Little Snitch: Network Monitor and Application Firewall for macOS

https://www.obdev.at/en/products/littlesnitch/index.html

by stefankuehnel • 2 years ago

188 108 2 years ago

obdev.at

talldayo• 2 years ago

Anyone using Linux can also try OpenSnitch, which is free to own: https://github.com/evilsocket/opensnitch

haunter• 2 years ago

Netguard if you want to use it on Android https://netguard.me/

dgares• 2 years ago

Another option for Linux (and Windows) is Portmaster. https://safing.io/

a-dub• 2 years ago

opensnitch is pretty good on a linux desktop, especially with its cool ebpf kernel interface.

mostly good for monitoring for malware though. doesn't replace good inbound firewall rules.

desro• 2 years ago

first application to get installed on every nuke and pave

triyambakam• 2 years ago

Never heard of "nuke and pave" before, nice idiom! https://en.wiktionary.org/wiki/nuke_and_pave

rconti• 2 years ago

It's by far the most common phrase I've heard used to wipe+reinstall a system in the past 20 years? 25 years? Not just the most popular colloquialism, the most popular phrase, period.

My experience is US/West Coast/Tech companies, for reference.

thustherust• 2 years ago

Probably because it is a leftover from the 1990s/2000s when you had to completely reinstall your os. That’s no longer necessary, as long as you’re not using windows.

simondanerd• 2 years ago

I've heard it said in relation to getting a new laptop with manufacturer cruft and using Dave's Boot And Nuke to do some cleanup: https://dban.org/

para_parolu2• 2 years ago

Little Snitch is one of the best pieces of software out there. It’s essential for every macOS user, works very well, and is a one-time payment. I truly hope it stays that way and doesn’t go down the same path as 1Password. I’m very grateful to the developers for creating such an excellent product. I wish more software were like this.

Hikikomori• 2 years ago

Whats wrong with 1password?

aosaigh• 2 years ago

I assume its switch to subscription payments

tiffanyh• 2 years ago

A few years ago, 1password became an electron app - and the Internet seemed to lose its mind when that happened.

sneak4• 2 years ago

It switched from being a product that you can buy, to a service to which you must subscribe in perpetuity.

AKA IAP subscription cancer

cynix• 2 years ago

and is a one-time payment

Well technically it's like a "subscription with indeterminate renewal cycle". Every few years they release a new major version and sometimes you have to pay to upgrade.

Of course you can choose to not upgrade... but then you don't get the new features, and it's unclear if the old version will support all newer macOS releases.

jen729w2• 2 years ago

Technically that's what we call "buying software".

danpalmer5• 2 years ago

It’s essential for every macOS user

Is it? I'm interested in hearing why. I've been using macOS for ~15 years, so very familiar with Little Snitch. I think I owned a version many years ago but haven't for a long time. I don't really see what I'd use it for. I don't run dodgy software, I don't want to partially break the software I do run by nit picking what connections it can make as that wouldn't improve my experience and would most likely cause issues. I also mostly trust Apple's anti-malware efforts to protect me from other software I don't want to run, but if I didn't I'd run better anti-malware software before a firewall.

SanjayMehta2• 2 years ago

The best feature is the map which shows the locations of all the connection attempts.

You can quickly spot anomalous connections to countries/servers, and locate the specific process doing this.

I found a daemon left over from an uninstalled app which was attempting to connect to its mother ship in China. Very strange.

ianmf• 2 years ago

I owned several versions of Little Snitch too. It started to be annoying when you had to approve each request, especially when running command-line scripts. Then I moved to run in silent-approval mode. At that point, there was no reason to have LS any longer, so I uninstalled it. Haven't used it in years now. But not to discredit LS, it is an amazing software when you need it.

noman-land• 2 years ago

Analytics is malware and Little Snitch allows me to put the ban hammer on desktop apps that send data to places I don't want them to.

amyames2• 2 years ago

I have grown weary of little snitch annoying me all the time but it was insightful about how much stuff Apple has me pinging by default: like yahoo.com for weather on boot just to name one.

This kind of angered me, I don’t want yahoo getting my ip anywhere I am in the world any time I turn on my computer. I think I found like 4-5 things that are baked into a clean Mac install these days that I took exception to and forbade.

Then Microsoft office and adobe are evil and constantly evading it and getting smacked down too.

aunty_helen• 2 years ago

I caught a python ml library phoning home to a chinese server on a project that my company was building. My developer had no idea it was happening but I caught it first run thanks to lil snitch. If deployed this would've been a security escape that would need to be disclosed at a govt level.

