Release Notes

This version improves compatibility with macOS 15 Sequoia. Due to a change in macOS Sequoia, Automatic Profile Switching no longer worked when joining a different Wi-Fi network. Little Snitch 5.8 now uses a new mechanism to detect the name of the current Wi-Fi network.

Little Snitch 5.8 is available for macOS 15 only, because this issue does not occur in earlier versions of macOS.

In this release, we‘ve addressed an issue in the inspector of Network Monitor causing text sections to be cut off, preventing the full text from being visible.

This bug was a side effect of fixing a hang in the Little Snitch app with the previous release. We apologize for any inconvenience caused by two updates occurring in such quick succession!

• Improved detection of Wi-Fi networks for Automatic Profile Switching on macOS Sonoma 14.5.
• Fixed a possible hang in the Little Snitch app when the rule inspector shows longer text that requires scrolling.

• Fixed an issue on macOS Sonoma 14.4 causing Automatic Profile Switching to not work with Wi-Fi networks.
• Fixed a bug in Configuration where badges in the sidebar were not correctly displayed.
• Fixed a bug in Network Monitor where the map would initially open 180 degrees longitude off from your location on large displays.
• Fixed a drawing bug in the traffic diagram of Network Monitor.

Bug Fixes

This version fixes a new bug in 5.7.2 where connection alerts appeared without the big app icon of the connecting application on macOS 13 Ventura and probably older systems. MacOS 14 Sonoma was not affected.

Improvements

• Rules for operating system processes in Xcode’s Simulator (iOS, iPadOS, watchOS, …) are now effective for all simulated OS versions and platforms. Note that existing Simulator rules are not automatically converted to the new “catch all” format, so you will get connection alerts for these processes one more time, but from then on they will remain effective also for other Simulator instances.

Bug Fixes

• Fixed: The traffic diagram shown in Network Monitor sometimes stopped auto-scrolling for no obvious reason.
• Fixed: The “Mark new rules as unapproved” option in Settings > Advanced was not properly considered for newly added rules in subscribed rule groups. These new rules were always marked as unapproved, even if the settings option was turned off.
• Fixed: The inspector pane in the rules window was always opened with its maximum width on macOS Sonoma.
• Fixed: The main window of Network Monitor stopped updating after a “Make connections private…” dialog.

• Fixed a possible crash of the connection alert on macOS 14 Sonoma.
• Fixed incorrect English localization of network types shown in the Networks section of the configuration interface.
• Fixed a problem where settings changes made in Network Monitor were not preserved after quit on macOS 14 Sonoma.

• Compatibility with macOS 14 Sonoma.
• Fixed a rare problem caused by a bug in macOS Monterey and later when using multiple Spaces, causing the connection alert not to appear on all Spaces.
• Fixed a potential crash when clicking a notification from Little Snitch in Notification Center.

Performance Improvements

• The Configuration app starts much faster, especially if there are lots of rules and large rule groups.
• Network Monitor starts faster.
• Filtering connections in Network Monitor is faster.

Improvements

• Option-click on the disclosure icon of a connection in Network Monitor now expands to all descending rows.
• Improved opening of the map in Network Monitor to make sure the map is shown within the visible area of the screen, moving the window to the left if necessary.
• Visual feedback when clicking connection endpoints on the map in Network Monitor.
• Improved presentation of Little Snitch background processes in System Settings > Login Items on macOS Ventura.
• The default schedule for performing rule group updates has been changed to Daily. If you prefer to perform these updates manually, you can choose the desired schedule in the rule group editor (right-click the group in the sidebar and choose “Edit” from the context menu).
• When creating a manual rule backup, the last used backup location is now preserved (instead of always suggesting the home folder).

Bug Fixes

• Fixed incorrect display of keyboard shortcut in settings.
• Fixed a bug in Network Monitor where clicks on map annotations did not work.
• Fixed a bug in Network Monitor where a click on the disclosure icon of a connection did not reveal details.
• The command line tool created a code coverage file (default.profraw) in the working directory. This has been disabled.
• Fixed a possible crash of Network Monitor when connections dropped out of the available history time range.
• Fixed possible crash of the Little Snitch configuration app when System Extension configuration changed during display update.
• Fixed a rare issue that could cause connections to be shown without a destination address in the connection alert.
• Fixed a possible crash of Little Snitch Agent.

