tiny-snitch

another comment here rightly pointed out that what we want is to protect our files from being read by unrelated processes. there are no good implementations of this yet to my knowledge. encrypted fuse with snitch like rules and prompts is probably the play. any network snitch program would have caught this and prevented exfill. a prompt would have been displayed for a new connection to sketchy.io udp 53. from pytorch or some child process. most eyebrows would rise. many requests would be denied. on mac you have little snitch and at least one foss alternative. on linux you have opensnitch, or can roll your own on libnetfilter_queue[1] or lsm hooks[2]. hopefully soon somebody implements encrypted fuse snitch. until and even after then, wrap yourself in network snitch safety blankets and feel warm and cozy. 1. https://github.com/nathants/tin

i use a kind of tui. it is actually a gui, pops up fullscreen. you can’t click it though, just keypress interaction. i agree with you. especially if i’m filtering all traffic, i need to be able to y/n quickly and easily. https://github.com/nathants/tinysnitch#demo

the issue is that libnetfilterqueue doesn’t have pid information, and so that must be looked up or joined to another data stream at runtime. this can fail. flakes at this point can be dangerous, and can reduce confidence in the system. they can also encourage you to add rules at both system and program level, which is annoying. one alternative is to specify rules at system level instead of program level. that’s the approach i ended up landing on[1]. i wish i had finer granularity, but i’m glad i don’t have flakes. it’s hard to imagine that monitoring network exfil isn’t THE best way to secure any system. at the least, it’s an important and necessary step. 1. https://github.com/nathants/tinysnitch

agr: like ag/ripgrep, but for search and replace. [1] set-opt: ensure settings in conf files in /etc. [2] s4: when i need to do distributed data processing and don’t want to import an apache project. [3] bsv: when i need maximum performance data processing. [4] tinysnitch: for monitoring network connections to/from my laptop. [5] new-gocljs: when i need to start a new fullstack web prototype. [6] cli-aws: when i need to work with aws from cli or go, and don’t want to import the cloudnative equivalent of an apache project. [7] aws-rce: when i need remote code execution on aws for great good. [8] 1. https://github.com/nathants/agr 2. https://github.com/nathants/bootstraps/blob/master/scripts/s... 3. https://github.com/nathants/s4 4. https://github.com/nathants/bsv 5. https://github.com/nathants/tinysnitch 6. https://github.com/nathants/new-

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3]. bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. bonus points if the filtering is at executable level granularity instead of system level. 1. https://www.obdev.at/products/littlesnitch/index.html 2. https://github.com/evilsocket/opensnitch 3. https://github.com/nathants/tinysnitch

i often am annoyed with the generality and complexity of existing solutions, and seek something simpler. additionally, that which i cannot build, i do not understand. to summarize: building things, for fun and profit. agr: https://github.com/nathants/agr like ag or ack, but with the ability to replace matches or delete lines. tinysnitch: https://github.com/nathants/tinysnitch a minimal system firewall for inbound/outbound connections with visual prompts on connections without an existing rule. fails closed. cli-aws: https://github.com/nathants/cli-aws a cli for working with aws, particularly ec2 and lambda, that dramatically simplify operations. currently exploring a go port. bsv: https://github.com/nathants/bsv a binary data format and composable tools for maximum performance data processing. several tools have triplicate implementations

> There isn't even a single decent dynamic firewall with those annoying popups. even benign apps that phone home like pulumi and terraform are fun to see and block with annoying popups. monitoring egress really is the only realistic play. i rolled my own[1], inspired by opensnitch[2]. netfilter_queue is really great, and definitely makes annoying popup dynamic firewalls possible. 1. https://github.com/nathants/tinysnitch 2. https://github.com/evilsocket/opensnitch

i also built off the original opensnitch[1]. libnetfilterqueue is really great. i used bpftrace instead of ftrace to get the process metadata, but eventually removed it after frustration building bpftrace. currently it is a global inbound/outbound firewall with ui prompts. i’ve recently had success running archlinux packaged bpftrace in a privileged container, so will be adding process metadata back in soon. https://github.com/nathants/tinysnitch

did you try tinysnitch [0], opensnitch fork [1] or Douane [2]? [1] works pretty well for me. [0] https://github.com/nathants/tinysnitch [1] https://github.com/gustavo-iniguez-goya/opensnitch [2] https://github.com/Douane/Douane/

i wanted something a bit simpler, so forked and reduced. recently dropped path matching except for display in the visual prompt, simple global firewall, inbound and out. as others noted, path matching is quite janky. never saw a use of libnetfilterqueue before this, so hats off to evilsocket. https://github.com/nathants/tinysnitch