6 ms·

Okay hear me out, I use little snitch for a while. Great product. Love finding out what phones where. I make every single request (except my browser, because I'

by parhamn 5mo ago

Okay hear me out, I use little snitch for a while. Great product. Love finding out what phones where. I make every single request (except my browser, because I'm fine with their sandbox) block until I approve. Recently I was wondering how you really have to trust something like little snitch given its a full kernel extension effectively able to MITM your whole network stack. So I went digging (and asked some agents to deep research), and I couldn't find much interesting about the company or its leadership at all. All a long way to say, anyone know anything about this company?

lapcat 5mo ago
> All a long way to say, anyone know anything about this company? Yes, they are indie Mac developers who have been in business for more than 20 years, and Little Snitch for Mac is beloved by many users for a long time.
- umpalumpaaa 5mo ago
  Everything has a price though… (I also use little snitch)
  - lapcat 5mo ago
    > Everything has a price though… What is that supposed to mean in this context?
    - gmzamz 5mo ago
      Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars
      - lapcat 5mo ago
        > Said motivation could be a nation state handing them $XXX million dollars You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.
        wafflemaker 5mo ago
        >why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? Per user hacked, it can be very cheap¹ compared to bribing anyone. And give data/access that SO can't get. State is not interested in you until it does. Being Jewish, Polish, Gypsy, Gay. Or just WrongThinking. Or maybe it becomes super cheap and easy to process all information? 1: it can even be free. You either give us backdoor to all your users or you rot in jail. Here's a complementary beating up or pictures of your kids, to argument our position further.
        selcuka 5mo ago
        > it can even be free. You either give us backdoor to all your users or you rot in jail. It is already a thing, at least in UK and AU [1]: > Both countries now claim the right to secretly compel tech companies and individual technologists, including network administrators, sysadmins, and open source developers – to re-engineer software and hardware under their control, so that it can be used to spy on their users. Engineers can be penalized for refusing to comply with fines and prison; in Australia, even counseling a technologist to oppose these orders is a crime. [1] https://www.eff.org/deeplinks/2018/12/new-fight-online-privacy-and-security-australia-falls-what-happens-next https://www.eff.org/deeplinks/2018/12/new-fight-online-priva...
        lapcat 5mo ago
        1) Little Snitch is not based in the UK or Australia. 2) They are interested in software will billions of users. They are not interested in software with thousands of users.
      - parhamn 5mo ago
        Or even sell the whole org for say $50M and no one ever mentions anything. I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.
        lapcat 5mo ago
        > I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too. No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.
        scheme271 5mo ago
        Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M.
        deleted 5mo ago
        [deleted]
        lapcat 5mo ago
        > Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. Little Snitch is not a working exploit for iPhone or Android. > I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M. No, sorry, this is absurd. A ton of products have a high population of devs, admins, etc. These are not getting acquired by intelligence agencies. Give me one example. There's nothing inherently valuable about this population. Who is a Little Snitch customer worth 50M to attack? Name them.
        latexr 5mo ago
        Depends on the target and what you can get. Think about Bartender, an app requiring an insanely high level of trust and permissions, which was quietly sold. If you know of someone specific you want to target who uses it, the investment could pay off. For example, we know from your blog posts that you use LittleSnitch. Someone who wanted to target you might do a lot to spy on you by buying LittleSnitch, probably. Think of your own apps, too. I don’t think you’d do the same that Ben Surtees did and sell everything in secret, but then again I don’t personally know you. You may have a price that I’m not aware of. For that reason alone, even as I trust the current code is not nefarious, I can never give StopTheMadness access to every website and can only use it selectively, which is inconvenient.
      - umpalumpaaa 5mo ago
        That’s what i meant. Thanks for reading my mind. :)
    - Leptonmaniac 5mo ago
      Well, that is obvious, is it not? It means They are interested in The Plan and have enough power that a vague comment is all you gonna get. Cannot have Them finding out that we are on to Them. Though of course, The Plan already accounts for that, so They already know and will do Something about it. Want facts? Wake up, do your Research!
ignoramous 5mo ago
disclaimer: I co-develop (FOSS) Little Snitch / Open Snitch inspired firewall but for Android > little snitch given its a full kernel extension On macOS, don't think Little Snitch needs kernel exclaves / extensions. Apple provides userspace ("Network Extension") APIs (however limited) for apps like Little Snitch to use (instead of pf). > effectively able to MITM your whole network stack "MITM" means something else, anywho... if network observability (not firewall) is the primary need, cross-platform (GUI) sniffers like Sniffnet exist: https://github.com/GyulyVGC/sniffnet https://github.com/GyulyVGC/sniffnet
littlesnitch 5mo ago
Disclaimer: I'm the developer of Little Snitch for Linux. Regarding MITM concerns: The eBPF component, which actually sees all the traffic, is Open Source (GPLv2). You can review it on Github and verify whether it sends any data to user space: https://github.com/obdev/littlesnitch-linux https://github.com/obdev/littlesnitch-linux But the trust issue is still real, the daemon has to run as root because it needs to watch for new mounts and keep a table of file system roots up-to-date, even after loading all the eBPF programs. As a root process, it can technically do whatever it wants. Unless you limit it with a kind of mandatory access control (SELinux or similar). This is the very first release and we will probably come up with a more restricted permission requirement in the future. For the moment, I try to catch up with bug reports. There seems to be more diversity in the Linux landscape than I had expected.
- hubabuba44 5mo ago
  I'm happy to see this on Linux and I really appreciate the open-sourcing of the eBPF component. I maintain rustnet, a passive network monitor in the same eBPF + libpcap space, so I ran into a lot of the same issues. Wanted to share what has been working for me on the privilege side, in case any of it is useful for v2. rustnet ships with setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' instead of setuid-root. During startup it loads the eBPF programs, opens the pcap handle, and then drops all three caps before touching any packet data. It clears the ambient set, sets PR_SET_NO_NEW_PRIVS, and applies a Landlock ruleset that restricts the filesystem to /proc plus configured log paths and blocks TCP bind/connect on 6.4+ kernels. Code is in src/network/platform/linux/sandbox/ if you want to have a look. On the "needs to watch mounts" point, totally fair that Little Snitch needs live mount visibility, but I think it is achievable without staying UID 0: - Watching for mount changes: poll() on /proc/self/mountinfo with POLLPRI wakes on every mount table change from a completely unprivileged process (this is what systemd and mount(8) use internally). Alternatively, an eBPF program on the mount/umount/move_mount tracepoints can be loaded at init and stream events via a ring buffer, with no continued cap cost after load. - Resolving an arbitrary PID to its binary across container mount namespaces: CAP_SYS_PTRACE is enough for that. The /proc/PID/root magic symlink does the namespace translation inline inside the kernel pathwalk, so open("/proc/12345/root/usr/bin/firefox", ...) opens the right file in the right container's view without ever calling setns(), which is what would otherwise need CAP_SYS_ADMIN (the new root).

