tiny-snitch

i use a kind of tui. it is actually a gui, pops up fullscreen. you can’t click it though, just keypress interaction. i agree with you. especially if i’m filtering all traffic, i need to be able to y/n quickly and easily. https://github.com/nathants/tinysnitch#demo

the issue is that libnetfilterqueue doesn’t have pid information, and so that must be looked up or joined to another data stream at runtime. this can fail. flakes at this point can be dangerous, and can reduce confidence in the system. they can also encourage you to add rules at both system and program level, which is annoying. one alternative is to specify rules at system level instead of program level. that’s the approach i ended up landing on[1]. i wish i had finer granularity, but i’m glad i don’t have flakes. it’s hard to imagine that monitoring network exfil isn’t THE best way to secure any system. at the least, it’s an important and necessary step. 1. https://github.com/nathants/tinysnitch

agr: like ag/ripgrep, but for search and replace. [1] set-opt: ensure settings in conf files in /etc. [2] s4: when i need to do distributed data processing and don’t want to import an apache project. [3] bsv: when i need maximum performance data processing. [4] tinysnitch: for monitoring network connections to/from my laptop. [5] new-gocljs: when i need to start a new fullstack web prototype. [6] cli-aws: when i need to work with aws from cli or go, and don’t want to import the cloudnative equivalent of an apache project. [7] aws-rce: when i need remote code execution on aws for great good. [8] 1. https://github.com/nathants/agr 2. https://github.com/nathants/bootstraps/blob/master/scripts/s... 3. https://github.com/nathants/s4 4. https://github.com/nathants/bsv 5. https://github.com/nathants/tinysnitch 6. https://github.com/nathants/new-

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3]. bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. bonus points if the filtering is at executable level granularity instead of system level. 1. https://www.obdev.at/products/littlesnitch/index.html 2. https://github.com/evilsocket/opensnitch 3. https://github.com/nathants/tinysnitch