IdeaWell

Project ideas from Hacker News discussions.

LittleSnitch for Linux

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. Trust & Possible Phoning‑Home

“Do you still trust them not to do self‑reporting or phoning home, even though it is $0 and closed source?” — righthand

2. Openness vs. Closed‑Source Model

“OpenSnitch is open source. You don't need to trust it as you can see the code yourself. Little Snitch on the other hand, is completely closed source.” — dizhn

3. Linux vs. macOS Technical Limits

“Little Snitch for Linux is built for privacy, not security, and that distinction matters. The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity… The macOS version uses deep packet inspection to do this more reliably. That's not an option here.” — littlesnitch

4. Process Identification & UI Feedback > “Little Snitch must be running when the process starts in order to identify it correctly. You get less ‘Not Identified’ if you run it for a while, or you should get none if you reboot and Little Snitch can start before everything else.” — littlesnitch

5. Business Model & Monetisation Concerns

“I would be fine with a commercial license with source available here… the issue isn’t the price, it’s the fact that you’re asked to MITM every network connection you make under the control of a binary blob.” — foo12bar

🚀 Project Ideas

OpenSnitch UI Redesign

Summary

  • Replaces the WebView UI with a native GTK/Qt interface, improving responsiveness and process identification reliability.
  • Adds rule import/export and per‑process DNS leak protection to address transparency concerns.

Details

Key Value
Target Audience Linux power users and privacy‑focused developers who currently find OpenSnitch’s UI limiting.
Core Feature Native rule‑management UI with per‑process DNS leak detection.
Tech Stack GTK 5 (or Qt 6), Rust backend using eBPF, SQLite for rule storage.
Difficulty Medium
Monetization Hobby

Notes

  • HN users repeatedly complained about the WebView lag and lack of native look‑and‑feel (“Webviews are slow and full of bloat”).
  • A native UI would also make it easier to ship on immutable distros and raise trust in the open‑source codebase.

eBPF Flow Manager Daemon

Summary

  • Provides a low‑overhead eBPF daemon that compiles user‑defined connection rules into kernel‑level filters, enabling per‑process blocking without root privileges after startup.
  • Exposes a declarative JSON rule API compatible with systemd‑sysext for immutable OS deployments.

Details

Key Value
Target Audience Users of immutable distros (Bazzite, Fedora Silver, NixOS) who want firewall capabilities without compromising immutability.
Core Feature Rule compilation
Monetization Hobby

Read Later