Another case of app going rogue...

Check this out:


This is a risk that would never go away. Open source or not.

This is the reason why I block apps from connecting to the internet, unless an internet connection is required for core functionality. This isn't the first time something like this has happened. There has been quite a few instances in the past where similar instances have occurred. This is not just limited to apps, but also browser extensions.

Open source and/ or free apps come with their own set of potential concerns. I don't see the motivation of the developer in offering something for free.

Broadly speaking, the following scenarios are possible:

1. Developer becomes greedy/ rogue.
2. Developer sells the product/ service to another entity that has questionable motives.
3. Man in the middle attacks.
4. The project itself had malafide intentions right from the start. First make a product popular for maximum reach, and then exploit it's fanbase.

BOTTOMLINE: Don't blindly trust a product or its makers just because it is popular. A little bit of caution always helps.

I find OneClickFirewall handy to do this for Windows firewall.

Fabler2 said:

I find OneClickFirewall handy to do this for Windows firewall.

Click to expand...

I have tried TinyWall and it is quite good. Will give this a try on one of my (expendable) Windows installation.

The idea of using a 3rd party firewall app has the same issue as in the OP. One doesn't know what MORE the app does in the background.

On my main systems, I follow one of two methods:

1. FIREWALL WHITELISTING
Windows Firewall blocks everything by default. I manually create a rule to allow (whitelist) only the essential programs that require internet for core functionality. For example, Firefox browser is whitelisted, while the background Mozilla Service is not.

2. FIREWALL BLACKLISTING
Install only the essential programs. This primarily includes browsers, iTunes, and a few well known softwares like VLC and a handful of others. In this case, I install programs that should not need to access internet (like VLC) inside a custom folder. I then run a script I found that blocks every executable (exe, dll, etc.) inside that folder.

The problem with method 2 is the number of rules that the script adds to Windows Firewall. It often runs into hundreds of rules for some of the apps. For example, over 300 rules are created for VLC alone. This is a very inefficient configuration because every internet request now has to go through thousands of firewall rules before being allowed/ denied.

I prefer method 1 for reason mentioned above. The only problem with it is sometimes I have difficulty in finding what to whitelist to make a program work. Also, some programs require multiple files to be whitelisted before it works correctly, e.g. Chrome Remote Desktop.

@TheMystic

Actually some people do things just because they have the time and enjoy doing it -- not everybody is 100% motivated by money.

Take for example that brilliant free product CALIBRE which works on Linux, MacOS and Windows, is regularly updated, enables things like kindles to be able to use epub type e-books so not relying on Amazon's own e-book offerings to be used on e-readers like kindles etc.

Its been 100 % free and ad free as well for years now. It's really the "Bible" of e-book management" -- brilliant program.


Cheers
jimbo

I tried several firewall apps, but I found them all very difficult to use. I do the following to limit my exposure.

a) Don't use the main work computer that contains personal data for doing fun stuff.

b) Use other computers with no personal data for doing fun stuff.

It is not possible to do a perfect a) vs b) separation but it lets me sleep at night :)

jimbo45 said:

Actually some people do things just becuase they have the time and enjoy doing it -- not everybody is 100% motivated by money.

Click to expand...

While I agree with that statement, such developers are indeed few and far between. Of course there is nothing wrong if a developer assigns a price for his product/ service. And all of the problems mentioned in OP would apply even then. But it is the free and/ or open source products that one should be more careful about, because the developer's motivation isn't clear.

Also, being open source isn't synonymous with being clean from a security or privacy perspective. Most forks from open source projects add their own things and the end product may not be completely open source. But due to false advertising, people assume that the end product is open source too. It is not.

Even if open source, is there a reliable entity that is actually auditing them, and auditing them continuously? There is a huge difference between being open for audit, and actually doing an audit.

Haydon said:

I tried several firewall apps, but I found them all very difficult to use. I do the following to limit my exposure.

a) Don't use the main work computer that contains personal data for doing fun stuff.

b) Use other computers with no personal data for doing fun stuff.

It is not possible to do a perfect a) vs b) separation but it lets me sleep at night :)

Click to expand...

Yes. This is pretty much what I do too. :)

As you can guess I'm a little lazy so I use 'Everything' and 'OneClickFirewall' so I can block all that's needed in a program. :)

Works well enough for me.

Fabler2 said:

As you can guess I'm a little lazy so I use 'Everything' and 'OneClickFirewall' so I can block all that's needed in a program. :)

Works well enough for me.

View attachment 23910

Click to expand...

I'm guessing that you are blocking just the exe file. That alone may not be sufficient. There are extensions like dll (and others) that need to be blocked too to completely block internet access.

So your method quite possibly is giving you a false sense of security.

TheMystic said:

I'm guessing that you are blocking just the exe file. That alone may not be sufficient. There are extensions like dll (and others) that need to be blocked too to completely block internet access.

So your method quite possibly is giving you a false sense of security.

Click to expand...

Noted

There is a fork of audacity called audacium. It apparently doesn't have the telemetry.

If anyone wants a copy of Audacity before it crossed over to the dark side... I have version 2.3.3
Scans 100% clean at Virustotal...





Works on Windows 10 and Windows 11.
It's not as pretty as the newest version, but it doesn't try to "call home" either. :)

Might be an idea to actually read the privacy notice before assuming reports on dubious so called expert sites are truthful and not exaggerated to create paranoia and is just click bait.

Only change is automatic updates which you can turn off and bug / crash reports which you can decline to send, pretty much normal for many apps these days.

Fired up Audacity one of the affected versions, updates off and it is not contacting anywhere having checked with TCP View and Current Ports.

Another awesome app, that doesn't try to call home... :)
Foobar2000