🆕 Software Suggestion | picosnitch

[elesiuta]

Hi, I created picosnitch and thought it may be worth mentioning here.

It uses BPF to monitor network traffic per application, and per parent to cover those that just call others. It also does it's best to hash every executable, and will complain if some mischievous program is giving it trouble.

This tool was designed to help protect your security and privacy by "snitching" on anything that connects to the internet, letting you know when, how much data was transferred, and to where.

I'm happy to hear any feedback and hope some people find it useful!

[dngray]

I'm actually thinking of having a firewall page at some point, or making this a part of each OS page.

Some topics we want to expand on like application firewalls for example.

[elesiuta]

On the topic of application firewalls, since they are easy to bypass on Linux I tried to design picosnitch to mitigate some of their shortcomings and function more like a HIDS instead.

However there were still some shortcomings that weren't practical to solve so I tried documenting them all under the limitations section and mentioning alternative strategies where possible if it was a concern.

I also considered how picosnitch could be used as an application firewall by watching the SQL logs from a firewall/router, but that would be more work and still less secure than just sandboxing whatever shouldn't have network access.

[dngray]

On the topic of application firewalls, since they are easy to bypass on Linux I tried to design picosnitch to mitigate some of their shortcomings and function more like a HIDS instead.

That's actually been one of my biggest concerns, is that a lot of these tools don't really work too well. Years ago, I remember a project called Douane, and had always been meaning to try it out.

[dngray]

Investigate and test as a part of privacyguides/privacyguides.org#1988.

I think this does make more sense for monitoring a server side, as opposed to "desktop" style applications like Douane.