Update, July 2026. dns0.eu, the European encrypted DNS resolver that Little Snitch offered as a preset, shut down at the end of May 2026 (insufficient resources). Little Snitch switched to DNS4EU, and this article follows suit, now pointing you to DNS4EU or Quad9.

Update, July 2, 2026. Little Snitch has moved to version 6.4.1 (June 2026): Touch ID unlock for settings, copy rules between profiles with drag and drop, hourly updates for block lists. Version 6.4.1 fixes rejection of old licenses. The comparison verdict remains unchanged, with the referenced versions below being up-to-date.

Introduction

While you’re reading this article, your Mac is talking. To forty-seven servers, without asking for your opinion. Apple iCloud, Adobe, Microsoft Telemetry, the weather app that wakes up a CDN in Singapore, the Solitaire game that posts your scores to an editor you don’t know.

No one, or almost no one, looks at the network output of their data.

That’s where the outgoing firewall on Mac comes into play. Not the integrated ALF (Application Firewall, which only filters incoming), not pf (powerful but blind to process). A real outgoing firewall process-aware that says “such a binary is trying to connect to such a domain, do you allow it?”. On macOS, two tools dominate: Little Snitch (paid, closed-source, Austrian) and LuLu (free, open-source, American, signed by Patrick Wardle).

Read also: The macOS privacy settings to change in 15 minutes

Why an outgoing firewall process-aware

Outgoing firewall in two sentences. A software that intercepts outgoing connections from your apps before they go to the internet and asks “do I allow or block it?”. An incoming firewall does the opposite, filtering what comes in from the network. Little Snitch and LuLu play on the outgoing side only, that’s their job.

macOS natively provides two layers of security. ALF (Application Layer Firewall) filters incoming connections. XProtect and MRT scan binaries known to be malicious. That’s what you get out-of-the-box.

If you want more serious protection, you can pile on more on top: Santa (NorthPoleSec, OSS) to block unwhitelisted executables, Wazuh to send events to a SIEM, and precisely what this article is about, an outgoing firewall process-aware. All these layers, native or added on, do what they’re supposed to do, complementing each other.

An app can be signed, validated by Apple, run by a legitimate user, and send your address book to a third-party server. ALF sees nothing (it’s outgoing). Santa sees nothing (the binary is allowed to run). XProtect sees nothing (the binary isn’t in the malware database). That’s exactly what an outgoing firewall process-aware is for: filling that gap. Filtering not by IP address, but by process and destination, with an allow/drop verdict per connection.

On macOS, since Big Sur, these tools use the Apple NEFilterDataProvider framework (Network Extension). No more kernel extensions to load, no more risk of kernel panic linked to a third-party kext. Apple maintains the network path, the third-party tool just renders a verdict.

The protagonists

Little Snitch 6.4.1

Developed by Objective Development Software GmbH, in Vienna, Austria, since 2003. Twenty-two years old, stable team, no takeover, no pivot. Perpetual license, proprietary closed-source. One known security incident (code-signing flaw in 2018, fixed before public disclosure by Patrick Wardle). Since version 5 (2020), no more kernel extensions, only Network Extension Apple. Current version: 6.4.1, released on June 22, 2026, supports macOS Sonoma, Sequoia, and Tahoe. UI in English and German. No French.

LuLu 4.3.2

Developed by Patrick Wardle, founder of Objective-See (USA), since 2017. Wardle is a global security Mac reference: ex-NSA, creator of the Mac Malware Project, regular speaker at Black Hat, DEFCON, and Objective by the Sea. Open source, GPL-3.0, public sources on GitHub, compilable binary. 100% free model, funded by donations via Patreon (no freemium, no tiered pricing). Current version: 4.3.2, released on May 3, 2026. Supports macOS 10.15+, Tahoe included since version 4.0. UI mainly in English.

What they do, what they don’t do

Little Snitch (left) and LuLu (right) prompts. Official captures from obdev.at and objective-see.org. © Objective Development and © Objective-See, GPL-3.0.

Shared core product. Both are outgoing firewalls process-aware built on the same Apple NEFilterDataProvider framework, so the network path is dictated by macOS, not the editor. Reference versions here: Little Snitch 6.4.1 (released on June 22, 2026, first macOS Tahoe 26 supported since version 6.3) and LuLu 4.3.2 (released on May 3, 2026, GPL-3.0). Native Apple Silicon on both sides.

Rule granularity. Little Snitch lets you target by process, domain, port, protocol, network interface, time, and profile. LuLu lets you target by process, domain or IP, scope (specific process or global), and duration. The difference isn’t cosmetic: allowing Spotify between 8 am and 10 pm, on a specific port, or on a dedicated profile for the train, that’s Little Snitch only.