Improvements

• Support for macOS Ventura.
• Added a workaround for a macOS bug where an alert with the text “The application is not open anymore” was shown.
• Added a workaround for a possible incompatibility with fwknop and similar tools which use ephemeral ports for communication.

Bug Fixes

• Fixed a memory leak in Network Monitor.
• Fixed a possible crash when parsing a malformed subscribed rule group.
• Fixed a bug where a rule for an unsigned command line tool executed by a signed application could be erroneously shown as redundant.
• Fixed a bug where connections of mDNSResponder showed a false destination host name on macOS Ventura.
• Fixed behavior when dragging “My Location” in the map.
• Fixed a bug where a drag-operation in the map failed after showing a context menu.
• Expect iOS simulator apps also in the directory ~/Library/Developer/XCTestDevices. This directory is used by the xcodebuild command line tool.

Bug Fixes

This version fixes a bug where dialogs shown after activation of automatic profile switching and after entering a new license key did not contain any text.

Improvements

• The connection alert now indicates when a connection was established via iCloud Private Relay (Private Relay is a new feature of macOS Monterey, which is currently in beta).
• Improved detection of iCloud Private Relay connections on computers with IPv6 connectivity.
• Updated QUIC protocol parser to support the latest IETF versions. This results in fewer connection alerts showing only the IP address of the remote server instead of its hostname when using Chrome or Firefox.
• Improved rule group subscriptions to support various common block list formats, consisting of lines with domain names, IP addresses or IP networks in CIDR notation, or blocklists in /etc/hosts format.
• Improved display of IP address rules. When a rule affects just a single IP address range, that range is now shown in the rule list.
• Improved performance in Network Monitor when scrolling through connections with key-repeat.
• Added Internet Access Policy information for the “nehelper” process of macOS.
• When the update of a subscribed rule group fails, the cause is now reported in more detail.
• Automatic backup of ruleset and configuration data at regular intervals. Up to eight backups are kept. The Restore from Backup command also offers these automatic backups.
• Added missing localizations of some texts.

Bug Fixes

• Fixed a bug where reading the code identity of of applications with large Mach headers did not work. Rules for these apps created in Little Snitch Configuration resulted in an identity mismatch alert.
• Fixed a bug where Until-Quit rules could expire even after they had been turned into permanent rules.
• Fixed a bug where enabling an identity check for a process did not work.
• Fixed a problem that could cause connection alerts to re-appear five seconds after allowing or denying the connection.
• Fixed an issue that could cause the Little Snitch network extension to refuse starting.
• Added workaround for a bug in MapKit causing the centering of the map on the current location to be off by 180 degrees longitude under rare circumstances.

Improved installation and update

• The update is now completed automatically when Little Snitch was replaced with a newer version.
• Improved wording during first-time installation and update to better communicate the current state of the installation.
• If the installation or update fails even after a retry, Little Snitch now offers to create a “Diagnostics Report”.
• During installation and updates, the application menu now contains a “Create Diagnostics Report” item.
• Improved appearance of installation window in dark mode.
• When Little Snitch detects a broken installation during startup, it now offers a “Show Details” button.

Other improvements

• Improved support for Viscosity OpenVPN client.
• “More Items…” rows in Network Monitor can no longer be selected, only expanded.
• Updated database used to show the geographic location of remote servers.

Bug Fixes

• Fixed a crash in the Network Extension of Little Snitch which occurred during installation of Adobe products.
• Fixed an issue where Network Monitor could consume a lot of CPU time and thus energy while a connection alert is on screen and the connections window is closed.
• Fixed a bug where Network Monitor did not indicate a matching rule if the rule requires a particular protocol (e.g. TCP or UDP).
• Updated detection of Private Relay connections on macOS Monterey.
• Network Monitor now properly honors the “Mark new rules as unapproved” preference setting.
• Fixed a bug where one-click subscription of rule groups on web pages did not work for some URLs containing a query.
• Fixed a bug where the profile selection menu in the connection alert was not correctly aligned.

