Hacker News Reader

Comment by sneak | Hacker News Reader

I do the same thing basically on bare metal: with Little Snitch I have blocked almost all system processes from accessing the network at all.

macOS still works fine. (You have to widen the permissions a bit for OCSP and the TSS api when doing OS updates, however.)

View on HN

I’m currently on the fence about buying Little Snitch. I tried the trial for a week and interestingly there were no outboard connections I did not expect so ended up allowing basically everything. I run a limited set of applications and that hasn’t changed in a number of years.

Obviously I feel quite happy that I’ve not found I’ve been allowing connections I didn’t want to but it also makes me feel perhaps I am being a little over the top by adding Little Snitch into the mix.

I went in thinking it would catch dozens of secret connections but nothing. So part of me feels it is over kill and a time waster for myself. Anyone care to explain how wrong I am? I would be grateful to be corrected and happy to buy if I can be convinced it is indeed worth while :)

To me it's more about personal control than surprises. It doesn't surprise me that Apple software is phoning home; I just want to stop it and control which connections and data I allow to leave my Mac.

Do you find LS causes any kind of network speed impact when dealing with systems that have hundreds or thousands of connections? I often have Transmission open downloading and as I have a 2.5gbps connection it can easily hit several hundred in and out connections when bandwidth hits >2gbps. I’m wondering if LS either slows that down or causes additional power use/heat?

> Do you find LS causes any kind of network speed impact when dealing with systems that have hundreds or thousands of connections?

Not that I'm aware of. Only my main Mac has Little Snitch installed, but as a developer I have other Macs and iOS devices for testing that don't have Little Snitch, and I've never noticed any difference in speed.

Thanks. I think I will reset the trial and stress test it a bit with and without LS installed to gauge for myself then. Shouldn’t take long to notice an impact. If all is good I guess I might pick it up to run with for a year and see how it goes. If it makes no performance difference and doesn’t introduce any other issues I don’t see any reason to not err on the side of paranoia :)

You're like the guy who says "I'm never sick, why am I being forced into paying health insurance".

I do not understand what point you’re trying to make?

Because Little Snitch is the tool that will help you from getting surprised in the future by something you don't have now. Sure, you might be surprise free in your outbound traffic now, but what happens 6 months from now when you suddenly are hit with something from a new download or some other method of infection? Little Snitch will block it from the first attempt and bring it to your attention. Without it, it'll just happily do it's little tasks until the next time you think about auditing with a reset trial version of Little Snitch.

Just like you don't need health insurance until you do, then it's too late if you don't have it. The comparison seems obvious enough

Ah yes thanks for clarifying. As I've never lived where I've needed health insurance I didn't connect the dots that way.

It whitelists all of the Apple privacy-invading phone home nonsense by default. You have to disable those rules to see the dozens of alerts from different OS processes phoning home to Apple (even if you don't use iCloud or iMessage or FaceTime or the App Store or any other service at all).

macOS underlying system is really opaque, is Little Snitch really do block all that there is ?

Probably, but we don't know.

macOS 11 stopped support for kernel extensions, and now requires firewall apps like Little Snitch to use "Network Extensions".

In early versions of macOS 11, some Apple apps bypassed network extensions. This was supposedly fixed in macOS 11.2, but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions.

> Probably, but we don't know.

Why not? It's not like it'd be hard to know. The submission article even talks about running it in a VM, wouldn't be hard to connect tcpdump to whatever bridge it's using and inspect if Little Snitch can truly capture and block all traffic.

Because you don't know what conditions would trigger a circumvention of the network extension. There might be a zero-day somewhere in macOS that allows a malicious app to circumvent network extensions.

If you look for leaks, and don't find any, it doesn't mean there aren't any.

> […] but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions.

Sure there is: you connect the system to a managed Ethernet switch and do port mirroring to inspect what traffic goes over the wire:

* https://community.fs.com/blog/port-mirroring-explained-basis...

* https://www.cisco.com/c/en/us/support/docs/switches/catalyst...

* https://en.wikipedia.org/wiki/Port_mirroring

If it's encrypted we may not know the exact contents, but you can't conceal IPs.

Not everyone can afford a managed switch and a second computer to inspect the traffic with.

Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with

> Not everyone can afford a managed switch and a second computer to inspect the traffic with.

Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.

It’s not magic, the packets have to comply with IP standards if they’re going to work on an IP network. Below that, the frames have to comply with Ethernet if you’re plugged into an Ethernet port. The traffic can’t hide.

> Not everyone can afford a...

For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?

While this would allow you to prove the presence of exceptions, it won't prove the absence of exceptions.

I think Little Snitch does a good job, but it would be easy to see any leaks at the router/hardware firewall if there's a real concern.

Reply on news.ycombinator.com