by parhamn 5mo ago

lapcat 5mo ago

> All a long way to say, anyone know anything about this company? Yes, they are indie Mac developers who have been in business for more than 20 years, and Little Snitch for Mac is beloved by many users for a long time.

umpalumpaaa 5mo ago
Everything has a price though… (I also use little snitch)
- lapcat 5mo ago
  > Everything has a price though… What is that supposed to mean in this context?
  - gmzamz 5mo ago
    Given sufficient motivation the little snitch dev could essentially supply chain attack every user, or even specific users. Said motivation could be a nation state handing them $XXX million dollars
    - lapcat 5mo ago
      > Said motivation could be a nation state handing them $XXX million dollars You're missing the most important part of the motivation here: why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? A nation-state could pay $XXX million to your significant other to spy on you. But again, a nation-state doesn't give a damn about you.
      - wafflemaker 5mo ago
        >why in the world would a nation-state give a damn about Little Snitch, especially to the tune of $XXX million dollars? Per user hacked, it can be very cheap¹ compared to bribing anyone. And give data/access that SO can't get. State is not interested in you until it does. Being Jewish, Polish, Gypsy, Gay. Or just WrongThinking. Or maybe it becomes super cheap and easy to process all information? 1: it can even be free. You either give us backdoor to all your users or you rot in jail. Here's a complementary beating up or pictures of your kids, to argument our position further.
        selcuka 5mo ago
        > it can even be free. You either give us backdoor to all your users or you rot in jail. It is already a thing, at least in UK and AU [1]: > Both countries now claim the right to secretly compel tech companies and individual technologists, including network administrators, sysadmins, and open source developers – to re-engineer software and hardware under their control, so that it can be used to spy on their users. Engineers can be penalized for refusing to comply with fines and prison; in Australia, even counseling a technologist to oppose these orders is a crime. [1] https://www.eff.org/deeplinks/2018/12/new-fight-online-privacy-and-security-australia-falls-what-happens-next https://www.eff.org/deeplinks/2018/12/new-fight-online-priva...
        lapcat 5mo ago
        1) Little Snitch is not based in the UK or Australia. 2) They are interested in software will billions of users. They are not interested in software with thousands of users.
    - parhamn 5mo ago
      Or even sell the whole org for say $50M and no one ever mentions anything. I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too.
      - lapcat 5mo ago
        > I think the type of users it attracts (techies, crypto ppl, etc) makes it worth more too. No, this by itself doesn't make Little Snitch or any business worth $50M. You're dreaming. That's a crazy valuation.
        scheme271 5mo ago
        Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M.
        deleted 5mo ago
        [deleted]
        lapcat 5mo ago
        > Various intelligence agencies are willing to pay 2-3M for a working exploit for iphone or android. Little Snitch is not a working exploit for iPhone or Android. > I think that they would be fine with paying 50M for a userbase that has a high population of devs, admins, etc. Being able to backdoor someone like this in the right organization down the line is probably worth 50M. No, sorry, this is absurd. A ton of products have a high population of devs, admins, etc. These are not getting acquired by intelligence agencies. Give me one example. There's nothing inherently valuable about this population. Who is a Little Snitch customer worth 50M to attack? Name them.
        latexr 5mo ago
        Depends on the target and what you can get. Think about Bartender, an app requiring an insanely high level of trust and permissions, which was quietly sold. If you know of someone specific you want to target who uses it, the investment could pay off. For example, we know from your blog posts that you use LittleSnitch. Someone who wanted to target you might do a lot to spy on you by buying LittleSnitch, probably. Think of your own apps, too. I don’t think you’d do the same that Ben Surtees did and sell everything in secret, but then again I don’t personally know you. You may have a price that I’m not aware of. For that reason alone, even as I trust the current code is not nefarious, I can never give StopTheMadness access to every website and can only use it selectively, which is inconvenient.
    - umpalumpaaa 5mo ago
      That’s what i meant. Thanks for reading my mind. :)
  - Leptonmaniac 5mo ago
    Well, that is obvious, is it not? It means They are interested in The Plan and have enough power that a vague comment is all you gonna get. Cannot have Them finding out that we are on to Them. Though of course, The Plan already accounts for that, so They already know and will do Something about it. Want facts? Wake up, do your Research!

