Hacker News Reader

Comment by munro | Hacker News Reader

Ooooo nice, I've been using Little Snitch for MacOS lately--it's been shocking how many things phone home, especially development tools. I installed Redhat's YAML extension for VS Code, and it was immediately trying to send a message home.

View on HN

Also there's OpenSnitch for Linux, available here:

https://github.com/evilsocket/opensnitch

I don't use it all the time but it is occasionally useful (or just satisfies my curiosity about what's phoning home)

Lulu - https://objective-see.com/products/lulu.html - is a great free alternative to Little Snitch.

Open source for good measure: https://github.com/objective-see/LuLu

i dont think lulu is an alternative, it is a rather small subset of features of what LS can do.

That's true - it may lack some advanced feature. But it's quite capable for the large majority of users. The only thing I don't like is that with newer macOS versions Lulu has dropped its own kernel extension in favour of macOS' built-in Network Extension framework that may have backdoor "bugs" built-in to allow Apple to spy on us (e.g. https://macresearch.org/mac-feature-bypass-firewalls-removed... ). I don't recall, but I think Little Snitch still uses it own custom kernel extension as macOS NEF doesn't still support all the features that LS offers.

> I installed Redhat's YAML extension for VS Code, and it was immediately trying to send a message home.

this frustrates me so much! i have not touched vs code, which is otherwise a decent editor, for a while because of all these shenanigans with the extensions.

Can't recommend Little Snitch enough, been using it for 7-8 years now. Extremely useful to prevent any unencrypted connections on wifi you don't trust (which I also used to prevent unencrypted connections when I'm in countries with internet censorship) and for peace-of-mind that some random application won't try to exfil data.

Automatic switching between profiles based on connection type (wifi, different VPN servers, etc.) is cherry on the top.

Running LS is both amazing for what it does, and depressing for what you see.

As for the VSCode extension, do you have telemetry disabled in Code globally? The Red Hat extensions are supposed to respect that preference for any telemetry they send. If you're seeing otherwise, please file a bug if you can.

Yeah I did have it on before installing. I never inspected the actually message though, it could have been "just downloading schemas".

I already spent like like 5 hours discetting every message in Wireshark coming out of my computer a few months ago lmao. I setup TLS logging so I could look at encrypted traffic with SSLKEYLOGFILE.

iftop is a Linux command line tool to list network connections.

https://www.tecmint.com/iftop-linux-network-bandwidth-monito...

Of course it has no firewall.

On this topic, is there a way to disable network access per VS Code extension? The vast majority have no business accessing the internet.

Reply on news.ycombinator.com