On: Little Snitch and the deprecation of kernel extens...

[jedberg]

That would introduce a major attack vector. One bad actor could introduce a rule that allows their malware to work.

[jfkebwjsbx → jedberg]

No, as long as it is just outgoing ones or only blocking ones. Most people do not have any filtering of outgoing traffic.

[jedberg → jfkebwjsbx]

I think you misunderstand the purpose of Little Snitch. The entire product is to warn you about outgoing connections. One of the use cases of that is seeing if a random app is connecting to an unknown host.

If you allowed crowdsourced rules, someone could sneak in a rule that says to allow their random app to connect to a random host, which is how malware exfiltrates your private data.

[jfkebwjsbx → jedberg]

TIL. Thanks. Yes, for whitelisting it does not work.