Little Snitch definitely needs a social feature where you can crowdsource good rules from other people and see what rules are common within the communities for certain apps.

While the social part is not there, the technology is.

I subscribe to rule groups through hostblocker.app, which pulls HOSTS files from different known websites and compile them into a .lsrules file which Little Snitch can use.

While I cannot vouch for the website's underlying code-I did not write it and I can not find an open source implementation-It only provides rules and I can edit any rule group to my liking after subscribing to it.

That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.

No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.

I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host.

If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.

TIL. Thanks. Yes, for whitelisting it does not work.

Back when I was using OSX and Little Snitch, first user experience was horrible. I reinstalled OSX and installed Little Snitch first, and went to install app by app after running it, and got a slightly better experience. But, requires a reinstall of your OS (or maybe creating a new user will be enough)

little snitch supports blocklists ublock origin supports. it's a bit obscure feature but easy to setup.

This is precisely why I've never installed it, because I figure it would overwhelm me.

How does combo help you not be overwhelmed?

It is really obnoxious when you first install it, but once you have set up your rules for your most frequently used applications, it isn't really an issue for me. You can also export and import your rules if you want to move them to a new system.

I haven't used micro snitch, though.

> once you have set up your rules for your most frequently used applications, it isn't really an issue

I can second this, also if you're overwhelmed you probably have a lot of garbage applications making too many outbound network requests to trackers and who knows what else which is actually nice to know about. Chrome-based browsers and Electron based apps seem to be particularly awful about this. My HP printer app tries to connect to Google Analytics, Microsoft RDP phones-home before connecting to a session. I really value that kind of insight and enjoy being able to control it.

I removed little snitch. :)

Micro snitch just alerts me when my mic or camera are activated. I can live with that.

Are they ever activated at times you aren’t expecting them to be? I assume I would have a noticed the little green light on my mbp if the camera was being activated against my wishes.