{"slug": "opensnitch", "name": "OpenSnitch", "category": "networking", "category_name": "Networking and VPN", "description": "Open-source interactive application firewall for Linux that prompts on outbound connections.", "recommenders": 5, "commenters": 5, "warners": 0, "score": 4.475, "rising": 1.02, "first": "2025-11-21", "latest": "2026-10-30", "why": "HN commenters recommend it as a Linux counterpart to Little Snitch that alerts on every new outbound connection, often layered with sandboxing and valued for being free.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 5, "neutral": 1, "compare": 0, "warn": 0}, "spark": [2, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2], "listed": true, "loved": ["Connection visibility", "Layered security"], "caveat": "Process attribution", "short_quote": "I'm certainly not going to spend $60 for something that has been doing the job for free.", "icon": true, "domain": null, "github_repo": "github.com/evilsocket/opensnitch", "official_url": "https://github.com/evilsocket/opensnitch", "pricing": "open source", "aliases": ["OpenSnitch"], "verdict": [{"text": "HN commenters recommend it as a Linux counterpart to Little Snitch that alerts on every new outbound connection", "cites": [{"id": 804940928, "item_id": 50308808, "url": "https://news.ycombinator.com/item?id=50308808", "by": "roscas", "date": "2026-10-30", "stance": "recommend", "quote": "Fist program to be installed.", "excerpt": "Do not forget opensnitch https://github.com/evilsocket/opensnitch for Linux. Fist program to be installed. If you never used, you don't know what is \"going\" on the pc.", "context": "Linux user", "use_case": "monitoring network connections", "switched_from": "", "story": "Little Snitch Shows Who Your Mac Talks To"}, {"id": 736635617, "item_id": 46039726, "url": "https://news.ycombinator.com/item?id=46039726", "by": "Fnoord", "date": "2025-11-24", "stance": "recommend", "quote": "Little Snitch on macOS and Open Snitch on Linux have helped me a lot here", "excerpt": "I don't have a filter list for compromised proxy servers and VPNs. Do you have a link? I'd be interested in logging such. For Tor, I use [1] (formats in json, txt, md) on OPNsense, but I've also been able to indeed simply parse ASNs (which I currently use for \"Twitter, Inc.\"). > Preemptively banning all bad-reputation cloud IP ranges except whitelisted hosts has zero impact on clients. =3 This. There's outbound and i", "context": "", "use_case": "outbound personal firewall", "switched_from": "", "story": "The Cloudflare outage might be a good thing"}, {"id": 736079712, "item_id": 46004982, "url": "https://news.ycombinator.com/item?id=46004982", "by": "henrixd", "date": "2025-11-21", "stance": "recommend", "quote": "I use OpenSnitch, which alerts me about all new connections.", "excerpt": "This might not be exactly what you meant or wanted, but I use OpenSnitch, which alerts me about all new connections. I also use temporary disposable virtual machines in QubesOS to isolate those kinds of activities from my more vulnerable systems.", "context": "", "use_case": "monitor outbound connections", "switched_from": "", "story": "Ask HN: Securing Pip and NPM package use?"}]}, {"text": ", often layered with sandboxing and valued for being free.", "cites": [{"id": 800563713, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "On top of this, I use opensnitch.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 763267904, "item_id": 47704244, "url": "https://news.ycombinator.com/item?id=47704244", "by": "Suffocate5100", "date": "2026-04-09", "stance": "recommend", "quote": "I'm certainly not going to spend $60 for something that has been doing the job for free.", "excerpt": "I'm glad people are building stuff for Linux, but the people who actually want something like this have likely already been using Opensnitch for years. I'm certainly not going to spend $60 for something that has been doing the job for free.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "LittleSnitch for Linux"}]}, {"text": " Complaints are rare; one commenter saw it attribute a connection to the wrong browser", "cites": [{"id": 767660497, "item_id": 47978781, "url": "https://news.ycombinator.com/item?id=47978781", "by": "roscas", "date": "2026-05-01", "stance": "neutral", "quote": "opensnitch caught the request but shows chromium instead of firefox", "excerpt": "Hum, I will use perplexity to find what is the mistery in here. Remember that chromium is trying to open perplexity.ai and I don't know what triggered it, even if it was something outside of chromium. So far, I cannot blame anyone... yet. update: I also cannot exclude Firefox that I use at the same time and opensnitch caught the request but shows chromium instead of firefox.", "context": "", "use_case": "monitoring network requests", "switched_from": "", "story": "How can perplexity.com persist on the browser without extension"}]}, {"text": ", and another called this kind of setup tedious.", "cites": [{"id": 800563713, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "On top of this, I use opensnitch.