Also, Apple. Their junk phones home just about everything you do. 50+ services constantly pinging Cupertino.

callmeal• 2 years ago

I don't want to partially break the software I do run by nit picking what connections it can make as that wouldn't improve my experience and would most likely cause issues.

Partially breaking web pages by blocking all connections to ad servers does wonders for my experience.

gr3ml1n• 2 years ago

I don't run dodgy software

I was confident I didn't either, but Little Snitch has proven otherwise. The amount of 'instrumentation' in modern JS and Python libraries is insane.

sneak4• 2 years ago

The issues it causes are for nosy devs, not for the end user, generally speaking.

para_parolu2• 2 years ago

I did exaggerate a bit. Many users don’t care about where their connections are going and many users have only limited set of apps.

I wouldn’t mind like to correct myself and say “essential for me”. So many times I caught up software going to places where it should not go. On top of that I often do local development without containers (guilty) and any random npm package can be compromised any time.

jonpurdy• 2 years ago

This is the absolute top of my wish list for software on iOS (impossible with Apple’s draconian restrictions though).

dunham• 2 years ago

I'd expect that you could do something like this with the api that vpn software uses

Aurornis4• 2 years ago

and is a one-time payment

I feel like I’ve done many one-time payments to get the new version of Little Snitch through the years.

I’m not currently using it, but for a long time it was on my list of Mac apps that I feared having to pay to upgrade with every new macOS release.

haswell5• 2 years ago

Paying for an upgrade to a new major version seems entirely reasonable and is the model I strongly prefer vs. ongoing subscriptions.

drewbitt• 2 years ago

One time payment... per major version, and it may be required to pay again if you update your OS. Not as good sounding as 'one-time payment'...

dcreater3• 2 years ago

I have it installed on my main Mac. But honestly I don't use it/don't know if it's doing anything. Should I be doing something?

haswell5• 2 years ago

That probably depends on what you do with your computer.

If you regularly clone git repos and run code you didn’t write or run unsigned apps from untrusted developers, it’s probably a good idea to scrutinize the connections that code is making.

nox1012• 2 years ago

I own many more devices than just a Mac. I have an iPhone, Apple TV, Linux box, Windows PC, Nintendo Switch, Quest 2, Kindle. I'd prefer one piece of software that covers all of them over different software for each of them.

arresin• 2 years ago

This is unreasonable.

OutOfHere• 2 years ago

This is an application level firewall software. Applications are OS specific.

Aurornis4• 2 years ago

Little Snitch and similar programs let you manage connections per application.

You can’t do that outside of the device.

SebFender2• 2 years ago

DNS filter is then your friend.

runjake• 2 years ago

It's not a one-time payment. You pay for the current major version. You generally have to pay for the next major version.

In many cases, when a new macOS comes out, you must pay for the next major version if you want to continue running Little Snitch.

Not a gripe, just a clarification.

Nicety: If you buy a single user license, you can use it on multiple devices.

treetalker2• 2 years ago

For those looking for a good, free firewall for macOS, consider LuLu.

https://objective-see.org/products/lulu.html

0x2a• 2 years ago

Other (paid) alternatives: Vallum, Radio Silence

- https://vallumfirewall.com

- https://radiosilenceapp.com

blackeyeblitzar• 2 years ago

I feel like macOS has been going the direction of iOS, increasingly locking things down and pushing to a walled garden world. What’s the chance that the next major update or two make changes that prevent utilities from having the access they need to provide these power user capabilities?

threatofrain• 2 years ago

How would you compare these to little snitch?

Pesthuf• 2 years ago

Doesn't macOS also have a built in (but disabled by default) Firewall? Why does nobody use that?

lapcat• 2 years ago

The built-in firewall is only for incoming connections, not outgoing connections.

Aaron2222• 2 years ago

It only handles inbound connections.

kccqzy• 2 years ago

There are actually two default firewalls. The firewall that's configurable in UI can only block inbound connections but not outbound connections. The other firewall (pf) doesn't have the concept of application so one cannot allow one app to access a remote IP but block another, and I also don't think it supports DNS.

treetalker2• 2 years ago

As others have indicated, LuLu (like Little Snitch) notifies you when your machine is initiating an outbound connection and lets you grant or deny permission, and to set up a persistent rule for that app/connection.

redrix• 2 years ago

Firewalls and endpoint security are important, and Little Snitch is pretty good, but this feels like an ad being posted.

It’s just a link to the main page of their website: nothing specific to warrant discussion.

dcreater3• 2 years ago

And it's a very old and well known software..

stogot• 2 years ago

I used it years ago but did not know they added all these features. I enjoyed seeing this post here

whycome• 2 years ago

It’s an HN “read the room” submission. It’s contextually related to earlier discussion about Apple Photos phoning home without a direct reference to it.

acomjean• 2 years ago

My understanding is that there were some issues with Apple often not allowing its own traffic to be filtered via firewalls on its systems.

