So Wireshark but with connection permission toggles... Why does anyone need this on Linux? You can already block domains you know are malicious in the hosts file or use a personalized DNS resolver for that. Or am I missing something?
- You can apply more flexible rules than just blocking specific hostnames -- for example, based on IP subnets, port numbers, or specific binary executables
- You can block connections even from programs that bypass the default system-wide DNS configuration
This doesn't sound like a common use case. You can already block connection on a specific port with all available firewall programs. And you can bubblewrap binaries from making internet connections.
> You can block connections even from programs that bypass the default system-wide DNS configuration
Other than browser's making use of DOH for DNS, I can't think of a common use case for this. Besides, why would I want to Wireshark my browser? Why not use uBlock to filter domains.
Doesn't seem obvious to me why one would go through all this trouble.
I can easily imagine such a program doing its own DNS lookups (or just using hardcoded IP addresses) to avoid detection, and this approach allows you to block it anyway.
Sure, you could do the same thing manually. But you might as well say "why does anyone need Visual Studio Code when we have sed and awk?"
There are better alternative routes you can take that do not involve a "MITM" for all your connections.
There’s no MITM involved. Just another hop (potentially with an interactive go/no decision.
Little snitch is effectively a MITM app for all connections on the system it is installed on.
Little Snitch is a gate. It either lets a specific connection through, or not; it does not modify it. It all happens on your own machine. You keep using that term, "MITM", I don't think it means what you think it means.
https://github.com/gustavo-iniguez-goya/opensnitch/issues/21
https://nullsweep.com/why-is-this-website-port-scanning-me/
https://user-images.githubusercontent.com/2742953/84960681-9...