3 ms·

I’ve found that by using subdomain wildcards and/or subnets, I build up a stable set of rules pretty quickly and then only have to review requests to new endpo

I’ve found that by using subdomain wildcards and/or subnets, I build up a stable set of rules pretty quickly and then only have to review requests to new endpoints once in awhile. To me, the peace of mind knowing that I’ll be prompted to allow new access is worth the initial hassle. And once the habit is built, it’s pretty easy to manage. Editing to add: I also use expiring rules regularly. Maybe I trust an installer and want to let it do its thing. So I open it up with a rule for the executable expiring in the near future (options include: forever, until reboot, for the next 30s, for the next 5 mins, etc). This can drastically simplify some tasks if there are a large number of endpoints for some reason and avoids leaving a hole open permanently.

xyst 2y ago
IMO - requires a ton of work. Adoption requires updating rules quite often
- haswell 2y ago
  Sounds like that varies widely by person/use case. I’ve been using this software for a couple years at this point. I don’t have to update rules all that often (usually a few rules/week), and when I do, it’s usually a 10-30 second detour. The only time it takes more work is if I don’t know why something is trying to connect. But that’s exactly the scenario I’m targeting, i.e. calling attention to the weird looking connections. My use cases are general productivity, development on side projects and a variety of software experiments, gaming, and some local AI stuff. I also don’t see this as a ton of work. Rules are 99% pre-configured for you and all you have to do is choose the scope and duration of the rule and whether to reject or allow. I’ll admit it’s annoying once in awhile if there’s a major update to software that spawns a bunch of new rules, but once I get past the feeling of being annoyed, it’s really an extremely simple and quick process. Really have to emphasize the habit creation part. After I stuck with it for a few weeks, it became second nature and I stopped getting annoyed for the most part. I consider this a worthwhile habit to build if you’re trying lots of code/libraries and want to know what’s phoning where.
  - BadBadJellyBean 2y ago
    A few rules per week sounds like a lot. I think I am not paranoid enough to micromanage my connections like this.
    - haswell 2y ago
      In terms of time spent, that amounts to about one minute per week for me right now. Sometimes less. The user experience is streamlined, and adding rules involves responding to a dialog that automatically pops up when a connection is attempted. UX is key here and this would be a very different story if you had to go into a separate rule management interface every time. Regarding paranoia, I don’t see it that way. Supply chain attacks are alive and well, and if you’re running other people’s code on a regular basis, this is a low cost precautionary measure. I totally recognize that not everyone has the same risk profile or tolerance.
    - cam_l 2y ago
      I have found it makes me less paranoid, which is good. In using it for a while, I have only found a few pieces of software trying to access places I don't expect and don't approve of (quite a few more that I do expect, but don't approve of). And none of them seemed to be actively malicious, just misbehaved or poorly configured.
    - mnahkies 2y ago
      Generally I don't get many prompts day to day, if I do it's because something has changed or I'm using a new application and I find it comforting to know what's going on. You can make rules based on host, process arguments, etc so it's pretty flexible for allowing stuff you consider safe and staying out the way. Long ago I used zonealarm on windows and it's a pretty similar ux to that. I still use firejail or docker for anything that might be sketchy, but it's been super interesting seeing what trusted applications are doing. For example I was a bit shocked that the gnome calculator app was making network requests but it turned out it was for currency exchange rates.
  - dotancohen 2y ago
    > I don’t have to update rules all that often (usually a few rules/week) I think that we have different definitions of "all that often". Even twice a week would be too often for me.

xyst 2y ago

IMO - requires a ton of work. Adoption requires updating rules quite often

haswell 2y ago
Sounds like that varies widely by person/use case. I’ve been using this software for a couple years at this point. I don’t have to update rules all that often (usually a few rules/week), and when I do, it’s usually a 10-30 second detour. The only time it takes more work is if I don’t know why something is trying to connect. But that’s exactly the scenario I’m targeting, i.e. calling attention to the weird looking connections. My use cases are general productivity, development on side projects and a variety of software experiments, gaming, and some local AI stuff. I also don’t see this as a ton of work. Rules are 99% pre-configured for you and all you have to do is choose the scope and duration of the rule and whether to reject or allow. I’ll admit it’s annoying once in awhile if there’s a major update to software that spawns a bunch of new rules, but once I get past the feeling of being annoyed, it’s really an extremely simple and quick process. Really have to emphasize the habit creation part. After I stuck with it for a few weeks, it became second nature and I stopped getting annoyed for the most part. I consider this a worthwhile habit to build if you’re trying lots of code/libraries and want to know what’s phoning where.
- BadBadJellyBean 2y ago
  A few rules per week sounds like a lot. I think I am not paranoid enough to micromanage my connections like this.
  - haswell 2y ago
    In terms of time spent, that amounts to about one minute per week for me right now. Sometimes less. The user experience is streamlined, and adding rules involves responding to a dialog that automatically pops up when a connection is attempted. UX is key here and this would be a very different story if you had to go into a separate rule management interface every time. Regarding paranoia, I don’t see it that way. Supply chain attacks are alive and well, and if you’re running other people’s code on a regular basis, this is a low cost precautionary measure. I totally recognize that not everyone has the same risk profile or tolerance.
  - cam_l 2y ago
    I have found it makes me less paranoid, which is good. In using it for a while, I have only found a few pieces of software trying to access places I don't expect and don't approve of (quite a few more that I do expect, but don't approve of). And none of them seemed to be actively malicious, just misbehaved or poorly configured.
  - mnahkies 2y ago
    Generally I don't get many prompts day to day, if I do it's because something has changed or I'm using a new application and I find it comforting to know what's going on. You can make rules based on host, process arguments, etc so it's pretty flexible for allowing stuff you consider safe and staying out the way. Long ago I used zonealarm on windows and it's a pretty similar ux to that. I still use firejail or docker for anything that might be sketchy, but it's been super interesting seeing what trusted applications are doing. For example I was a bit shocked that the gnome calculator app was making network requests but it turned out it was for currency exchange rates.
- dotancohen 2y ago
  > I don’t have to update rules all that often (usually a few rules/week) I think that we have different definitions of "all that often". Even twice a week would be too often for me.