ignoramous 5mo ago

disclaimer: I co-develop (FOSS) Little Snitch / Open Snitch inspired firewall but for Android > little snitch given its a full kernel extension On macOS, don't think Little Snitch needs kernel exclaves / extensions. Apple provides userspace ("Network Extension") APIs (however limited) for apps like Little Snitch to use (instead of pf). > effectively able to MITM your whole network stack "MITM" means something else, anywho... if network observability (not firewall) is the primary need, cross-platform (GUI) sniffers like Sniffnet exist: https://github.com/GyulyVGC/sniffnet https://github.com/GyulyVGC/sniffnet

littlesnitch 5mo ago

Disclaimer: I'm the developer of Little Snitch for Linux. Regarding MITM concerns: The eBPF component, which actually sees all the traffic, is Open Source (GPLv2). You can review it on Github and verify whether it sends any data to user space: https://github.com/obdev/littlesnitch-linux https://github.com/obdev/littlesnitch-linux But the trust issue is still real, the daemon has to run as root because it needs to watch for new mounts and keep a table of file system roots up-to-date, even after loading all the eBPF programs. As a root process, it can technically do whatever it wants. Unless you limit it with a kind of mandatory access control (SELinux or similar). This is the very first release and we will probably come up with a more restricted permission requirement in the future. For the moment, I try to catch up with bug reports. There seems to be more diversity in the Linux landscape than I had expected.

hubabuba44 5mo ago
I'm happy to see this on Linux and I really appreciate the open-sourcing of the eBPF component. I maintain rustnet, a passive network monitor in the same eBPF + libpcap space, so I ran into a lot of the same issues. Wanted to share what has been working for me on the privilege side, in case any of it is useful for v2. rustnet ships with setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' instead of setuid-root. During startup it loads the eBPF programs, opens the pcap handle, and then drops all three caps before touching any packet data. It clears the ambient set, sets PR_SET_NO_NEW_PRIVS, and applies a Landlock ruleset that restricts the filesystem to /proc plus configured log paths and blocks TCP bind/connect on 6.4+ kernels. Code is in src/network/platform/linux/sandbox/ if you want to have a look. On the "needs to watch mounts" point, totally fair that Little Snitch needs live mount visibility, but I think it is achievable without staying UID 0: - Watching for mount changes: poll() on /proc/self/mountinfo with POLLPRI wakes on every mount table change from a completely unprivileged process (this is what systemd and mount(8) use internally). Alternatively, an eBPF program on the mount/umount/move_mount tracepoints can be loaded at init and stream events via a ring buffer, with no continued cap cost after load. - Resolving an arbitrary PID to its binary across container mount namespaces: CAP_SYS_PTRACE is enough for that. The /proc/PID/root magic symlink does the namespace translation inline inside the kernel pathwalk, so open("/proc/12345/root/usr/bin/firefox", ...) opens the right file in the right container's view without ever calling setns(), which is what would otherwise need CAP_SYS_ADMIN (the new root).