3 ms·

I've been using Little Snitch for years, and it's probably the most important software on my computer. However, I've noticed a problematic trend in modern softw

I've been using Little Snitch for years, and it's probably the most important software on my computer. However, I've noticed a problematic trend in modern software development: developers are using the same hostname to serve both functional and non-functional web APIs. For example, let's say that Apple's Xcode sends harmless data to their telemetry service at telemetry.apple.test. Even though the data is anonymous, I still choose to block it because I believe in protecting my data. But then, I realize that some features of Xcode, such as CI/CD, no longer work. It turns out that Xcode is also using the same domain to host an API for their cloud CI/CD offering. (hypothetical example) I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. I redirect non-functional HTTP requests to /dev/null and functional requests to the corresponding website. It works, but it's not a scalable solution. So, I have a feature request for the Objective Development team. Could they please implement an option to view the raw HTTP request in the alert window, especially if the network connection is to send an HTTP request? Sometimes, it's hard to decide whether to click “Allow” or “Deny” based solely on the hostname and port.

ramzyo 4y ago
I think this maybe could indicate potential increased usage of reverse proxies? Total shot in the dark though, not sure.
paxys 4y ago
This isn't some new "problematic trend". A website serving all kinds of requests from a single domain name has been how things have worked forever. Pages making cross-origin requests is in fact a new phenomenon, and has been widely adapted by the ad industry simply because the ad server cannot trust the content host to report its own ad view/click-through numbers. If the server doing the data collecting or ad serving is the same as the one providing the content, there's zero reason for them to be on different domains. And for all these cases any kind of network-level blocking is always going to be ineffective.
antifa 4y ago
> I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. What do you recommend for someone looking to get started with doing this to their own device(s)?
rsync 4y ago
"It turns out that Xcode is also using the same domain to host an API for their cloud CI/CD offering. (hypothetical example) ..." By "domain" I think you mean a full FQDN and not a top-level "apple.com" and I agree that this is troublesome and then go further and suggest that this is by design.
wepple 4y ago
> Could they please implement an option to view the raw HTTP request in the alert window, This would be very, very hard to do well. First, for anything that doesn’t use standard libraries for TLS it’s simply not possible. And for things that do, you’re putting this software in a phenomenally trusted position. And then actually maintaining and using a deny/allow list based on something more granular than host:port will be so high that it’s a 0.1% of users type feature. Negative RoI

ramzyo 4y ago

I think this maybe could indicate potential increased usage of reverse proxies? Total shot in the dark though, not sure.

paxys 4y ago

This isn't some new "problematic trend". A website serving all kinds of requests from a single domain name has been how things have worked forever. Pages making cross-origin requests is in fact a new phenomenon, and has been widely adapted by the ad industry simply because the ad server cannot trust the content host to report its own ad view/click-through numbers. If the server doing the data collecting or ad serving is the same as the one providing the content, there's zero reason for them to be on different domains. And for all these cases any kind of network-level blocking is always going to be ineffective.

antifa 4y ago

> I've been trying to solve this problem by routing my network traffic through my own software and manually inspecting the traffic from time to time. What do you recommend for someone looking to get started with doing this to their own device(s)?

rsync 4y ago

"It turns out that Xcode is also using the same domain to host an API for their cloud CI/CD offering. (hypothetical example) ..." By "domain" I think you mean a full FQDN and not a top-level "apple.com" and I agree that this is troublesome and then go further and suggest that this is by design.

wepple 4y ago

> Could they please implement an option to view the raw HTTP request in the alert window, This would be very, very hard to do well. First, for anything that doesn’t use standard libraries for TLS it’s simply not possible. And for things that do, you’re putting this software in a phenomenally trusted position. And then actually maintaining and using a deny/allow list based on something more granular than host:port will be so high that it’s a 0.1% of users type feature. Negative RoI