Do not forget opensnitch https://github.com/evilsocket/opensnitch for Linux.
Fist program to be installed.
If you never used, you don't know what is "going" on the pc.
In Little Snitch Shows Who Your Mac Talks Toevilsocket
opensnitch
Python2017–2026
evilsocket / opensnitch
opensnitch
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
84Distinct people
101Mentions
0Explicit recommenders
14.3KGitHub stars
What to know before exploring
What it is
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- gustavo-iniguez-goya/opensnitch · linked in 2 of the same discussions
- henrypp/simplewall · linked in 2 of the same discussions
- nathants/tiny-snitch · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year101 dated mentions
Observed mentions: 2017-04-17 16:24:07 UTC to 2026-10-30 19:13:07 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 8 | 4 | 4 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 16 | 1 | 15 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 18 | 1 | 17 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 12 | 1 | 11 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Join the project community on our server!
OpenSnitch is a GNU/Linux application firewall.
•• Key Features • Download • Installation • Usage examples • In the press ••
Key features
Interactive outbound connections filtering.
Block ads, trackers or malware domains system wide.
Ability to configure system firewall from the GUI (nftables).
Configure input policy, allow inbound services, etc.
Manage multiple nodes from a centralized GUI.
SIEM integration
Download
Download deb/rpm packages for your system from https://github.com/evilsocket/opensnitch/releases
Installation
deb
$ sudo apt install ./opensnitch*.deb ./python3-opensnitch-ui*.deb
rpm
$ sudo dnf install opensnitch*.rpm
Then run: $ opensnitch-ui or launch the GUI from the Applications menu.
Please, refer to the documentation for detailed information.
OpenSnitch in action
Examples of OpenSnitch intercepting unexpected connections:
https://github.com/evilsocket/opensnitch/discussions/categories/show-and-tell
Have you seen a connection you didn't expect? submit it!
In the press
2017 PenTest Magazine
11/2019 It's Foss
03/2020 Linux Format #232
08/2020 Linux Magazine Polska #194
08/2021 Linux Format #280
02/2022 Linux User
06/2022 Linux Magazine #259
Donations
If you find OpenSnitch useful and want to donate to the dedicated developers, you can do it from the Sponsor this project section on the right side of this repository.
You can see here who are the current maintainers of OpenSnitch:
https://github.com/evilsocket/opensnitch/commits/master
Contributors
See the list
Translating
Read the full README on GitHubWhat Hacker News says
101 sourcesTelemetry is anything including a process list. If you're talking about eBPF it's also used for debugging and server fleets and recently in basic task managers. Any data can be used to take a magnifying glass to the system. The kernel has literally thousands of toggles for this from networking to threading. And yes a program can see what your kernel supports and yes it can refuse to run if you're not running a specific kernel with a specific feature. How do you think programs like open snitch even work?
https://github.com/evilsocket/opensnitch/wiki/monitor-method...
In LG monitors silently install software through Windows Update without consentI'm aware, and I'm choosing GOG when I can now, though even then I see phoning home (or attempts to) happening (opensnitch is useful for that https://github.com/evilsocket/opensnitch) - I've paid for some titles 2-3x over which is frustrating, admittedly I don't have the physical media from the first time which is on me, but it's frustrating seeing single player games wanting to phone home
In The case for physical media ownershipA year ago a similar attack was reported and I think that there have been similar campaigns reported this year: https://github.com/evilsocket/opensnitch/discussions/1290#di...
- This is a new repository, not a fork
- All repositories have different contributors and different names
From the last two points, it becomes clear that even if we find one such repository, we won’t be able to find other similar repositories using it.
In previous campaigns the repositories were linked to a few users. But those users had starred other users, that at the same time had also cloned other repositories with the malware. Sometimes the malicious repository had been cloned from another malicious repo, and if you listed the repositories and "friends" of that user, all were part of the botnet.
Also, github doesn't delete repositories and accounts, they
Read the rest
mark them as deleted. If you use their api you can still list them.
Some posix like systems mount /home with noexec in fstab.
Practically, most systems leave it off because many out-of-band user space script language package ecosystems stop working. =3
There are also adaptive application firewalls that are user friendly.
https://github.com/evilsocket/opensnitch
In A backdoor in a LinkedIn job offerthe pop-ups fatigue is already an issue, and not an easy one to solve. Pretty much like SIEM/SOC alerts.
> The trick is to infect a plugin that has a legitimate reason for accessing the internet or running certain commands, and then coming up with ways to abuse that to exfiltrate the data. Or exfiltrating via DNS queries, or some other vector that isn't so obvious as "allow TCP/UDP connections to the whole world".
They'll get there, maybe. But the reality is that right now, everyone allows outbound requests blindly.
Instead of speculating, I suggest to actually investigate current IOCs and common tactics of malicious npm/pip/plugins/VS extensions. Something like this:
https://github.com/evilsocket/opensnitch/discussions/1119
Or use OpenSnitch (or Lulu, Glasswire, ZoneAlarm anyone?:D etc) to actually analyze real VS malicious extensions or
Read the rest
npm packages and see if it stops the exfiltration, and if not, suggest ways to improve it. For example:
https://markdownpastebin.com/?id=9c294c75f09349d2977a4ccd250...
absolutely. These attacks will evolve for sure, like the malware evolved on Microslop for years.
But for the time being, the common entry vector is clear:
https://github.com/evilsocket/opensnitch/discussions/1119
> 2) trigger a tab open to attacker's website
be sure not to use extra cli parameters like "firefox --new-tab <url>", because if the rule is filtering by process path + cmdline it'll trigger a pop-up to allow the outbound request.
In Mini Shai-Hulud Strikes Again: 314 npm Packages CompromisedThere's https://github.com/obdev/littlesnitch-linux, and https://github.com/evilsocket/opensnitch and probably many others.
In Little Snitch comes to Linux, but the core logic is closed sourceYou mean “how can I donate?”
https://github.com/evilsocket/opensnitch?tab=readme-ov-file#...
In LittleSnitch for Linux>The daemon (littlesnitch --daemon) is proprietary, but free to use and redistribute.
Worth noting that it is closed source. Would be worth contributing patches to OpenSnitch to bring it up to parity with Little Snitch.
https://github.com/evilsocket/opensnitch
In LittleSnitch for LinuxHow does it compare to opensnitch? https://github.com/evilsocket/opensnitch
In LittleSnitch for LinuxGnome calculator pings the International Monetary Fund website
16 points · Open discussion1. Linux → https://github.com/evilsocket/opensnitch
2. Windows → https://www.glasswire.com/
3. Windows (open source) → https://github.com/henrypp/simplewall
4. Windows → https://safing.io/
In Snitch – A friendlier ss/netstatit sounds like you want https://github.com/evilsocket/opensnitch
In Show HN: Network Monitor – a GUI to spot anomalous connections on your LinuxShow HN: I made a Rust Terminal UI for OpenSnitch, a Linux application firewall
I made a Terminal UI for OpenSnitch[1], an interactive application firewall for Linux inspired by Little Snitch. I’ve always wanted to create a TUI and found the perfect excuse to make this for usage on one of my headless servers.
I wrote this in Rust to force myself to learn more, viz. async features. Super open to feedback and contributions!
[1] https://github.com/evilsocket/opensnitch
6 points · Open discussionShowing the 15 most recent of 101 sources. Enable JavaScript to search and browse every indexed mention.