Little Snitch and the deprecation of kernel extensions

[frankjr]

This is good news. Moving to the Network Extension framework means that Little Snitch's filtering will run entirely in user space, which is not only great for security but it will also allow the code to be written in a higher level language such as Swift.

[emmelaich]

> great for security

That depends doesn't it? You'll be safe from Little Snitch but Little Snitch will have less power to protect you.

[CameronNemo]

What if that has an impact on performance? Kernel-user space communication usually means copying data into different portions of memory, plus a context switch.

[m463]

no.

Apple will just slowly write itself into the equation so that little snitch can no longer mess with whatever muddled idea apple seems to think is important.

Already with Catalina you have to connect to apple and ask permission before you can even install little snitch. That means little snitch can't protect you from apple, even if you've told apple "my machine doesn't connect to the internet".

And your machine contacts apple every bit as often as microsoft machines even though their philosophy is supposed to be different.

bottom line: you should not have to ask apple permission to do anything with your machine.

[brianpgordon]

It may be a technically superior API but even so I'm not thrilled that if I want to stay current with MacOS updates past the phase-out period then I have to pay for a Little Snitch 5 license. v4 works fine for me and without this API deprecation issue I almost certainly wouldn't be interested in upgrading.

[beckler]

Little Snitch 4 is a rather impressive piece of software. The map is my favorite part. It's not always accurate, but it's absolutely wild to see the places apps want to ship data off to.

Also if you interface directly to your WAN, you can see all the bots/worms/etc that try to connect to your IP. I got a surprising amount of netbios queries from Iran (I'm assuming from EternalBlue based malware trying to connect), but I highly recommend NOT doing this. It's the wild west outside your firewall.

[qwerty456127]

> It's the wild west outside your firewall.

You mean outside my $5 NAT WiFi router last updated 6 years ago (because the manufacturer won't maintain it any more and the ISP never gave me the admin password anyway)?

[0xff00ffee]

I use both Little Snitch and Micro Snitch.

The LS proxy completely overwhelmed me. I thought I could be savvy and limit traffic. Yeaaaaah no. Once I started observing what was actually flying around it's... it's just insanity how many requests are made in just a few seconds. What else can I do but throw up my hands and hope for the best? But I guess it won't matter soon.

[zomg]

I've been using Little Snitch since 2.0 and I agree, it's very impressive software. I had the same reaction to seeing the map features -- eye opening to say the least and a very, very interesting feature!

[tomc1985]

It's kind of peaceful watching attacks crash against your webserver/firewall, like waves at shore.

[jzl]

https://en.wikipedia.org/wiki/Internet_background_noise

[odysseus]

I'd like to see a similar map built into pihole. Seems like a natural fit. This way you could get a map for connections made by various apps on your phone too.

[microtonal]

Background: Apple is abolishing (third-party) kernel extension to increase security:

https://developer.apple.com/system-extensions/

[0xff00ffee]

I always felt a little queasy installing a .kext from some random foreign-language websites (be it FTDI, or Alfa drivers, or even RealTek updates). I can feel the bias in me, "Oh no, this must be bad because it's foreign," which is absurd, but I still shouldn't be asked to sudo something when I buy offbrand hardware.

[hs86]

If they keep all third parties out of their kernel, could this ease a possible x86-to-ARM transition?

[riazrizvi]

And Apple takes another step closer toward a proprietary OS away from UNIX. Perhaps 10.16 will lose certification [1].

[1] https://www.opengroup.org/openbrand/register/

EDIT: I can't find anything that references kernel extensions in the conformance [2] section of the spec, so maybe 10.16 will adhere to the UNIX03 standard after all.

[2] https://pubs.opengroup.org/onlinepubs/009695399/

[gumby]

There are so many people using it at Apple that I can't imagine LS5 not working on 10.16 when it ships to the general public.

[mroche]

From the very end of the article:

> When will Little Snitch be updated to the new APIs?

> The replacements APIs that are currently available (NetworkExtension framework on macOS 10.15.4) are not yet completely sufficient to implement the full functionality of Little Snitch. But we are working closely with Apple to fill the remaining gaps and we expect that a beta version of macOS 10.16 (most likely available at the next WWDC) or even an upcoming version of 10.15 will provide what is missing. As soon as the APIs allow us, we will complete the transition of Little Snitch to the new NetworkExtension API. It’s our goal to provide a public beta in June 2020 and a stable version in October.

If they can (and Apple) can keep to that timeline, I expect they will.

[jayrhynas]

"we are working closely with Apple to fill the remaining gaps" - definitely sounds like it. I think Apple has made the right call tightening security around kernel extensions but I'm glad they're working with 3rd party developers (even if it's only big ones) to ensure the functionality is still there. They also mentioned the existing version will still work, it will just need to be explicitly enabled.

