What is the purpose of an "application firewall" in an open source world?
If I have the source code and I am curious I just read it. I have yet to see any source code that attempted to obfuscate opening sockets.
Sometimes I run programs with ktrace (strace for Linux folks I guess) and look at the calls.
But truthfully in most cases controlling DNS catches most if not all of today's applications' attempts contact the mothership.
I do not use a third party cache, I maintain a custom root and can use it to block wildcarded domains, something that cannot be done with /etc/hosts. I do make extensive use of the HOSTS file but not for blocking.
I can also redirect traffic to localhost servers where I can log requests and analyze the captured packets. For instance if I want to reverse engineer the protocols used.
In my opinion an "application firewall" is a misnomer. IMHO a "firewall" operates on incoming packets from other computers, not packets originating from the computer running the firewall.
If a Windows user wants to run a "firewall" then IMO they need an additional computer, e.g., a gateway they control.
This is the way to stop the telemetry, IMHO.
I think Microsoft puts some application they call a "firewall" on Windows. IMHO that is misleading, but not surprising considering the source.
In an open source world, in the event a particular user does not "have the time" to read source code or even grep it for clues, chances are that some other user does have the time and compiles all his programs from source. It is always possible that an application's "phoning home" behaviour could be documented by such users in public forums, etc.
What if an application hard codes an IP address? Answer: I see it in the source code. NB: I very rarely see this in practice. Apparently few people can maintain a stable IP.