See discussion:

https://news.ycombinator.com/item?id=25109724

https://news.ycombinator.com/item?id=37500237

If you want to monitor your own network I’ve heard good things about the pi-hole project

https://pi-hole.net/blog/2017/02/22/what-really-happens-on-y...

m463• 2 years ago

If little snitch worked on ios...

I'm pretty sure the only reason it works on macos at all was that it got in early. I believe Apple periodically tries to hobble it but there is pushback.

marcus0x62• 2 years ago

See also: Patrick Wardle's excellent (and free) Lulu firewall: https://objective-see.org/products/lulu.html. He has a bunch of other excellent macOS security tools:

Rei Key - identify keyloggers: https://objective-see.org/products/reikey.html

Block Block - get an alert before an auto-start program gets registered: https://objective-see.org/products/blockblock.html

Oversight - identify when the mic or camera is active on your mac - https://objective-see.org/products/oversight.html

Ransomwhere - detect and block ransomware: https://objective-see.org/products/ransomwhere.html

bromuk• 2 years ago

What’s the windows equivalent?

gnabgib• 2 years ago

[SimpleWall](https://github.com/henrypp/simplewall)

ChrisMarshallNY2• 2 years ago

I remember installing it on my work machine, and our IT Crowd demanded that I remove it.

They didn’t like that it exposed all their sneakware.

lxgr2• 2 years ago

Arguably you’re the one installing sneakware on your employer’s machine.

Work machines and personal software/data and vice versa don’t mix well in many jobs.

ChrisMarshallNY2• 2 years ago

This is true.

I didn’t argue with them, but kept using it on my personal kit.

I think it’s less useful, these days, as Apple is really battening down their I/O hatches. I know that Charles Proxy can miss stuff.

patrickhogan1• 2 years ago

This is a great product!

unit149• 2 years ago

This kind of work, collecting meta-data, mediating queries, altering a relational database processing language, on a DNS server through a Matching Code ID on Little Snitch is freakishly effective at times.

pentagrama• 2 years ago

For Windows I remember using the open source Portmaster for this, but noticed some apps and the OS lagging a bit on startup.

interlock• 2 years ago

I’ve been using Little Snitch for ages. It been my go to on all my all new systems and they offer discounts on upgrades to new versions. Their support has been excellent the one time I needed it.

triilman• 2 years ago

same functionality but without fancy graphic and map interface https://sniffnet.net/

eviks• 2 years ago

How is this the same if it says it doesn't support process id?

Can it ask you on new connection by a specific app whether to allow it like little snitch does?

Jiahang• 2 years ago

Is there a similar solution that can run on openwrt

grahamj• 2 years ago

LS is excellent but if I'm going to go to the trouble of building firewall rules I'd rather them be at the network level so all my devices can benefit.

What would be really cool is the LS UI but tied into something like pfsense for the actual filtering.

anonzzzies• 2 years ago

Little snitch is great; I give it as a bd present to people.

pronouncedjerry• 2 years ago

How’s it compare to Objective See’s LuLu OSS https://github.com/objective-see/LuLu ?

pmkary• 2 years ago

I have had it for years, and every once in a while, there's a red light flashing in my menubar, making me smile as one more tracker goes empty-handed today.

SebFender2• 2 years ago

Little Snitch + DNS filter = greatness.

1vuio0pswjnm7• 2 years ago

But where is Little Snitch for iOS. At least Android has NetGuard.

Firewalling applications is relatively easy on a general purpose computer. Where it becomes excessivelky difficult is on a so-called "smartphone".

https://www.obdev.at/support/littlesnitch/bm3q8

"Will Little Snitch be available for iOS, tvOS and watchOS?

Unfortunately Apple's regulations and submission guidelines do not allow applications like Little Snitch that operate on the system level on the iOS (iPhone, iPad, iPod touch), tvOS (Apple TV), or watchOS (Apple Watch) platforms."

It appears Apple's "regulations" prohibit owner control and increased transparency. No such thing as an option for "experts only" when it comes to Apple computer owners; one size fits all. Apple are the only experts and the only ones entitled to control and transparency, over and into _other peoples'_ computers. Remarkable.

lucasazevedo• 2 years ago

I love this product! It is a must-have app on macOS! pro: you can literally control all Application Networks on your computer (sometimes it is funny to see completely off-line apps that don't need to collect any data trying to sync a bunch of stuff). cons: it can be annoying when you install new apps and running it on with most secure options.

Little Snitch: Network Monitor and Application Firewall for macOS

Related Stories