Improvements

• Improved user guidance when starting Little Snitch for the first time. Instructions how to enable the Network Extension are now illustrated.
• Added support for Private Relay connections on macOS Monterey. Since the Internet address of a Private Relay connection is not known, Little Snitch now shows it as “Private Relay”.
• When recording traffic of a process via littlesnitch capture-traffic from the command line, traffic from related helper-processes is now included as well. Parameters for the capture-traffic subcommand have been renamed to reflect this change.
• Connection details in the Network Monitor inspector now reflect the displayed and selected time period.
• When a temporary rule expires, Little Snitch now shows a connection alert for all related connections that are still active but no longer covered by the now expired rule. These connections can then again be allowed or denied, but until a new decision is made, the previous, temporary decision (allow or deny) remains effective.
• Improved connection alert to allow the creation of “Until Quit” rules for apps that are connecting via a helper tool, when the helper is already terminated, but the parent app is still running.
• Improved wording of the term “software update” in German localization.
• Corrected wording in tooltips of rule buttons in Network Monitor.

Bug Fixes

• Fixed a rare crash in the Little Snitch network extension.
• Fixed a rare issue where the host name of the remote server could not be determined for unencrypted HTTP connections.
• Fixed expiry handling of time based temporary rules. The expiry was delayed while the computer was in sleep mode.
• Fixed a possible deadlock which occurred when a “New Network” alert should have been shown.
• Fixed “Sort by Data Volume” behavior in Network Monitor. The values used for sorting did not take the displayed time period into account.
• Fixed a bug where the type of traffic meters in Network Monitor was not updated in all rows when switching the sort order between Last Activity and Data Volume.
• Fixed the computation of traffic rates shown in the inspector of Network Monitor. Rates may have been about 30% too low.
• Fixed a bug where data volume meters did not update when sorting by data volume.
• When switching the displayed time period in Network Monitor from a long to a short interval, some connections did not drop off the list, even if their last activity was outside the chosen interval. This issue has been fixed.
• Fixed a possible crash of the Little Snitch application when searching rules for occurrences of a string.
• Fixed an issue causing lots of warning messages regarding “deprecated use of NSObject in XPC” to be shown in the Console of macOS Monterey.
• Fixed a bug causing the connection alert not to update the indication that the connecting process just terminated.
• Fixed a bug causing a “location services disabled” alert message to appear twice when running Network Monitor for the first time.
• Fixed an issue where starting the Little Snitch application with the Option key held down did not open the Installation Status window.
• Fixed various bugs with mouse-hovering sensitive areas in the connection inspector of Network Monitor.
• Fixed an issue causing the “Show in Finder” button in the connection inspector of Network Monitor to disappear when clicked.
• Fixed a bug causing the Little Snitch application to hang after pasting a large number of hostnames or IP addresses in the rule editor.
• Corrected a typo in the German localization of the Profile popup in the connection alert.
• Corrected some layout and appearance issues in the “Welcome to Little Snitch” window.

This version brings a new feature to Network Monitor: Background processes which are part of the operating system are now grouped into a single entry titled macOS, which can be expanded to show all individual processes. Likewise, iOS/iPadOS/watchOS/tvOS processes that are running within Xcode’s Simulator are now grouped into a single Simulator entry.

Improvements

• When the Endpoint Security System Extension is not installed, rules affecting the Berkeley Packet Filter are now marked as inactive.
• Improved reliability of automatic update of My Location in Network Monitor.
• Network Monitor now shows a message dialog when it attampts to update the computer’s location automatically but access to location services is denied in the Privacy section of System Preferences.

Bug Fixes

• Fixed an issue where Little Snitch could freeze during a New Network alert.
• Fixed an issue where clicking the user notification “Connections During Login” did not reveal these connections in the Little Snitch app.
• Fixed detection of XPC process ownership on macOS 12 (Monterey) beta.
• Fixed an issue where the contents of the inspector sidebar in Network Monitor were not updated on a selection change.

This version fixes a crash in Network Monitor when the “Make Connections Private” action was invoked from the context menu.

This is a hotfix release for 5.2. It fixes a crash of the Little Snitch Agent when an iOS app runs in the simulator. The effect of this crash was that no connection alert was shown and Internet connections not covered by existing rules would hang.

