OpenSnitch

Even though it's poorly implemented, Windows 10's dynamic firewall feature is theoretically a worthwhile addition. It notifies you when an application it doesn't know about, or an application without adequate permissions, attempts to make an outside network connection. You can then choose to enable it or block its attempts to communicate. Much like Android, this would be great if you could trust that nothing else was getting through without notifying you, but that sadly isn't the case. However, Mac OS users have a better option with a third-party tool called Little Snitch, which does basically the same thing, but because Little Snitch registers kernel extensions on a Unix-alike system, it seems a little more trustworthy.

What would be even better than all of these, of course, is a Linux application that tries to do the same thing – enter OpenSnitch. OpenSnitch is a firewall tool that notifies you when an unknown process attempts to make a connection and lets you decide whether to whitelist the app, block the app from making the connection, or deny or allow the connection for this time only. You might wonder why you'd need something like this when Linux network security is already very high, but it's because we often install and run so much that it can be difficult keeping abreast of what permissions are needed by everything. OpenSnitch does exactly this. It will automatically detect an outgoing connection regardless of the source, allowing you to create your firewall configuration as you need it. It's also a great way to see what even trusted applications are doing over the network. Of course, if you suffer some kind of vulnerability, the first thing it will try to do is talk to a server, which can be stopped with OpenSnitch before any communication takes place.

Project Website

https://github.com/evilsocket/opensnitch

For the firewall functionality to work, OpenSnitch needs a kernel with iptables, NFQUEUE, and ftrace kernel support.

IRC client

Irc it (ii)

The IRC protocol is supremely hackable and relatively easy to implement, mostly thanks to the protocol being basic and universal – it's almost as simple as sending character codes to a port and reading character codes from a port. It's perhaps for this reason that there are so many different IRC clients and implementations, from the all-powerful, like Irssi or WeeChat, to the experimental. Irc it (ii) definitely falls into the experimental category, because instead of presenting IRC as an interactive text parser, it turns IRC into a minimalist FIFO filesystem. This means that your IRC server connection appears as a directory tree, populated by server, channel, and nickname directories. At the end of every path is an in file and an out file. The out file is where you'll find the messages for that channel, whereas text placed within the in file will be delivered to the channel. For example, typing

echo "/j #linuxvoice"> irc.freenide.net/in

will join the Linux Voice channel and create a new directory.

It's a unique take on IRC that could even have practical uses, especially if you use IRC for sharing files. But this filesystem layout may be equally useful for automation tasks or for processing input and output, such as through a natural language parser or speech synthesizer. The project site includes several example bots, as well as enhancements that help you use the client from within Vim or as a PHP web front end. And while you're unlikely to find a pre-built package for your distribution, this project's tiny pocket of 500 lines of C code will build in less than a second and makes for a great template if you want to write you own IRC client.

Project Website

https://tools.suckless.org/ii/

Turning IRC into a simple filesystem may initially sound like a gimmick, but it actually has many powerful and legitimate uses.