Software Updates

Little Snitch runs a system daemon and loads an eBPF kernel program. Although the code has been designed for security and has gone through security reviews by humans and by AI, it may contain vulnerabilities which have not yet been discovered. Staying up to date is therefore important.

How the update check works

Little Snitch performs a regular version check. This is a check only, not an automatic update: when a new version becomes available, a banner appears in the UI linking to the download and the release notes. Downloading and installing is up to you, and you can also simply skip an upgrade.

Why no package repository (an APT source or similar) for fully automatic updates? Adding our repository would require you to trust our signing key, which effectively allows us to administer your machine. We do not want to bear that responsibility.

What data is sent

The update check fetches a plain text file from a fixed URL. No data beyond standard HTTP headers is sent with this request.

The download link shown in the update banner includes:

your CPU architecture and whether you run a statically linked binary, used to narrow down the downloads offered to you, and
your currently installed version, used to show the release notes of all versions since the one you have.

Which of this information is included in the link can be configured.

Configuring or disabling the check

The update check is controlled by software_update.toml. Configurable are, among other things:

Disabling the check entirely. The quickest way is to create an empty file at:
```
/var/lib/littlesnitch/override/config/software_update.toml
```
If you disable the check, stay up to date by monitoring the download page or subscribing to the releases feed of the GitHub repository.
Separate "current version" URLs for the stable and prerelease channels.
The download link and which information is embedded in it.

The exact options are documented in the factory software_update.toml file.