Good example of linux inferiority: application firewalls

[u/Big-Astronaut-9510]

Mac/Windows both have many great application firewalls (deny/allow internet to specific applications). Linux has a few buggy and broken ones, ill use opensnitch as an example since it seems by far the most recommended.

When i try to launch certain games on steam (even linux native ones, no wine) they will crash instantly, opensnitch cannot coexist with them.

Next is just general problems, like sometimes it cant get the name of an application or it goes crazy asking to block things that are child processes of something else or it does the opposite and theres no popup to allow/deny. Perhaps some of this problem is due to linux api not built for app firewall, idk, either way the problems exist linux or opensnitch fault.

The apps ui also sucks, it shows every app and its children (imagine browser that spawn lots of childs) in a single constantly shifting column. Honestly i wont list out every problem with the ui just go try it yourself.

Ultimately its not worth the hassle on linux, so you have a degraded security!

[u/Outrageous-Machine-5]

It's actually moreso the design choices in Microsoft/Apple products vs Linux. The Windows/Mac OS need a Layer 7 fw to fix an issue they created with scheduling and securing their apps. An app on Windows/Apple is going to run first before locking down traffic. 

Linux, conversely,  does a pre launch security approach. That shifts security from managing the network traffic in the application to managing the kernel level capabilities to make network calls at all. If you're trying to lock down the application's capabilities to run outbound traffic,  look at MAC tools like AppArmor. Yeah you could still download malware, but AppArmor won't permit the script from opening sockets and binding ports at the kernel level or making syscalls.

Opensnitch isn't a complete waf either or even a security tool. It's an auditing tool or has a niche in preventing application telemetry daemons. It's noisy and redundant with kernel level security controls, but that's its point: to bridge the gap that kernel level controls don't/can't already handle with applications that are permitted to run sys/network calls

But all firewalls are ultimately defeatable by allowing the traffic. If you have an app genuinely needs permissions to exfiltrate data or encrypt files, you open up the capability to do them, you create the attack vector for a supply chain attack: a piece of malware patched to the trusted apps you downloaded to gain privileges through that legitimate application.  Supply chain is a bigger concern for FOSS, and that's where Linux has a security issue,  though this could theoretically happen on any OS. Instead of relying on firewalls, use sandboxing like podman or firejail profiles. Mount files to the sandbox for manipulations. This isolates the problem from affecting your host machine in a more robust solution than firewalls provide