Little Snitch has been useful to get a better handle on all the connections my computer tries to make. It's main dialog to allow or deny connections allows customizing (e.g. require specific port, or allow all connections, etc.) but it has no option to allow *.domain.com. This is possible by manually editing the created rules, which is inconvenient, but it makes me wonder when this should and should not be a concern. That is, based on my naive logic:

If I trust apple.com (to the extent I trust they are not grabbing personal data that I have not agreed to), then is there any reason I should trust foo.apple.com any less? My assumption is that all such subdomains are under the control of Apple, Inc, that owns the domain name, so are all equally trustworthy (again, in terms of not hacking my personal data).

Id like to be able to reduce rules to *.apple.com, *.google.com, etc. Rather than have hundreds of subdomains.

Same logic for non-standard ports to a trusted domain.

One exploit I could imagine would be a malicious program sending data to www.apple.com (say) that is not actually meant for Apple's servers, and then external parties intercepting that data. This could include data encrypted with 3rd party keys, such that neither me nor Apple could ever determine what that data is. But such an exploit would seem virtually impossible to prevent or even detect using any of the tools at my disposal... Right? And yet, also doesn't seem particularly difficult for attackers to implement.

1 Answer 1


If you're concerned about malware you should note that subdomains of apple.com or google.com allow running a malware command & control (C&C). For example malware could encrypt and post your data to a discussions.apple.com post. Previously, malware has used Google Docs as C&C. This is however not very common for typical malware, thus the answer to your question depends on whether you're trying to protect against non-common, eventually targeted, malware -- if that's the case you shouldn't whitelist *.example.com.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .