EBPFSnitch: An eBPF based Linux Application Firewall
I get the point of it, but I think it&#x27;s a distraction from the solutions we really need. The whole idea of app firewalls is &quot;do&#x2F;don&#x27;t let an arbitrary network communication happen unless I know about it&quot;. The problem is, what if what you allow still involves an attacker? Say you allow some network connection from application A to site Z using protocols B,C. And say that you even inspect the connection using DLP. There will come a point where the attacker will position themselves to appear exactly like legitimate traffic.<p>Ultimately, all firewalls are just a very poor hack around a complex problem. The best solution to the problem is to ensure the connection is genuine and that the data being passed is genuine, and you can&#x27;t do that with an arbitrary monitoring program. You need strong end to end authentication, authorization, and integrity, and sometimes also privacy. But we don&#x27;t have the tools to do that right now because the protocols were designed for a different time.<p>Take DLP for example. Almost every major company in the world is starting to implement traffic inspection, because how the hell else are you going to ensure security of your IP with 10,000 employees using TLS 1.3? The inspection you force on the users is its own security hole, to say nothing of software bugs. And you can&#x27;t even just lock down the network to only protocols that use OAuth or something. None of our security solutions are holistic.<p>We need a revolution in network security that takes each <i>part</i> of a network communication and its individual security needs into account, not just what we imagine is end-to-end (but never actually is). We can&#x27;t rely solely on a facile &quot;privacy or nothing&quot; approach to internet security that the TLS mafia has been pushing. We need more flexible methods that allow us to fine-tune security at each level of the protocol stack, across multiple organizations and use cases. Nothing like that exists currently for the web.