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}]}], "praise": [{"label": "Connection visibility", "summary": "Alerts on new connections so users see what their machine is contacting.", "quotes": [{"id": 736079712, "item_id": 46004982, "url": "https://news.ycombinator.com/item?id=46004982", "by": "henrixd", "date": "2025-11-21", "stance": "recommend", "quote": "I use OpenSnitch, which alerts me about all new connections.", "excerpt": "This might not be exactly what you meant or wanted, but I use OpenSnitch, which alerts me about all new connections. I also use temporary disposable virtual machines in QubesOS to isolate those kinds of activities from my more vulnerable systems.", "context": "", "use_case": "monitor outbound connections", "switched_from": "", "story": "Ask HN: Securing Pip and NPM package use?"}, {"id": 804940928, "item_id": 50308808, "url": "https://news.ycombinator.com/item?id=50308808", "by": "roscas", "date": "2026-10-30", "stance": "recommend", "quote": "Fist program to be installed.", "excerpt": "Do not forget opensnitch https://github.com/evilsocket/opensnitch for Linux. Fist program to be installed. If you never used, you don't know what is \"going\" on the pc.", "context": "Linux user", "use_case": "monitoring network connections", "switched_from": "", "story": "Little Snitch Shows Who Your Mac Talks To"}, {"id": 736635617, "item_id": 46039726, "url": "https://news.ycombinator.com/item?id=46039726", "by": "Fnoord", "date": "2025-11-24", "stance": "recommend", "quote": "Little Snitch on macOS and Open Snitch on Linux have helped me a lot here", "excerpt": "I don't have a filter list for compromised proxy servers and VPNs. Do you have a link? I'd be interested in logging such. For Tor, I use [1] (formats in json, txt, md) on OPNsense, but I've also been able to indeed simply parse ASNs (which I currently use for \"Twitter, Inc.\"). > Preemptively banning all bad-reputation cloud IP ranges except whitelisted hosts has zero impact on clients. =3 This. There's outbound and i", "context": "", "use_case": "outbound personal firewall", "switched_from": "", "story": "The Cloudflare outage might be a good thing"}]}, {"label": "Layered security", "summary": "Used alongside bubblewrap sandboxes or Qubes VMs for defense in depth.", "quotes": [{"id": 800563713, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "On top of this, I use opensnitch.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 736079712, "item_id": 46004982, "url": "https://news.ycombinator.com/item?id=46004982", "by": "henrixd", "date": "2025-11-21", "stance": "recommend", "quote": "I use OpenSnitch, which alerts me about all new connections.", "excerpt": "This might not be exactly what you meant or wanted, but I use OpenSnitch, which alerts me about all new connections. I also use temporary disposable virtual machines in QubesOS to isolate those kinds of activities from my more vulnerable systems.", "context": "", "use_case": "monitor outbound connections", "switched_from": "", "story": "Ask HN: Securing Pip and NPM package use?"}]}, {"label": "Free", "summary": "Seen as a free tool that already does what paid alternatives charge for.", "quotes": [{"id": 763267904, "item_id": 47704244, "url": "https://news.ycombinator.com/item?id=47704244", "by": "Suffocate5100", "date": "2026-04-09", "stance": "recommend", "quote": "I'm certainly not going to spend $60 for something that has been doing the job for free.", "excerpt": "I'm glad people are building stuff for Linux, but the people who actually want something like this have likely already been using Opensnitch for years. I'm certainly not going to spend $60 for something that has been doing the job for free.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "LittleSnitch for Linux"}]}], "caveats": [{"label": "Process attribution", "summary": "One user saw a request attributed to Chromium that may have come from Firefox.", "quotes": [{"id": 767660497, "item_id": 47978781, "url": "https://news.ycombinator.com/item?id=47978781", "by": "roscas", "date": "2026-05-01", "stance": "neutral", "quote": "opensnitch caught the request but shows chromium instead of firefox", "excerpt": "Hum, I will use perplexity to find what is the mistery in here. Remember that chromium is trying to open perplexity.ai and I don't know what triggered it, even if it was something outside of chromium. So far, I cannot blame anyone... yet. update: I also cannot exclude Firefox that I use at the same time and opensnitch caught the request but shows chromium instead of firefox.", "context": "", "use_case": "monitoring network requests", "switched_from": "", "story": "How can perplexity.com persist on the browser without extension"}]}, {"label": "Setup effort", "summary": "Combining it with sandboxing was described as tedious to set up.", "quotes": [{"id": 800563713, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "On top of this, I use opensnitch.