5 ms·

We desperately need OS level user configurable firewalls. I need to be able to download an app and tell the OS “this app cannot access the internet in any way

We desperately need OS level user configurable firewalls. I need to be able to download an app and tell the OS “this app cannot access the internet in any way shape or form”. It won’t solve all the problems. But at least for apps like “alarm clock” or whatever that should be able to work offline, the OS should guarantee it remains offline.

noja 3y ago
https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
- DueDilligence 3y ago
  [dead]
yomlica8 3y ago
It can help, but most OSes are in on the scam so it often asking the fox to guard the hen house.
- intelVISA 3y ago
  Protecting your network only really works at the router level for this reason. Hence Google's push to normalize adtech like QUIC to evade this.
akyuu 3y ago
There are several existing options: - Windows: Simplewall (uses native WPF for filtering), Portmaster (interactive firewall, uses custom kernel extension). - macOS: LuLu or Little Snitch (they all use a native filtering API, which unfortunately is not perfect: https://lapcatsoftware.com/articles/2023/6/3.html https://lapcatsoftware.com/articles/2023/6/3.html). - Linux: OpenSnitch, denying network permission to Flatpak apps. - Android: Rethink, NetGuard; GrapheneOS has app network permission natively. iOS is the only OS where no application firewall is available, although if you don't use Wi-Fi, you can block apps from using cellular data.
ignoramous 3y ago
> We desperately need OS level user configurable firewalls (I co-develop a FOSS network monitor for Android) Yes, but: "OS level" firewalls are as weak as the OS itself (as in, if an app gets root, all the sandboxing and firewalling is pretty much done for). One probably must use an external firewall for better protection, but the problem is of course, one can't expect to carry it around everywhere. While for smartphones, the external firewall (fronting an AP / Wifi) is bypassed when using mobile data. For unprivileged installed apps (as opposed to OEM apps), perhaps a un-rootable OS-level firewall works.

noja 3y ago

https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html

DueDilligence 3y ago
[dead]

yomlica8 3y ago

It can help, but most OSes are in on the scam so it often asking the fox to guard the hen house.

intelVISA 3y ago
Protecting your network only really works at the router level for this reason. Hence Google's push to normalize adtech like QUIC to evade this.

akyuu 3y ago

There are several existing options: - Windows: Simplewall (uses native WPF for filtering), Portmaster (interactive firewall, uses custom kernel extension). - macOS: LuLu or Little Snitch (they all use a native filtering API, which unfortunately is not perfect: https://lapcatsoftware.com/articles/2023/6/3.html https://lapcatsoftware.com/articles/2023/6/3.html). - Linux: OpenSnitch, denying network permission to Flatpak apps. - Android: Rethink, NetGuard; GrapheneOS has app network permission natively. iOS is the only OS where no application firewall is available, although if you don't use Wi-Fi, you can block apps from using cellular data.

ignoramous 3y ago

> We desperately need OS level user configurable firewalls (I co-develop a FOSS network monitor for Android) Yes, but: "OS level" firewalls are as weak as the OS itself (as in, if an app gets root, all the sandboxing and firewalling is pretty much done for). One probably must use an external firewall for better protection, but the problem is of course, one can't expect to carry it around everywhere. While for smartphones, the external firewall (fronting an AP / Wifi) is bypassed when using mobile data. For unprivileged installed apps (as opposed to OEM apps), perhaps a un-rootable OS-level firewall works.