3 ms·

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation s

by gmzamz 6mo ago

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

lapcat 6mo ago
> Said motivation could be a nation state handing them $XXX million dollars You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.
- wafflemaker 6mo ago
  >why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? Per user hacked, it can be very cheap¹ compared to bribing anyone. And give data/access that SO can't get. State is not interested in you until it does. Being Jewish, Polish, Gypsy, Gay. Or just WrongThinking. Or maybe it becomes super cheap and easy to process all information? 1: it can even be free. You either give us backdoor to all your users or you rot in jail. Here's a complementary beating up or pictures of your kids, to argument our position further.
  - selcuka 6mo ago
    > it can even be free. You either give us backdoor to all your users or you rot in jail. It is already a thing, at least in UK and AU [1]: > Both countries now claim the right to secretly compel tech companies and individual technologists, including network administrators, sysadmins, and open source developers – to re-engineer software and hardware under their control, so that it can be used to spy on their users. Engineers can be penalized for refusing to comply with fines and prison; in Australia, even counseling a technologist to oppose these orders is a crime. [1] https://www.eff.org/deeplinks/2018/12/new-fight-online-privacy-and-security-australia-falls-what-happens-next https://www.eff.org/deeplinks/2018/12/new-fight-online-priva...
    - lapcat 6mo ago
      1) Little Snitch is not based in the UK or Australia. 2) They are interested in software will billions of users. They are not interested in software with thousands of users.
  - lapcat 6mo ago
    > Per user hacked, it can be very cheap¹ compared to bribing anyone. How many users do you think Little Snitch has?
- chabreck 6mo ago
  its been known for some time that little snitch and other personal firewalls are established targets of three-letter agencies https://news.ycombinator.com/item?id=13813160 https://news.ycombinator.com/item?id=13813160
  - lapcat 6mo ago
    That comment is a screenshot presented with no context, listing a bunch of rather mundane stuff. "This is clownish" https://news.ycombinator.com/item?id=13813828 https://news.ycombinator.com/item?id=13813828
parhamn 6mo ago
Or even sell the whole org for say $50M and no one ever mentions anything. I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.
- lapcat 6mo ago
  > I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too. No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.
  - scheme271 6mo ago
    Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M.
    - deleted 6mo ago
      [deleted]
    - lapcat 6mo ago
      > Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. Little Snitch is not a working exploit for iPhone or Android. > I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M. No, sorry, this is absurd. A ton of products have a high population of devs, admins, etc. These are not getting acquired by intelligence agencies. Give me one example. There's nothing inherently valuable about this population. Who is a Little Snitch customer worth 50M to attack? Name them.
  - latexr 6mo ago
    Depends on the target and what you can get. Think about Bartender, an app requiring an insanely high level of trust and permissions, which was quietly sold. If you know of someone specific you want to target who uses it, the investment could pay off. For example, we know from your blog posts that you use LittleSnitch. Someone who wanted to target you might do a lot to spy on you by buying LittleSnitch, probably. Think of your own apps, too. I don’t think you’d do the same that Ben Surtees did and sell everything in secret, but then again I don’t personally know you. You may have a price that I’m not aware of. For that reason alone, even as I trust the current code is not nefarious, I can never give StopTheMadness access to every website and can only use it selectively, which is inconvenient.
umpalumpaaa 6mo ago
That’s what i meant. Thanks for reading my mind. :)

by gmzamz 6mo ago

Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars

lapcat 6mo ago

> Said motivation could be a nation state handing them $XXX million dollars You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.

wafflemaker 6mo ago
>why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? Per user hacked, it can be very cheap¹ compared to bribing anyone. And give data/access that SO can't get. State is not interested in you until it does. Being Jewish, Polish, Gypsy, Gay. Or just WrongThinking. Or maybe it becomes super cheap and easy to process all information? 1: it can even be free. You either give us backdoor to all your users or you rot in jail. Here's a complementary beating up or pictures of your kids, to argument our position further.
- selcuka 6mo ago
  > it can even be free. You either give us backdoor to all your users or you rot in jail. It is already a thing, at least in UK and AU [1]: > Both countries now claim the right to secretly compel tech companies and individual technologists, including network administrators, sysadmins, and open source developers – to re-engineer software and hardware under their control, so that it can be used to spy on their users. Engineers can be penalized for refusing to comply with fines and prison; in Australia, even counseling a technologist to oppose these orders is a crime. [1] https://www.eff.org/deeplinks/2018/12/new-fight-online-privacy-and-security-australia-falls-what-happens-next https://www.eff.org/deeplinks/2018/12/new-fight-online-priva...
  - lapcat 6mo ago
    1) Little Snitch is not based in the UK or Australia. 2) They are interested in software will billions of users. They are not interested in software with thousands of users.
- lapcat 6mo ago
  > Per user hacked, it can be very cheap¹ compared to bribing anyone. How many users do you think Little Snitch has?
chabreck 6mo ago
its been known for some time that little snitch and other personal firewalls are established targets of three-letter agencies https://news.ycombinator.com/item?id=13813160 https://news.ycombinator.com/item?id=13813160
- lapcat 6mo ago
  That comment is a screenshot presented with no context, listing a bunch of rather mundane stuff. "This is clownish" https://news.ycombinator.com/item?id=13813828 https://news.ycombinator.com/item?id=13813828

parhamn 6mo ago

Or even sell the whole org for say $50M and no one ever mentions anything. I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.

lapcat 6mo ago
> I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too. No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.
- scheme271 6mo ago
  Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M.
  - deleted 6mo ago
    [deleted]
  - lapcat 6mo ago
    > Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. Little Snitch is not a working exploit for iPhone or Android. > I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M. No, sorry, this is absurd. A ton of products have a high population of devs, admins, etc. These are not getting acquired by intelligence agencies. Give me one example. There's nothing inherently valuable about this population. Who is a Little Snitch customer worth 50M to attack? Name them.
- latexr 6mo ago
  Depends on the target and what you can get. Think about Bartender, an app requiring an insanely high level of trust and permissions, which was quietly sold. If you know of someone specific you want to target who uses it, the investment could pay off. For example, we know from your blog posts that you use LittleSnitch. Someone who wanted to target you might do a lot to spy on you by buying LittleSnitch, probably. Think of your own apps, too. I don’t think you’d do the same that Ben Surtees did and sell everything in secret, but then again I don’t personally know you. You may have a price that I’m not aware of. For that reason alone, even as I trust the current code is not nefarious, I can never give StopTheMadness access to every website and can only use it selectively, which is inconvenient.

umpalumpaaa 6mo ago

That’s what i meant. Thanks for reading my mind. :)