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}]}], "who": [{"by": "roscas", "context": "Linux user", "url": "https://news.ycombinator.com/item?id=50308808", "date": "2026-10-30"}], "tags": ["for Linux users", "Little Snitch alternative", "pairs with sandboxing"], "use_cases": ["application firewall", "monitoring network connections", "monitoring network requests", "outbound personal firewall", "monitor outbound connections"], "compared": [{"slug": "little-snitch", "name": "Little Snitch", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50308361", "title": "Little Snitch Shows Who Your Mac Talks To", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50029123", "title": "Telegram Desktop vulnerability allowed any user's file to be stolen", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47978477", "title": "How can perplexity.com persist on the browser without extension", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47697870", "title": "LittleSnitch for Linux", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46029908", "title": "The Cloudflare outage might be a good thing", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45986895", "title": "Ask HN: Securing Pip and NPM package use?", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"neutral": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 2}}, "quotes": [{"id": 804940928, "item_id": 50308808, "url": "https://news.ycombinator.com/item?id=50308808", "by": "roscas", "date": "2026-10-30", "stance": "recommend", "quote": "Fist program to be installed.", "excerpt": "Do not forget opensnitch https://github.com/evilsocket/opensnitch for Linux. Fist program to be installed. If you never used, you don't know what is \"going\" on the pc.", "context": "Linux user", "use_case": "monitoring network connections", "switched_from": "", "story": "Little Snitch Shows Who Your Mac Talks To"}, {"id": 800563713, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "On top of this, I use opensnitch.", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 767660497, "item_id": 47978781, "url": "https://news.ycombinator.com/item?id=47978781", "by": "roscas", "date": "2026-05-01", "stance": "neutral", "quote": "opensnitch caught the request but shows chromium instead of firefox", "excerpt": "Hum, I will use perplexity to find what is the mistery in here. Remember that chromium is trying to open perplexity.ai and I don't know what triggered it, even if it was something outside of chromium. So far, I cannot blame anyone... yet. update: I also cannot exclude Firefox that I use at the same time and opensnitch caught the request but shows chromium instead of firefox.", "context": "", "use_case": "monitoring network requests", "switched_from": "", "story": "How can perplexity.com persist on the browser without extension"}, {"id": 763267904, "item_id": 47704244, "url": "https://news.ycombinator.com/item?id=47704244", "by": "Suffocate5100", "date": "2026-04-09", "stance": "recommend", "quote": "I'm certainly not going to spend $60 for something that has been doing the job for free.", "excerpt": "I'm glad people are building stuff for Linux, but the people who actually want something like this have likely already been using Opensnitch for years. I'm certainly not going to spend $60 for something that has been doing the job for free.", "context": "", "use_case": "application firewall", "switched_from": "", "story": "LittleSnitch for Linux"}, {"id": 736635617, "item_id": 46039726, "url": "https://news.ycombinator.com/item?id=46039726", "by": "Fnoord", "date": "2025-11-24", "stance": "recommend", "quote": "Little Snitch on macOS and Open Snitch on Linux have helped me a lot here", "excerpt": "I don't have a filter list for compromised proxy servers and VPNs. Do you have a link? I'd be interested in logging such. For Tor, I use [1] (formats in json, txt, md) on OPNsense, but I've also been able to indeed simply parse ASNs (which I currently use for \"Twitter, Inc.\"). > Preemptively banning all bad-reputation cloud IP ranges except whitelisted hosts has zero impact on clients. =3 This. There's outbound and i", "context": "", "use_case": "outbound personal firewall", "switched_from": "", "story": "The Cloudflare outage might be a good thing"}, {"id": 736079712, "item_id": 46004982, "url": "https://news.ycombinator.com/item?id=46004982", "by": "henrixd", "date": "2025-11-21", "stance": "recommend", "quote": "I use OpenSnitch, which alerts me about all new connections.", "excerpt": "This might not be exactly what you meant or wanted, but I use OpenSnitch, which alerts me about all new connections. I also use temporary disposable virtual machines in QubesOS to isolate those kinds of activities from my more vulnerable systems.", "context": "", "use_case": "monitor outbound connections", "switched_from": "", "story": "Ask HN: Securing Pip and NPM package use?"}]}