Implement a networking agent

[Danielle Foré]

Something like https://www.obdev.at/products/littlesnitch/index.html

The goal of this agent is to intercept apps when they attempt to use networking and make sure the user intends for them to have this permission.

[Danielle Foré (danrabbit)]

Looks like someone started working on something similar here: https://github.com/Douane/Douane

[Danielle Foré (danrabbit)]

Better link: https://github.com/Douane/

Looks like things are broken up into different repos so it should be usable and we can create our own agent and configure from the plug without having to re-invent the wheel

[Cody Garver (codygarver)]

LittleSnitch used to be my favorite app back in the day but here's the problem with these types of things:

It's either being so specific it's annoying (protocol * ip address * port) _or_ being so general that everyone will just click Allow no matter what.

[Aneurin Hall (aneurin-hall)]

I generally think that generic clickthroughs are bad, on the other hand if funny_scroller.sh or minecraft_piratebay_edition.elf is connecting to malware.vodka.923284erjlkdjf38.ru I'd really like to know about it.

I'm kind of a poweruser and it's not clear at all what I'm supposed to do in the firewall tab in security and privacy to block specific apps or executables from connecting and while I try not to think about that it scares the shit out of me when I do.

Maybe it could be mitigated by treating different files with different levels of suspicion: random file > a.out I just compiled > .deb > vetted app store download. maybe make it an opt-in like the firewall currently is. maybe put a 3+ second timeout on the "go away" button to make users read the copy.

[Aneurin Hall (aneurin-hall)]

also daniel,

on your sketch you wanted something better than a raw ip. that's called "Reverse DNS Lookup".

https://en.wikipedia.org/wiki/Reverse_DNS_lookup

and it's already built into your OS dude.

nine@shiddbox:~$ dig +short -x 8.8.8.8
google-public-dns-a.google.com.