Network profiles. LS automatically switches to the Wi-Fi SSID or interface (trusted vs public network, adapted VPN profile). That’s the nomadic MacBook user’s argument that has no equivalent. LuLu has profiles since version 4.0, but the switch is manual. You choose before connecting, or you’ve forgotten.

Integrated encrypted DNS. LS offers DoH, DoT, DoQ to Quad9, Cloudflare, DNS4EU, Google (you get the idea, it’s not the MS choice), as an option directly in the app’s settings. You no longer need a separate system profile for encrypted DNS. LuLu has a basic toggle “Allow DNS Traffic” on UDP:53, encrypted DNS isn’t its problem, you handle it upstream (dnscrypt-proxy, AdGuard, etc.). And beware of the Network Extension conflict described below.

Wildcard DNS and the Chrome trap. LS handles CDN reroutings like Akamai or iCloud without breaking rules, because it does wildcard resolution on the domain side. LuLu doesn’t have wildcard hostname support (GitHub issue #379, requested for a long time, not implemented). The consequence is serious on the Chrome side: Chrome doesn’t use Apple’s Network.framework for DNS resolutions, so with LuLu, hostname blocking is ineffective on Chrome, fallback IP-only only (issue #410). If you live in Chrome, that’s a major limitation that’s little known.

Live Network Monitor and Research Assistant. LS has a real-time network map, a 5-minute traffic graph, a connection inspector per connection, and a Research Assistant that tells you what the community has already judged for that process (reduces whitelist fatigue). LuLu has Netiquette as a separate tool, not integrated into the prompt. No community reputation base.

Little details that add up. LS has a silent mode (auto-allow or auto-deny during a meeting or presentation), built-in blocklists (trackers, ads, malware, daily updates), configurable acoustic notifications per rule, bidirectional rules since LS 6, binary identification by code signature (resists replacement by a false binary at the same path), and usage statistics per rule.

LuLu doesn’t have silent mode (GitHub issue #540), no built-in blocklists, no sounds, no bidir (outgoing only by design), identifies the process by path (more fragile), and doesn’t store stats.

CLI and automation. LS offers a mature CLI littlesnitch with export-model, restore-model, diagnostics, switch-profile, write-rules. You can backup your rules model, version it, and restore it on another Mac (with user mapping if different and Keychain password if export is encrypted). Native JSON on the backup side, .lsrules JSON on the subscription rule set side, both Git-friendly.

LuLu doesn’t have an official CLI. The rule format is a fragile binary plist, user rule export exists since version 4.2.1 but remains less standardized. For a fleet of several Macs managed with infrastructure-as-code, the gap is direct.

Logs and SIEM. LS writes to a at.obdev.littlesnitch subsystem (macOS unified log), plus a local SQLite DB exploitable, plus a Wazuh decoder own decoder. LuLu writes to os_log without a documented subsystem, so tailing Wazuh on the manager side requires more regex and less structure. If you send your events to a SIEM (Wazuh, Splunk, Elastic), LS gives you proper material, LuLu gives you best effort.

Common macOS limitation. Only one active filtering provider at a time on the system. Activating LS, or LuLu, or a third-party encrypted DNS profile (NextDNS for example), not the three. That’s an Apple limitation, not a product flaw. LS works around it by integrating its encrypted DNS. LuLu doesn’t.

Release cycles. LS is regular, 6.3.1, 6.3.2, 6.3.3 in September-November 2025 then 6.4 and 6.4.1 in June 2026, stable team since 22 years. LuLu is more erratic, 4.2.0 in October 2023, 4.3.0 in March 2026, 4.3.2 in May 2026, project maintained on the available time of Wardle and the Objective-See foundation. Neither has French UI.

Score: Little Snitch covers about 22 complete features out of 24 checked. LuLu covers about 10 complete features, 5 partial features, 9 missing features.

The gap is clear. And it won’t close with the next LuLu release: some absences (CLI, encrypted DNS, integrated Network Monitor) are architectural choices, not oversights.

Sovereignty: LuLu wins

This is the most misunderstood point in the French debate, so let’s be direct.

LuLu is more sovereign than Little Snitch. Period.

Why? Three reasons that pile up.

1. LuLu is open source GPL-3.0. The entire code is on GitHub. You can read it, audit it, compile it yourself, fork it. No backdoor can be inserted without leaving a public trace. No editor kill-switch possible without a researcher noticing. No hidden telemetry holds up against a grep on the sources. That’s the verifiable trust model, not the delegated trust model.

2. Little Snitch is proprietary closed-source. The Viennese editor could be impeccable (and it is, for 22 years), you have no way to verify it other than delegating trust. Apple’s signature guarantees that the binary comes from Objective Development. It doesn’t guarantee anything about what that binary does. No formal independent audit has been published on Little Snitch (nor on LuLu, for that matter). On the rigor formality, the two tools are at the same level: zero published audit.

