Item — HN Reader

Picosnitch tracks every executable that connects to the internet and notifies you the first time something connects, or if the hash changes (it can also check VirusTotal).

There is also a simple curses based UI for browsing and filtering the connection logs (time, executable, hash, domain, IP address, etc).

It was designed using eBPF and fanotify to be extremely reliable, use very little system resources, and does not impact network performance. The entire program is only ~1500 lines.

1 comments

One thing I forgot to mention is that by using hashes to identify executables, picosnitch can provide more reliable intrusion detection since different executables can appear to be located on the same path.

For example, it can successfully identify whether curl being run from inside a docker container is the same or different from curl being run on your system, even if they both appear to be located at /usr/bin/curl.

To improve performance, hashes are cached based on the device and inode of the executable, and watched with fanotify to trigger a rehash if the executable is modified.