAlarm :)
Whatarethese 4y ago
Miss those red and green bars!

footlose_3815 4y ago

why not make piehole rules for what little snitch covers?

gorbypark 4y ago
While Little Snitch can do general blocking from a block file, its main use is per-process blocking. With PiHole, you can't see what process on your computer is making the request, just that your computer's IP is making it. Little Snitch (and LuLu) are great, because you can see what program is actually making the request, and block/allow/setup rules for it.

joanne123 4y ago

[dead]

Terretta 4y ago

"The full feature set, including connection blocking, extended traffic history time ranges, advanced display and filtering options and more is available as an in-app purchase." So this means as a company using MDM, I cannot purchase it for all my employees. MacOS devs who see IAP and subscriptions as the only purchase paths are leaving corporate purchases on the table. We choose software we can pay for. We are fine if it's priced fairly to support the developer and the work to get to the next version. We are fine paying for the next version too. But IAP or subs paid for by company? Apple itself doesn't support that on Macs managed using their corp device management. (And no, the user cannot buy it and expense it either, IAP/subs are disallowed on managed Apple IDs.) Indie MacOS devs, all you have to do is also list a full retail version. You will have buyers. $2.99/month sub also sold $79 full price and a major update each 2 years with a new full retail version number? You will still have buyers, and you'll have the cash now, instead of over the 2 years.

jiveturkey 4y ago
https://www.obdev.at/products/littlesnitch/order.html https://www.obdev.at/products/littlesnitch/order.html
- mattl 4y ago
  This doesn’t contain the mini product
  - memsom 4y ago
    The UI does look different, but functionality looks the same.
  - jiveturkey 4y ago
    The parent didn't want the mini product. He wanted the full paid version (what you get if you do the IAP in the mini product).
    - mattl 4y ago

owaislone 4y ago

This page is somewhat misleading. It pretends Little Snitch Mini supports blocking but that is not true and only works in the paid version. It does clarify this at the very bottom but weird to have your free app's landing page list features from the paid version. At least put a "premium" sticker on those screenshots or something.

yosito 4y ago

I like this app. It's very similar to an app I already use to restrict which apps are using data called Trip Mode. With Trip Mode, I can automatically block all connections by default and only allow whitelisted apps. I don't see that mode for Little Snitch Mini, but if it had that mode, I might completely replace Trip Mode with it.

kccqzy 4y ago

I used to use Little Snitch quite a lot, but eventually I gave up. Two things contributed to it: (a) a lot of apps started using nsurlsessiond to load URLs, obscuring the real originator; (b) a lot of apps started making requests to ec2-xx-xxx-x-xx.us-west-2.compute.amazonaws.com and making the server essentially anonymous except that it's hosted on AWS. Have things improved in the past few years?

ar9av 4y ago

I use Little Snitch on my MacBook Pro and love it. I’m a privacy nut and don’t relish the idea of behemoth corporations making money off me by exploiting my computer. It can be a pain to check every connection your browser tries to make but it’s worth it. Yesterday I shopped on three sites. None of them were Amazon. In that 24 hour period Amazon attempted to connect 259 times.- not their web services. To a lesser degree Google and then the social media sites. Facebook was the worst. I use an IP identification site to look up each IP that attempts to connect on Firefox and see what company it belongs to. After awhile you learn which sites the first 2-5 numbers belong to. It is one of the finest security programs on the market and well worth the money. Last week I did some holiday shopping for my granddaughter on the GAP site on my iPad and within 48 hours ads for GAP and all of their affiliated sites started showing up in my Twitter feed. I only use Firefox in private browsing mode now. Hope this helps!

quesera 4y ago
> within 48 hours ads for GAP and all of their affiliated sites started showing up in my Twitter feed That's called "retargeting". The advertising network tracks your web activity across multiple sites, and advertisers pay extra to target you because you've visited their site previously. Ad blockers break the code that tracks you around the web and the display of ads, whether new or retargeted. There are some decent options for iOS.