3. The “Wardle is American so US jurisdiction” argument doesn’t hold. An argument has been circulating since the release of the free Linux version of Little Snitch in 2025, especially on the marketing side of obdev: LuLu is American, so less sovereign than LS which is Viennese. That’s false, or at best misleading. For a simple reason: LuLu’s code is public, GPL-3.0, compilable locally. No US injunction can force Wardle to insert a backdoor without the community noticing in the next commit. The binary you compile from your local sources has no more jurisdictional link with Wardle. That’s precisely what open source auditable prevents: undetectable jurisdictional takeover. Meanwhile, Little Snitch remains closed-source on the EU side, so the sovereignty argument reverses literally when you look at audibility rather than the headquarters jurisdiction.

And Wardle isn’t just anyone. Ex-NSA, founder of Objective-See, creator of the Mac Malware Project, regular speaker at Black Hat and DEFCON, organizer of Objective by the Sea. His research has documented several bypasses of macOS firewalls (BlackHat 2018), which directly nourishes the defense of his own product. On the outgoing firewall Mac layer, that’s an authority.

Sovereignty verdict: LuLu, no debate. If sovereignty is your absolute criterion, the arbitration is trivial. If someone sells you Little Snitch as “more sovereign because EU editor”, they’re confusing jurisdictional sovereignty (true for other layers: Proton, DNS4EU) and audibility (the real question on code that inspects your traffic).

LuLu rules window, official capture from objective-see.org. © Objective-See, GPL-3.0.

Functionality: Little Snitch wins

On the other axis, the gap is just as clear, but in the other direction.

Five features tip the choice as soon as you go beyond “I just want an app to stop phoning home”.

1. Automatic network profile switch on SSID. You’re at home on your Wi-Fi: permissive rules. You push your MacBook onto a café’s Wi-Fi: strict rules (blocklist trackers activated, forced encrypted DNS, restricted business apps). You’re at the office: pro profile that allows internal tools. Little Snitch automatically switches to the SSID. LuLu has profiles, but the switch remains manual. For a nomadic MacBook user, that’s a point to consider.

2. Integrated encrypted DNS. DoH, DoT, DoQ to Quad9, Cloudflare, DNS4EU, Google (you get the idea, it’s not the MS choice), as an option directly in the app’s settings. LuLu has a basic toggle “Allow DNS Traffic” on UDP:53, encrypted DNS isn’t its problem, you handle it upstream (dnscrypt-proxy, AdGuard, etc.). And beware of the Network Extension conflict described below.

3. Mature wildcard hostname. iCloud, Akamai, Adobe, and most modern CDNs constantly rotate their IPs. An “allow *.icloud.com” rule holds up. An “allow 17.X.X.X” rule breaks at the first rotation. Little Snitch handles wildcards properly. LuLu doesn’t (GitHub issue #379, not implemented). And on Chrome, which doesn’t use Apple’s native network framework, LuLu falls back to IP-only filtering, which means your hostname blocking no longer works at all on Chrome (issue #410). That’s a major limitation that’s little known.

Little Snitch Network Monitor, official capture from obdev.at. © Objective Development.

4. Real-time Network Monitor. During the whitelist phase, or during an audit, you want to see the live traffic: who’s talking to whom, what volume, what geographic destination. Little Snitch has a live map and a 5-minute graph integrated into the app. LuLu offers Netiquette, an Objective-See tool that you have to launch separately. It’s OSS and it does the job, but it’s less fluid.

5. Scriptable CLI for the fleet. That’s the point that tips the scale as soon as you have more than two Macs to manage. Little Snitch exposes a littlesnitch binary that knows how to do export-model (backup JSON of the rules model), restore-model (restore from JSON file, with user ID mapping and Keychain password if export is encrypted), diagnostics, switch-profile, write-rules. The real-world workflow on a fleet looks like this: ssh mac-source littlesnitch export-model > rules.json on the reference Mac, you commit rules.json to a Git repo, and on each target Mac you do scp rules.json mac-target: then littlesnitch restore-model -m oldUID>newUID rules.json. Not a one-liner magic pipe stdin, but versioned, diff proper, code review possible. LuLu doesn’t have an official CLI. To push rules, you copy a fragile binary plist, which changes format between versions, without any guarantee of reproducibility.

Functionality verdict: Little Snitch, no debate. If you want the maximum granularity, nomadic profiles, scriptable fleet, and proper SIEM integration, the arbitration is quick.

Common limitations (that no one else tells you about)

Before you decide, four limitations that apply to both tools. Honest radicalism, we don’t pretend.