[perplex]

> Yes. We are going to release an update of Little Snitch that will be compatible with macOS 10.16.

At least a future version of LS will work with 10.16.

[bredren]

I hope this goes over better than the Sign in with Apple deadline that was attempted. That seemed like a pretty big flop.

[greendave]

Apple has really done a 180 degree turn from back in the early OS X days, when they actually did quite a bit of work to keep existing applications functional. Forget binary compatibility, now even existing APIs are disappearing left and right.

[bognition]

That makes sense right though. 15 years ago the number of people using OSX was a fraction of what it is today. They had to be very protective of that customer base.

Now the install base is huge and the threats are different.

[pjmlp]

During the early OS X days Apple was battling for survival, the were pretty much like this during the Mac OS days.

Plus it isn't like they aren't providing an upgrade path.

[tambourine_man]

What worries me about this move from Apple is that it may stifle creativity on the platform.

Apple is working closely with Little Snitch to provide them with APIs with the features they need. Fine.

But would Little Snitch exist if there were no Kernel Extensions?

[m463]

They've been taking that direction for years.

"Here's to the crazy ones..." Oh wait, there are none left.

[hyperbovine]

Yes? Clearly the market is there. And writing kernel extensions is a major PITA. One benefit of working in user space is that you can (usually) do so in the language of your choosing. Little Snitch 0.0.1alpha would have been a lot easier to prototype in Swift than in C.

[leokennis]

Little Snitch also nicely shows how Google will make increasingly desperate attempts to invisibly update its software in the background.

It starts with a request to Google.com from Google Software Updater. But if you block that and the follow ups enough times, in the end it will even try curl’ing directly to IP’s...

[djsumdog]

I guess it will be even more difficult to run Hackintoshes with 10.6

[sudosysgen]

If you have hackintosh level access, you would be able to inject kexts anyways.

[arm]

(Small typo correction: 10.16, 10.6 is Snow Leopard).

[Synaesthesia]

I think we will be able to go forward with custom kernels or some hack failing that.

[test7777]

Showing the deprecation message before the API that replaces it is actually out? Isn't that a bit of an a-hole move? I know everyone here is a developer and hates code older than a month, but really? Nobody gonna call them out on that?

[Isamu]

I never looked before but "ls /dev/bpf*" shows a lot of Berkeley packet filters. Maybe that reflects a movement toward user-space monitoring?

[wahern]

Interesting. I get 256 on Catalina (0-255), as opposed to 4 (0-3) on Mojave. /dev doesn't appear to be dynamic as it is on Linux, so they've chosen to pre-create more device files. More importantly, on Catalina the permissions are now ug=rw (0660) and with a group name of "access_bpf", whereas on Mojave they were u=rw (0600) and "wheel".

So, yeah, looks like Catalina was a stepping stone.

[codezero]

I think dtrace monitoring can be enabled, but requires removing some system security settings, if I remember correctly, so I guess if they go that route they still need to beef up security.

[rlonstein]

Archive before it gets hugged to death... https://archive.is/7HxHk

[KingOfCoders]

This article sparked interest into Snitch again and I've tried to upgrade from Snitch 3 - sadly upgrading doesn't work.

[unixhero]

A port to Linux would be nice, just saying!

[m463]

there is a project called opensnitch that supposedly does similar things on linux

https://github.com/evilsocket/opensnitch

I'm not sure how active it is (no recent activity and there seem to be a lot of forks)

[ethanpil]

I think Hackintosh enthusiasts are also an intended target of this phase out... These systems heavily rely on kexts...

[milofeynman]

What's the cleanest way to monitor your entire network similar to little snitch?

[pilsetnieks]

The difference is granularity - inside your computer you know which application is doing it. On a network level you only see which device it is.

Maybe there's something with a central server and an agent installed on every device connecting but I doubt it's as easy and pretty as LS.

[spacepinball]

So basically they will charge me once more for a compatibility fix.

[IOT_Apprentice]

So will the deprecation break Hackintoshs?

[nutjob2]

No. Hackintosh is a hardware and firmware platform, mostly at a lower level than macOS. Barring custom Apple hardware, anything that runs on Apple hardware will run on Hackintosh. Even custom hardware can be worked around as long as it is not critical (eg a custom CPU).

[delouvois]

Snitches get stitches

[shanemhansen]

It's interesting to compare and contrast community reactions to apple vs google policies, as well as how the companies interface with popular software.

Google changes extension model for Chrome, breaking ad blockers, reaction seems to be that it's an obvious power grab.

Apple changes extension model, breaking network blocker, reaction seems to be favorable.

[tjoff]

Maybe because it is not comparable?

[saagarjha]

> Google changes extension model for Chrome, breaking ad blockers, reaction seems to be that it's an obvious power grab.

Interestingly, Apple made this exact change in Safari first.