What does HackerNews think of opensnitch?

Oh, that is fair. I assume https://github.com/evilsocket/opensnitch doesn't work for you?

I have OpenSnitch[0] installed on Ubuntu, and when I launch the Calculator app it alerts me that Calculator tries to phone home to `imf.org` apparently for currency conversion purposes. I really don't want the International Monetary Fund in my calculator app.

[0] https://github.com/evilsocket/opensnitch

Little Snitch was a must have when I used a Mac. Open Snitch for Linux is still being maintained.

https://github.com/evilsocket/opensnitch

you can try opensnitch https://github.com/evilsocket/opensnitch

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is.

an exploit that cannot communicate is likely benign and easy to detect in the attempt.

monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security.

macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3].

bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering.

bonus points if the filtering is at executable level granularity instead of system level.

1. https://www.obdev.at/products/littlesnitch/index.html

2. https://github.com/evilsocket/opensnitch

3. https://github.com/nathants/tinysnitch

Some similarish things mentioned on the Debian privacy issues page:

https://github.com/evilsocket/opensnitch https://github.com/kushaldas/unoon https://github.com/nsntrace/nsntrace https://wiki.debian.org/PrivacyIssues#Detection_tools

I've seen a few Linux implementations of something like Little Snitch but I would not consider any of them production datacenter ready. A balanced approach might be to do something as simple as using the "owner" module in iptables to create rules saying what service accounts on your servers are permitted to talk outbound and to where and on what ports. This example does not limit by application but you can deploy your applications to use different service accounts accomplishing essentially the same thing.

Mail server example:

  iptables -I OUTPUT -o eth0 -m owner --uid-owner postfix -p tcp --syn --dport 25 -j ACCEPT

To answer your question, here is a desktop firewall for Linux that operates like Little Snitch [1] This is not meant to be used in your server deployments.

[1] - https://github.com/evilsocket/opensnitch

I want an in-and-out-app-specific firewall on linux and only then, I will be happy... something a lot like https://github.com/evilsocket/opensnitch/

This is cool, and lays the groundwork for per-directory, per-app access controls like on current macOS.

Is there a comparable thing for network access? Last I looked OpenSnitch seemed to be unmaintained, but looking just now it apparently has some commits on master recently again:

https://github.com/evilsocket/opensnitch

If you're interested in this, you may be interested in this as well: https://github.com/evilsocket/opensnitch

It has a GUI interface as well.

An alternative that does not come with a potentially machine-bricking kernel panic bug is Opensnitch [1], last updated 14 months ago with a change to "funding.yaml" asking for donations.

A fork seems to be relatively alive [2] and I use it personally -- it works well, but is a bit of a PITA to build. Time to buy the devs a coffee...

[1] https://github.com/evilsocket/opensnitch [2] https://github.com/gustavo-iniguez-goya/opensnitch

OpenSnitch looks promising. https://github.com/evilsocket/opensnitch

Tilix is very much like iTerm2. Simple to use too.

I run a newsletter[0] that has a section call "Code to read" for many language.

I tried to include small/interesting repos to do weird/cool things so people can learn about it. Eg, this code: https://github.com/evilsocket/opensnitch (UI in Python but the logic is Go)

---

[0]: https://betterdev.link

how about a 3-pronged approach:

  1) pi-hole
  2) steve blacks hosts file
  3) ublock origin


  3 = most conservative filtering configuration that can easily be tweaked from the browser
  2 = use modules (-e gambling -e porn etc)
  1 = most basic blocking configuration

this way you don't have to do much fidgeting on the router. this comes at a tradeoff for putting some of the burden on the hosts #2 & #3 but with the advantage of better usability for non-tech users.

protip: if you can live with not accessing unicode domains at all (counter measure to avoid domain squatters and some phishermen) patch[1] your dnsmasq and add this in dnsmasq.conf:

   address=/:xn--*:/0.0.0.0

[1] https://github.com/spacedingo/dnsmasq-regexp_2.76.git

EDIT: for mobile I used to have a VPS running openvpn. Make Android connect to the vpn by default routing all traffic through it. Run something like opensnitch[1] to MiTM and whitelist the mobile traffic and sinkhole shit you want to get rid off. This isn't for the fainthearted since new versions of apps might make different API calls and break your rules. Apps will just stop working. If you only have 2 or 3 apps and want to kill traffic from built-in carrier spyware it works nicely and is well worth the effort. Nice way to study what your device does. https://github.com/evilsocket/opensnitch

The author is not subtle in letting know that this is intended to be open source replacement for Little Snitch (domain!).

But at-least macOS has little snitch, closest for Linux was opensnitch which was announced on HN few months back - https://github.com/evilsocket/opensnitch/ but I'm not sure whether it's actively being developed though.