[HN Gopher] Little Snitch comes to Linux, but the core logic is ...
___________________________________________________________________
Little Snitch comes to Linux, but the core logic is closed source
Author : TheIPW
Score : 66 points
Date : 2026-04-09 16:36 UTC (6 hours ago)
(HTM) web link (the.unknown-universe.co.uk)
(TXT) w3m dump (the.unknown-universe.co.uk)
| roscas wrote:
| Glad you also talk about OpenSnitch. It is critical to have it
| installed.
|
| OpenSnitch and PiHole are simply a must on every network.
| benf76 wrote:
| Can you elaborate on ideal pairing?
| klueinc wrote:
| for folks on the mac, Lulu has been a great option too.
| https://github.com/objective-see/LuLu
| Barbing wrote:
| objective-see is carrying an immense weight for Mac users
|
| Security: BlockBlock, KnockKnock, RansomWhere...
|
| System/Productivity: TaskExplorer...
|
| Yes times 4
| braingravy wrote:
| They really are... and it's just one person too, right?
|
| They're doing the lord's work.
| mystraline wrote:
| What "lord" is that? A landlord?
|
| I'm not a feudalist, nor a techno-feudalist.
| lapcat wrote:
| See "Little Snitch for Linux"
| https://news.ycombinator.com/item?id=47697870
|
| Also:
|
| > Little Snitch is not there to replace OpenSnitch. It's just an
| additional option you can choose from. Some people might prefer
| it, others not.
|
| https://news.ycombinator.com/item?id=47701918
|
| > But I currently can't make the entire project Open Source. My
| other option would be to keep it completely private (wrote it
| mostly for myself in the first place).
|
| > I think it's still better to make it public and only partially
| Open Source so that some people can benefit from it. If you don't
| trust us, that's completely reasonable, just don't install it.
|
| https://news.ycombinator.com/item?id=47701740
| knowaveragejoe wrote:
| One nice thing about LittleSnitch on linux is that it comes with
| a web UI by default. Is there anything like that for headless
| systems using OpenSnitch?
| TheIPW wrote:
| I get the appeal; the Little Snitch UI is undeniably shiny. But
| for the headless Linux nodes in my Proxmox setup, I've never
| really felt the need for a proprietary dashboard just to see my
| network state. I'd much rather export my logs to something like
| Grafana or just check my AdGuard dashboard at the edge. It
| feels more "Linux" to keep the tools transparent and open than
| to invite a mystery binary onto my system just for the sake of
| a pretty graph.
| melon_tusk wrote:
| How anyone could trust OpenSnitch is beyond me.
| patrickdet wrote:
| Please elaborate
| kelsey98765431 wrote:
| last thing in the world i want is to install proprietary software
| on linux. even less so is something meant to be security software
| and interacting directly with my network stack.
| bornfreddy wrote:
| > ...my primary line of defence is AdGuard Home. By handling
| privacy at the DNS level...
|
| To each their own, I guess, but that would be a hard pass from
| me. One example from mobile: FF on android keeps trying to
| connect to its various services (like
| firefox.settings.services.mozilla.net). For privacy reasons, I
| use NetGuard to block this and other similar domains. But there
| is a gotcha: there are sites (like seekingalpha.com) who refuse
| to load if access to these same domains is blocked - even on a
| completely different browser! With NetGuard I can still visit
| those sites in the secondary browser while blocking Mozilla
| tracking. With DNS blocking I wouldn't be able to do that.
| TheIPW wrote:
| NetGuard is a solid tool for Android, but managing a whole home
| lab is a different beast. I've got dozens of VMs and containers
| tucked away in Proxmox; if I tried to micro-manage per-app
| permissions for every single one of them, I'd never get
| anything else done.
|
| I prefer to take the hit on those rare site-breaking edge cases
| if it means I have a single, transparent "source of truth" at
| the DNS level. It's definitely a trade-off, but I'd rather
| spend my time building things than perpetually tweaking
| firewall rules for every new service I spin up.
| senojsitruc wrote:
| I wrote GlowWorm ~20 years ago, duplicating much of the
| LittleSnitch functionality at the time.
|
| I remember discovering remote kernel debugging across ethernet;
| it was magical.
|
| https://glowworm.us
| guessmyname wrote:
| When I click on the "Download / Buy Now" link [1], Safari tries
| to download it instead of visiting the page. I tried with cURL
| and discovered that the page is returning a "content-type:
| application/octet-stream" header, which makes no sense because
| the page is just HTML. Also, I can see some portions of raw PHP
| code in the HTTP response, so I think your web server is not
| interpreting PHP as it is supposed to and instead returning the
| raw content from the PHP file.
|
| edit: In fact, every PHP file is being leaked, for example,
| this file [2] contains a $hash_salt , which is supposedly being
| used to _"prevent[s] users guessing filenames and make data
| more secure"_
|
| [1] https://glowworm.us/securimage/download.php
|
| [2] https://glowworm.us/securimage/securimage.php
| senojsitruc wrote:
| The website is preserved for historical reasons. Nothing
| there has been active in a long, long time.
| guessmyname wrote:
| I'm as paranoid as the next person but what's the purpose of this
| article?
|
| If you don't like closed source software and don't trust the
| developer(s), then don't use the software. Why waste time writing
| an article that all it does is critize the developer's decision?
|
| If you care so much about the software you run in your computer,
| then do what I do: open a disassembler and reverse engineer the
| code, inspect every single HTTP(S) call, every network packet,
| every system call, and then maybe you will feel at ease.
| TheIPW wrote:
| I write these things because transparency is kind of the point
| of the platform. Most people don't have the time or the
| interest to open up a disassemble every time they want to try a
| new tool, they just want to know if it fits the FOSS ethos they
| moved to Linux for.
|
| Pointing out that a "privacy" tool has a closed-source brain
| isn't an attack on the dev, it's just a heads-up for people who
| care about that sort of thing.
| nslsm wrote:
| If it is closed source then it does not fit the FOSS ethos.
| You don't have to disassemble it; you can just move on.
| GeekyBear wrote:
| The Linux Steam client is closed source.
|
| Should we refuse to use Steam?
| TheIPW wrote:
| There's a big difference between running a closed-source
| app to play games and trusting a closed-source app to
| protect your whole system.
| zahlman wrote:
| There's https://github.com/obdev/littlesnitch-linux, and
| https://github.com/evilsocket/opensnitch and probably many
| others.
___________________________________________________________________
(page generated 2026-04-09 23:01 UTC)