The makers of Little Snitch write about macOS network filtering, kernel extension deprecation, and security issues in their app.
Commenters cite it for how Apple's own software can bypass Little Snitch, the content filter exclusion list, and the move away from kernel extensions.
No, it's an entirely separate new product they introduced back in 2015 [1], Little Snitch is still far and away their main and most important offering. Micro Snitch does fit in with their overall company focus of monitoring application background transmissions of your data, but it's a lot more minimal in focus (and in turn very cheap). I'm not sure why it's getting an HN post now, it hasn't recently received any significant upgrades beyond some basic Mojave compatibility/Dark Mode.
Actually Mojave introduced some significant new per-application protections and permission requirements for privacy related equipment, including camera and microphone [2], so I'm not sure it's as relevant now as it was at launch. I suppose that even if you grant something permission it could still be useful to have more active monitoring of usage as well, it might get compromised or look legit but then do things you don't expect.
----
1: https://blog.obdev.at/introducing-micro-snitch/
2: This can actually "break" old software in some cases, because it'll try to access something and fail but the OS permission dialog will be hidden by some other window or not show up properly. Sometimes you can work around this manually in the Privacy pane of the Security & Privacy preference panel, where it'll list software that recently tried to access a resource but couldn't and you can check it off to allow it in the future.
> The developers of Little Snitch have explicitly said they favor this move ...
Sure. They also said that if Apple doesn't provide them the required API's, they will continue using a kernel extension:
> But what happens if Apple will not or cannot provide the required features? NKEs will be deprecated, but not Kernel Extensions in general. We can still implement a Kernel Extension to augment the functionality of the NE framework. The basic filtering can be done via the NE framework and additional functions would be provided by our own Kernel Extension.
Source: https://blog.obdev.at/little-snitch-and-possible-deprecation-of-nkes/
The unsaid part is ofcourse - "as along as Apple allows them to do so."
With the way Apple is tightening down the Mac systems, through both hardware (Apple T2 security chip) and the software (changes to macOS making it more like ios), there is absolutely NO GUARANTEE that Apple will allow unapproved Kernel Extensions to run on the future versions of macOS.
> That's why Apple has the Developer and Public Beta releases for iOS/OSX so that external users can provide feedback. And on this occasion just like on many other they will take action if necessary.
Except that Apple did not take action. Firewall developers such as Little Snitch did become aware of the issue during the beta releases and gave feedback to Apple, which Apple ignored and shipped it anyway to the public. https://blog.obdev.at/a-hole-in-the-wall/
Sounds like this was discovered by MalwareBytes so if you have that installed a scan should let you know too.
Also, Little Snitch will show you the connections it makes every hour. Before anyone says it - in macOS 11.2, Apple removed the exclusion list that allowed their own software to bypass firewalls.[1]
[1] https://blog.obdev.at/a-wall-without-a-hole/
It appears you are mistaken: a properly configured little snitch will protect you. You can configure APS (automatic profile switching) to pause and ask every time your mac connects to an unknown network -- not a device, as I imagined, but a network.
Here is a detailed post: https://blog.obdev.at/automatic-profile-switching/
In the Vault 7 leaks, Little Snitch was mentioned as something three letter people had problems with circumventing. I think it's worth considering whether this new attack surface is there by design:
https://blog.obdev.at/little-snitch-on-vault-7/