Berkeley CSUA MOTD:Entry 11946
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/25 [General] UID:1000 Activity:popular
5/25    

2004/1/26-27 [Computer/SW/OS/OsX] UID:11946 Activity:high
1/26    Is there a program for Mac that catches programs making unauthorized
        network access/"call home".
        \_ Sounds like you want 'Little Snitch':
           http://www.obdev.at/products/littlesnitch
           (This is OS X only, not sure if there was something like this for
            OS 9).
        \_ it's called a firewall.
           \_ most home firewalls only block incoming.. and allow unrestricted
              access outgoing. since he said "call home" i assume he means
                  \_ Yes a firewall can do that. But how is your firewall is going
                     to tell the legitimate outgoing traffic (say web browsing) from
                         such "call-home" connections unless you start monitoring all
                         outgoing traffic or doing something equally inconvenient?
              something more like zonealarm pro but for mac
              \_ what you're talking about is a router that does NAT.  Any
                 decent software firewall will check inbound and outbound
                 connections.
                  \_ Yes a firewall can do that. But how is your firewall is
                     going to tell the legitimate outgoing traffic (say web
                     browsing) from such "call-home" connections unless you
                     start monitoring all outgoing traffic or doing something
                     equally inconvenient?
                     \_ OP wants zone alarm for the mac.
                     \_ because any firewall that isn't totally stupid will
                        ask you, "hey, program X is trying to send packets to
                        Y on port Z.  Do you want to allow this once, always,
                        not this time, or never?"
                        \_ Which is completely inconveniet and unacceptable to
                           lots of users. Many of the sites I visit every day I
                           visit for the first time and I don't want to be asked
                           every minute the same stupid question. Most firewalls
                           have that feature turned off by default for a good
                           reason.
                           \_ ZoneAlarm by default only warns you when a new
                              program tries to access the net, not when the
                              same program tries to access a new site.  So
                              after the first day you almost never get new
                              dialog boxes.  Get a clue.  -tom
                           \_ I used a simple example, but any decent
                              software firewall is rule-based.  Rules look
                              like: "Always allow connections from Mozilla.
                              Allow connections from ssh, but only to csua.
                              Deny all connections from Photoshop.  Ask me
                              about anything else." It's not that hard.
                              Good firewall programs will let you create
                              rules when they initially prompt you.  Yes,
                              you might get a prompt the first time you
                              start your web browser, but not for each site,
                              unless *you* *choose* to configure your
                              firewall that way.
           \_ Which "firewall" checks if an outgoing traffic is generated by
              some spyware/MS rather than ssh/mozilla?
              \_ most firewall will tell you the name of the file which is
                 trying to gain access.
Cache (337 bytes)
www.obdev.at/products/littlesnitch -> www.obdev.at/products/littlesnitch/
When an application tries to establish a network connection, Little Snitch intercepts the attempt and brings up an alert panel, telling you all the connection details including the name of the application which initiated the connection. You can either allow the connection, deny it or add a permanent rule for similar future-connections.