1. Apple apps that bypass Network Extensions. Since Big Sur, Apple has a whitelist of system apps exempted from any third-party NEFilterDataProvider filtering. Apple Mail, App Store, some iCloud services bypass Little Snitch like they bypass LuLu. Neither sees 100% of Apple’s native traffic. That’s not a product flaw, it’s Apple’s decision, and it’s documented (Michael Tsai 2020).

2. Network Extension conflict. macOS only allows one active filtering provider at a time. You activate Little Snitch, or LuLu, or a third-party encrypted DNS profile (NextDNS, DNS4EU), not the three. That’s a platform limitation, not a product flaw.

3. No formal independent audit. Neither Little Snitch nor LuLu has had a published third-party audit type Cure53, Trail of Bits, or ANSSI/CSPN. That’s a limitation to know. On the LuLu side, open source GPL-3.0 compensates (continuous community audit). On the Little Snitch side, the 22-year track record without a major incident partially compensates (one known code-signing vuln in 2018, fixed before public disclosure). But on the formal rigor, the two tools are at the same level: zero published audit.

4. The whitelist phase is a hidden cost. During the first days of use, you’ll be prompted every two minutes. Your OS, your apps, your antivirus, your backup, your mail client, each wants to join something. Budget one to two weeks of serious friction before your rules model is stable. That’s true with both tools. If you’re not patient, disable rather than authorize everything without looking (auto-allow by default breaks the very purpose of the tool).

How much it really costs

LuLu is zero euros. No freemium, no tiered pricing, donations via Patreon optional. If you want to support Wardle and the Objective-See foundation, do it. It’s not mandatory to use the product.

Little Snitch is more subtle. The public obdev.at grid, last verified on May 5, 2026, offers five pricing options. The Single License at €59 for one Mac. The Family License at €115, on which obdev doesn’t specify how many Macs are covered on the order page, so clarify with support before purchasing. The Multi License explicitly, 5 Macs at €239 (around €48 per Mac) or 10 Macs at €419 (around €42 per Mac). And the Snitch Bundle (Little Snitch + Micro Snitch, the microphone/camera control of the same editor) at €63.49 for one Mac.

Perpetual license, no subscription. Major upgrade (5 → 6 for example) = reduced price upgrade. Over time, you pay once, use until the next major version.

For a fleet of 5 Macs in Multi License, the real cost is around €48 per Mac, perpetual license. For 10 Macs, around €42 per Mac. That’s a calculation no one makes, but it changes the comparison with the “€59 per Mac” cited everywhere.

Verdict on two axes

No unique winner. Two axes, two winners, a choice that depends on your priority criterion.

If sovereignty is your absolute criterion: LuLu.
Open source GPL-3.0, verifiable code, binary compilable locally, author of reference security Mac. No undetectable jurisdictional takeover. Free. You accept in exchange a lower granularity, no automatic profiles, no integrated encrypted DNS, no CLI fleet. For a single Mac, personal use, basic process blocking, that’s more than sufficient.

If rich functionality is your absolute criterion: Little Snitch.
Automatic SSID profile switch, integrated encrypted DNS, mature wildcard hostname, real-time Network Monitor, scriptable CLI, proper SIEM integration. You accept in exchange proprietary closed-source (with a Viennese editor stable for 22 years, but not auditable), a cost license (around €42 to €48 per Mac depending on the pack), no French UI. For a nomadic MacBook user, fleet management, or serious SIEM integration, that’s the tool.

Neither is “better in the absolute”. They answer two different questions.

And if you’re still undecided: start with LuLu. Free, OSS, two clicks to install. If after two months you feel the granularity is lacking, the wildcard is frustrating, or the fleet scripting is a chore, switch to Little Snitch with knowledge of cause. The opposite (starting with LS paid and descending to LuLu) costs €59 more for nothing.

No affiliation with Objective Development, no commercial link with Objective-See. This article does not earn any money on Little Snitch purchases.

See also

• The macOS privacy settings to change in 15 minutes
• Apple Silicon and Secure Enclave: what your Mac really protects
• Digital sovereignty in practice
• Email security and mail client on Mac

Sources

The editors themselves

• Objective Development (obdev.at), the Austrian company developing Little Snitch since 2003: product page, release notes, press releases
• Objective-See (objective-see.org), Wardle’s foundation publishing LuLu freely

The code and the technical documentation

• LuLu’s source code on GitHub, freely readable, with public discussions between the author and users (bugs, limitations: #280, #379, #410)
• Apple’s documentation on NEFilterDataProvider, the interface both tools use since Apple closed the old method in 2019

Independent analyses

• MacGeneration, French reference site on the Apple ecosystem, for the review of Little Snitch 6
• Howard Oakley (The Eclectic Light Company), British engineer who dissects macOS internals, to understand how these firewalls integrate into the system
• Patrick Wardle himself, for the announcement of LuLu v4 on his Patreon (2025) where he documents the complete refactoring of the firewall