naveednajam / little-snitch---rule-groupsv2

Little Snitch Rule Groups

Little-Snitch---Rule-Groups

This repo provide rule groups for Little Snitch based on unified host list to block ads, malware, fake news and porn

Python script will convert the unified host files provided and maintained by the great team and members at https://github.com/StevenBlack/hosts to the .lsrules files which can be directly subscribed in Little Snitch V4.1 as of now each rule group can hold maximum of 10,000 (rules, domain, hosts) script split the unified host file multiple small files each contains maximum of 10,000 rules to comply with Little Snitch limitation.

Change log V2:

In this new version of Rule-GroupsV2 . I heard all the opinions and wrote everythng from scratch to make it moduler. Now lists are separated by source and respective category. It will make a singe list much smaller and easier to handle by rule manager in little snitch. Do check the page and subscribe to the rulegroups with just a click.

little-snitch---rule-groupsv2's Issues

AdGuard DNS Filter

Hi @naveednajam,

I've noticed that the AdGuard DNS Filter rules count is bouncing between ~30.000 and ~9000 from time to time. Are you aware of this?

Cheers,
T

SSL Certificate expired on Mar 21

SSL Certificate for domain rulegroups.com and dl.rulegroups.com has been expired since 2023-03-21

$ curl -s -vv --insecure https://rulegroups.com 1>/dev/null
*   Trying [64:ff9b::cab9:c687]:443...
*   Trying 202.185.198.135:443...
* Connected to rulegroups.com (64:ff9b::cab9:c687) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1

… omitted console output …

* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: CN=rulegroups.com
*  start date: Dec 21 15:02:39 2022 GMT
*  expire date: Mar 21 15:02:38 2023 GMT
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

… omitted console output …

$ curl -s -vv --insecure https://dl.rulegroups.com 1>/dev/null
*   Trying [64:ff9b::cab9:c687]:443...
*   Trying 202.185.198.135:443...
* Connected to dl.rulegroups.com (64:ff9b::cab9:c687) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1

… omitted console output …

* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: CN=rulegroups.com
*  start date: Dec 21 15:02:39 2022 GMT
*  expire date: Mar 21 15:02:38 2023 GMT
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

… omitted console output …

Does anyone update these lists?

I'm noticing that essentially all of these rules were added and have not been updated since two years ago. I can't imagine how much work goes into translating raw IP and domain lists into the proper formats, but assuming there's a script that can do it, is there an original source for these which may be recently updated?

Question

Hi there, not sure how you are filtering domains, but why for example is mozilla.org being blocked in

Little-Snitch---Rule-GroupsV2/sources/ads/adguard.english/domains

Line 7492 in dd2f3bb

mozilla.org

Is this a bug?

Conflict in Requirement.txt

The conflict is caused by:
The user requested urllib3==1.26.5
pyfunceble 2.2.0 depends on urllib3
requests 2.23.0 depends on urllib3!=1.25.0, !=1.25.1, <1.26 and >=1.21.1

Ukraian rules

Hi, pls move .ua domain to separate group, as it's not a Russian domain

Mining zerodot1 - domain "be" vs "www.be"

Hey,

thanks for this tool - it's very helpful.

I've noticed that when I import "mining zerodot1", all traffic to any ".be" website will be blocked. This happens because of the rule Deny outgoing connections to domain be. This matches any website with a top level of .be of course. I've checked the dotzero1 list and the entry there is actually www.be, which is a valid full domain rather than just be.

I assume this may be a bug in the script that generates the rules? Would that be possible?

Links on https://rulegroups.com don't provide proper rule groups format

Hi @naveednajam I was trying to subscribe to some rule groups from you website but when I do that each subscribed rule group has only one rule with all domains in it. And it doesn't block anything.

According to the this page https://help.obdev.at//littlesnitch4/ref-lsrules-file-format you are using

{
  "name": "LaunchBar Software Update",
  "description": "This rule allows LaunchBar to check for updates.",
  "rules": [
    {
      "action": "allow",
      "process": "/Applications/LaunchBar.app/Contents/MacOS/LaunchBar",
      "remote-hosts": "sw-update.obdev.at"
    }
  ]
}

But it says that you will need to provide action, process for each domain.

In your Github repo you use a different approach (which works)

{
    "name": "Social Media Block List",
    "description": "Blocks access to popular social media sites.",
    "denied-remote-domains": ["facebook.com", "twitter.com", "youtube.com"]
}