At least on macOS, there is a third way where you can control the network connection on the PID/binary level by setting up a network system extension and then s

At least on macOS, there is a third way where you can control the network connection on the PID/binary level by setting up a network system extension and then setting up a content filter so you can allow/deny requests. It is pretty trivial to set this up, but the real challenge is usually in how you want to express your rules. Little Snitch does this pretty well: https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html