This version focuses on three main areas:

• The list of „Known Networks“ used for Automatic Profile Switching which was previously shown in a separate window is now integrated into the main window of the Little Snitch application.
• The search and sort performance in the rules window has been greatly improved.
• Added support for executables running from randomized file system paths. Rules for executables in /tmp or /var/folders automatically ignore random path components. Rules for executables in other locations can be converted manually into „Identifier Rules“ which refer to the process by its code signature identifier and team identifier or SHA256 (for unsigned scripts) instead of the executable’s path.

Improvements

• Improved detection of Wireguard VPN: Added explicit check for PIA VPN Service.
• It’s now possible to remove other users’ connections shown in Network Monitor after authenticating as an administrator.
• Rule group modifications or resetting to factory rules can now also be authorized via biometric authentication.
• When a selected rule changes its position within the list due to some modification, the scroll position of the list is now adjusted so that the rule remains visible.
• Minor visual improvements in the configuration window.

Bug Fixes

• Fixed a bug where a connection alert for a terminated process did not disappear after creating a rule.
• Fixed an issue where a suspicious process warning with “validation error 255” was shown in a connection alert.
• Fixed identification of iOS processes running in the Xcode debugger. Rules for these processes now match regardless of random path components.
• Connection Alerts for incoming connections now always create IP address based rules because the remote computer name cannot reliably be known.
• Fixed an issue where two domains were not recognized as equal due to a lowercase/uppercase mismatch.
• Fixed a bug where an error message was shown in the inspector of Network Monitor if no Internet Access Policy was available for a process.
• Fixed a possible crash when showing the list of files available for „Restore from Backup“.
• Fixed startup issues after restarting computers with Fusion Drive.
• Fixed a bug where a temporary rule would overwrite a disabled rule and eventually remove it.
• Fixed a rare crash of the Little Snitch app when searching in rules.

New Features

• Capturing traffic of individual processes in PCAP format. This feature is available from the command line via littlesnitch capture-traffic.
• The rules shown in the configuration application can now be sorted by the remote server’s domain name. Clicking the table header in the rules window brings up a menu with available sort options.

Bug Fixes

• Fixed automatic update of “My Location” in Network Monitor.
• Fixed a bug where a profile selection button appeared in the connection alert even if no profiles were available.
• Fixed a rare crash of Little Snitch Agent during upgrade. This fix affects the next upgrade, the crash can still occur when upgrading to this nightly build.
• Fixed a bug in detecting the path of Java applications.
• Fixed a possible crash of Network Monitor.

This patch release fixes a possible loss of network connectivity due to a crash of the Little Snitch network extension. This crash could occur when an application used the QUIC protocol. This protocol is a replacement for HTTPS which is used primarily by Google Chrome and its derivatives when connecting to Google servers.

Improvements

• Improved accessibility via VoiceOver.
• Better detection of VPNs for Automatic Profile Switching.
• Improved indication of Little Snitch installation issues in the status menu icon.
• Performing code signature verification for shell scripts and other scripts, if they are signed.
• Shell scripts and other scripts are no longer considered as the connecting process when they use helper processes like ping or curl. They are now treated as the parent of the helper process.
• Little Snitch no longer warns when shell scripts and other scripts don’t have a code signature.
• Accepting code signatures of iOS applications on Apple Silicon Macs.
• The macOS kernel is now treated as if it were code-signed. This allows the default localnet rules to apply to the kernel.
• Improved detection of remote computer name. Connection alerts with multiple, ambiguous host names are now less likely.
• Numerous user interface improvements.

Bug Fixes

• Fixed various memory leaks in all components of Little Snitch.
• Fixed a bug where the traffic view in Network Monitor did not display any data.
• Fixed identity check for code signatures using non-Apple certificates.
• Fixed an issue where an Identity Mismatch Alert could not be resolved by clicking “Accept Modification”.
• Fixed an issue where clicking on a silent mode activity notification did not select the corresponding process in the configuration app.
• Fixed a bug where loading subscribed rule groups did not load anything. This bug occurred with the abbreviated format.
• Fixed a bug where subscribed rule groups were not updated automatically.
• Fixed a possible crash when importing configurations from (Time Machine) backup.
• Fixed a bug where Little Snitch could crash when exporting a configuration backup.

