macOS underlying system is really opaque, is Little Snitch really do block all that there is ?
macOS 11 stopped support for kernel extensions, and now requires firewall apps like Little Snitch to use "Network Extensions".
In early versions of macOS 11, some Apple apps bypassed network extensions. This was supposedly fixed in macOS 11.2, but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions.
Why not? It's not like it'd be hard to know. The submission article even talks about running it in a VM, wouldn't be hard to connect tcpdump to whatever bridge it's using and inspect if Little Snitch can truly capture and block all traffic.
If you look for leaks, and don't find any, it doesn't mean there aren't any.
Sure there is: you connect the system to a managed Ethernet switch and do port mirroring to inspect what traffic goes over the wire:
* https://community.fs.com/blog/port-mirroring-explained-basis...
* https://www.cisco.com/c/en/us/support/docs/switches/catalyst...
* https://en.wikipedia.org/wiki/Port_mirroring
If it's encrypted we may not know the exact contents, but you can't conceal IPs.
Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with
Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.
For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?