vaxman 4y ago

Will not help if you use Parallels. (Read the Privacy Policy of Parallels to see why.) Realtime connection info, logfiles and control arefeature of Murus, a frontend to the BSD pf that is included in macOS. This kind of tool really belongs in your routers not your Max though. Any VC on here should consider writing a check to a startup making coreboot/linuxboot or libreboot routers using hardware that doesn’t originate in China’s sphere of influence. (Even some routers recently sold at Walmart retail have been shown to have CCP backdoors!) [The ability to Notify a consumer’s Apple devices from their routers (using APNS command line utilities or CURL) has been around for a while so they can just as easily alert when That Guy in St Petersberg is launching a DDOS attack or whatever from the consumer’s p0wnd smartbulbs (as well as whatever trust is being violated by devs on their interactive computers) just like LittleSnitch/SOB/etc.] Peace

hda111 4y ago
What do you mean with Parallels?

rsync 4y ago

Two questions from someone who genuinely considering paying for "Little Snitch Mini": 1) Can I install this myself, without the app store ? Is there a binary or .dmg (or whatever) with published checksums that I can just download ? I assume the answer is "no" but ... surprise me. 2) What network traffic does LSM itself send home to LSM developers ? Can I disable all traffic as a specific preference or do I need to configure LSM to watch LSM itself ? (A specific preference would, in my mind, be preferable).

make2 4y ago

is https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html a viable alternative?

gorbypark 4y ago
LuLu works great. It's not quite as "polished" as Little Snitch (and LS Mini), but functionality wise it's pretty feature complete, IMO.

November-Echo 4y ago

Does anybody have a memory comparison between Little Snitch Mini and Little Snitch? What's the memory footprint of the Mini version? Regards, 8 GB MacBook Air

jachee 4y ago

Copy edit suggestion: > know to whom your Apps are talking to. Pick one instance of ‘to’ and delete the other. :)

bartkappenburg 4y ago

Love this tool! I upgraded to premium so that I could see which apps are the most chattiest... it turns out to be Tailscale. It connects to a lot of random places across the whole(!) world. See: https://imgur.com/a/Gc5pnih https://imgur.com/a/Gc5pnih Any reason for this behaviour?

jachee 4y ago
My semi-educated guess is verifying server status to know which endpoints are available.
slhck 4y ago
See https://tailscale.com/kb/1232/derp-servers/ https://tailscale.com/kb/1232/derp-servers/ They use those relay servers for handling NAT issues, and figuring out which one has the lowest latency requires them to ping them all. That said you can run your own one if you need to.

leokennis 4y ago

Unfortunately, if you're on a multi-user computer, MacOS networking (as far as I know) prevents Little Snitch to pass the "wife acceptance factor". Every rule/block I set in LS, applies to all users on the computer.

jonaswouters 4y ago

I hope they migrate some of the design from mini to the normal version. The mini version looks good with better use of space.

bit2pixel 4y ago

For people who don't want to or can't pay the subscription fee, you can install Pi-Hole on a Docker container on your local machine and get almost the same functionality with the cost of a little more battery usage.

rpgbr 4y ago

Does this add up for someone using NextDNS/Pi-Hole?

massysett 4y ago

Any thoughts on using this (or software like it) to beef up the security of old MacOS versions? I have an old MacBook Pro that can’t run the latest macOS anymore. I would rather not toss the machine but I’m skittish to use it without security updates. But I might be willing to use it if I could secure it “enough” by monitoring what it does on the Internet, and by not putting sensitive data on it - for example I wouldn’t log it in to my iCloud and would only use it for some non-sensitive tasks (I use TaskWarrior as a task tracker. This works fine on an old Thinkpad but that thing has a miserable screen.)

berdon 4y ago

Most people interested in the non-mini should buy a normal, non-subscription license: https://www.obdev.at/products/littlesnitch/order.html https://www.obdev.at/products/littlesnitch/order.html