Improvements

• Improved Automatic Profile Switching. The delay between a network change and the resulting profile change has been significantly reduced.
• A warning sign is now shown in the menu bar status icon if the Little Snitch network content filter got deactivated in System Preferences > Network.

Bug Fixes

• Fixed a bug where the pop-up button for selecting the domain did not appear in connection alerts.
• Fixed a bug where an identity mismatch error was incorrectly shown for the operating system kernel.
• Increased startup timeouts to facilitate booting on slow Macs (with HDDs).
• Fixed a bug where (in some cases) an Internet Access Policy was not shown in the connection alert.
• An incorrect ownership of the Launch Daemon and Launch Agent configuration files is now fixed automatically during the installation and update process.
• Fixed a crash when an invalid protocol number was present in a rule.
• Fixed a bug where servers could have a trailing dot in their name.

Improvements

• New icons in the Suggestions section of the Rules Window.
• Improved selection behavior in the Rules Window after deleting a rule.
• Improved status menu to show the selected profile at the top level of the menu.
• Improved layout of numerical data rate values shown in the status menu icon.
• Improved performance when launching Network Monitor.
• Improved updating the Little Snitch app to a newer version via Drag and Drop. The app will now start automatically to perform the necessary completion of the installation.

Bug Fixes

• Fixed a bug where rules making connections private in Network Monitor would not become effective until a restart.
• Fixed a crash when a connection alert should be shown for www.domain where domain is a top level domain.
• Fixed incorrect display of port number for incoming connections. Previous versions showed the remote port instead of the local port.
• Fixed a possible random crash of the Network Extension.
• Deny-rules are now always applied, regardless of the trustability of the process.

Improvements

• If the identity of a process is not checked, the identity of helper processes is now also not checked. This is a concession to the fact that apps without code signature usually ship with helpers that have no code signature. In addition, it allows iOS developers to disable identity checks on Xcode, thereby disabling identity checks on simulator apps running in Xcode's debugger.

Bug Fixes

• Fixed a bug where configuration changes such as modified preference settings could get lost after a restart of the computer.
• Fixed a bug where access to URLs like https://1.2.3.4/ would be interpreted as host 1.2 in domain 3.4.
• Improved compression of disk image to reduce the size of the download.
• Added missing localization in Connection Alert.
• Fixed a bug where Network Monitor opened unexpectedly when the demo period ended.

Improvements and new features

• Improved handling of DNS lookups. It’s no longer necessary to allow DNS lookups for each process individually.
• Extended debug capabilities of the command line tool.

Bug fixes

• Addressing an issue that could cause Little Snitch helper processes to prevent from getting started.
• Fixed a crash when loading a corrupted configuration file.

What’s new in Little Snitch 5?

There has been quite a bit of public discussion recently about the deprecation of various types of kernel extension on macOS. Among them are Network Kernel Extensions (NKEs). You probably did not care so far, but Little Snitch 4 was based on an NKE to do its job. Since NKEs are now deprecated and no longer officially supported by Apple, we have spent the last year rewriting the core of Little Snitch to the Network Extension (NE) framework. While working on this core, we took the chance to revise some old design decisions and add some long anticipated features.

So what are the benefits of the new version?

• Compatible with (and requires) macOS Big Sur.
• Future-proof, because it is based on the new Network Extension and Endpoint Security frameworks.
• Drag and Drop installation and upgrade, no reboot required.
• Universal Binary which runs on both Intel and Apple Silicon Macs.
• Little Snitch now comes with a command line interface for preferences editing, configuration import and export, debugging, logging and access to traffic history.
• The time range available in Network Monitor’s traffic diagram has been extended from one hour to up to a year.
• Rules can now specify a list of port numbers, not just one contiguous range as before.
• The export format for backups is human readable normalized JSON.
• Recording of network statistics is done independently of Network Monitor. You can quit Network Monitor and still have statistics recorded.
• Live traffic logs via command line tool.
• Ready for mass deployment installation in corporate environments.