[c618b9b695c4]

The reddit thread raises a good question I have often wondered. What is my best option for an application level firewall? I want to deny network connections by default and specifically enable who can speak to the outside world.

[miles]

OpenSnitch[1] is mentioned[2] in the reddit thread and was most recently featured on HN last year[3].

[1] https://github.com/evilsocket/opensnitch

[2] https://old.reddit.com/r/linux/comments/od3h8b/audacity_may_...

[3] https://news.ycombinator.com/item?id=22206116

[matheusmoreira]

> I want to deny network connections by default and specifically enable who can speak to the outside world.

I also want to filter the network data. I want my firewall to inspect what the software is sending over the network and delete, randomize or nullify all data that isn't strictly necessary for it to perform the desired function. Like uBlock Origin but for the network stack.

This would enable normal operation of the software while also at least partially subverting the "legitimate business interests" of these corporations.

[phone[phone]]

> I want my firewall to inspect what the software is sending over the network and delete, randomize or nullify all data that isn't strictly necessary for it to perform the desired function. Like uBlock Origin but for the network stack.

You'll have to TLS man-in-the-middle yourself for this to be viable.

[matheusmoreira]

Absolutely. Interception is okay when we're the ones doing it. Software exists to serve us, it doesn't have the right to establish private communications with third parties against our wishes.

I've intercepted the traffic of many mobile apps to see what information they're sending. I hear developers are pinning certificates now. I can just replace the pinned certificate, right?

[jfrunyon]

That's easy, since you have control over trusted CAs. And also, not true; it could be done in the TLS library.

[alpaca128]

Could also work with file access. Most applications never need to access the whole filesystem. My browser mostly needs access to the profile-specific data and the downloads folder. A music player doesn't need access to anything outside the music directory and also no networking unless maybe that one URL it uses to load album cover images.

Although I'd only prefer this approach if it's actually done right. Android, Flatpak etc. mostly showed ways to do it badly.

[matheusmoreira]

Agreed. We need ways to filter every Linux system call. Not just disallow the system calls themselves. We need the ability to apply policies to parameters and filter I/O in a transparent way.

[jfrunyon]

https://en.wikipedia.org/wiki/Systrace https://en.wikipedia.org/wiki/Linux_Security_Modules

[jfrunyon]

https://wiki.ubuntu.com/AppArmor ???

[iliketrains]

On Windows I use henrypp/simplewall. It is lightweight UI on top of Windows Filtering Platform. My only complaint is to all the self-updating programs that keep changing its binary and I need to re-enable them periodically...

[lioeters]

On macOS, LuLu: https://objective-see.com/products/lulu.html

[sneak]

Netlimiter on Windows, Little Snitch on macOS.

[simcop2387]

For linux, check out firejail for isolating it.

[pmontra]

I didn't know about firejail. Thanks.

The gist of it is

  sudo apt install firejail
  firejail audacity

I guess that the line

  net none

in /etc/firejail/audacity.profile prevents any network connections. And

  man firejail

for many useful functionalities.

[throwawayboise]

Run it under a different user and firewall that user off from network access.