6-months with Little Snitch 6 — what I learned about how much my Mac talks to the internet

Originally posted on r/macapps.

I’d been hearing about Little Snitch for years at this point. Colleagues swore by it. A couple of friends in security said it was the one paid app on their Mac they’d never give up. This sub mentions it constantly. And I kept putting it off.

The reason was honestly just the price. $59 for a one-time purchase, single device. I’ve bought plenty of paid Mac software before like Bartender, Things, Soulver, the usual, but $59 for one machine felt like a lot for something I wasn’t sure I’d actually use. The free options like Lulu and the built-in firewall seemed "good enough" on paper.

Six months ago I finally decided to check. Writing about it here in case anyone else has been on the fence for the same reason.

Why I finally bought it

A couple of things tipped me over:

• I’d read one too many threads about how chatty modern apps are with telemetry and analytics, and I realized I genuinely had no idea what was leaving my machine.
• I tried Lulu first for about a week. It blocks fine, but it doesn’t show you anything. I wanted visibility, not just a deny list.
• The 30-day demo mode, where it cycles on and off in 3-hour windows, was enough to convince me the alert UX was actually decent and not the clunky popup hell I’d half-expected.

So I bought it.

First night, Adobe Creative Cloud alone tried to phone home to something like 22 different domains in the first 20 minutes. I hadn’t even opened Photoshop. That was the moment I realized why everyone had been telling me to buy this thing.

The first week is rough

Not going to sugarcoat it. The first few days were a mess of popups. Every app I opened wanted to talk to five different servers and I had no idea which ones were legit. Spotify needs to reach its CDN, fine. But why is iStat Menus connecting to an analytics domain in Ireland? Why is my PDF reader checking for updates and sending telemetry and loading fonts from a third-party host?

I almost uninstalled it twice. The cognitive load of "is this connection real or sketchy" on top of actually trying to work was rough.

What saved me:

• I stopped trying to make perfect decisions. If something looked legitimate, like a CDN, official domain, or obvious update server, I allowed it for that app only and moved on.
• I leaned on the Research Assistant feature pretty heavily. It tells you what a domain is for and whether it’s known sketchy.
• I turned on Silent Mode for a couple of evenings while I just watched the Network Monitor and learned what normal looked like.

By the end of week 2 the popup volume had dropped maybe 80%. By week 4 I was getting maybe 2-3 alerts a day, almost always for something new.

What I actually use it for now

Honestly, the popups aren’t even the main value anymore. The Network Monitor is. Being able to open it and see, in real time, every process on my machine and what it’s connecting to is the thing I didn’t know I wanted.

Some specific things I caught or learned:

• A small menu bar utility I’d been using for over a year was reaching out to an analytics endpoint every 15 minutes. Not malicious, just noisy. I blocked it and the app still works fine.
• Adobe is genuinely something else. Even with Creative Cloud signed out, there are background processes that try to reconnect constantly. My deny rules for Adobe alone are probably 30+ entries.
• One of my browsers was making connections I couldn’t explain even with all extensions disabled. It turned out to be a built-in feature I’d never noticed in settings.
• A game I hadn’t opened in 4 months was still checking in daily with its publisher’s telemetry server.

The traffic map and the live connection graph are honestly more useful for vibes than for action. But the DNS encryption and the blocklist subscriptions, I’m running Steven Black’s hosts list through it, are doing real work. According to my stats panel I’m at something like 27,000 blocked connections over 6 months. No idea how meaningful that number actually is, but it’s not zero.

The honest pros and cons

What’s good

• The Network Monitor is genuinely best-in-class. Nothing else on macOS gives you this view.
• Rule management scales reasonably well even with about 800 rules. Search and filtering work.
• It’s stable. In 6 months I’ve had 2 crashes. Performance hit is invisible to me.
• The DNS encryption plus blocklist combo means it’s also doing some of what a Pi-hole would, without the Pi.
• Native feel. It looks and behaves like a Mac app, not an Electron port of a Windows tool.

What’s not

• The price still stings a little. $59 single-device is on the high end for one-time Mac software, especially if you have multiple machines. The family and multi-device pricing helps but it’s still not cheap.
• The learning curve is real. If you don’t enjoy thinking about networking even a little, you’ll bounce off it.
• Rule sprawl is a thing. After 6 months my rule list is genuinely hard to audit. I’ve started over once.
• Alerts during screen sharing or presentations are awkward. Silent Mode helps but you have to remember to flip it.
• Occasional false positives where I block something and an app starts misbehaving in non-obvious ways. Tracking that down took me a couple of hours more than once.

Edge cases worth flagging

A few things that took me a while to figure out:

• Battery impact is basically nothing I can measure. Older Intel Macs apparently see more of a hit from what I’ve read.
• Major macOS updates can break things briefly. The Sequoia 15.1 update needed a reinstall of the kernel-level component for me. It took 5 minutes but caught me off guard.
• iCloud-related connections are a rabbit hole. Block the wrong one and Calendar sync silently fails for a day before you notice.
• VPN interactions matter. Mullvad needed some specific allow rules before it would route correctly.

What about Lulu / Radio Silence / built-in firewall?

Like I said, I tried Lulu for about a week before paying for Little Snitch. It’s free, it’s open source, and the developer is great. For pure outbound blocking it works. What it doesn’t have is the Network Monitor depth, the traffic map, the connection history, or the same rule management. If you mainly want a "block this thing forever" tool and don’t care about visibility, Lulu is genuinely fine and you should try it first. You might not need to spend the $59.

Radio Silence is even simpler. It’s basically a deny list. Cheaper, easier, way less powerful.

The built-in macOS firewall doesn’t do outbound at all. It’s not in the same category.

So for me, Little Snitch earned the price by being the only one with the monitoring layer. If I just wanted blocking, I’d be on Lulu and $59 richer.

Was the price worth it?

Six months in, yes. I’d buy it again. The thing that finally justified the cost in my head wasn’t any single feature. It was that I now actually understand what’s running on my machine. That’s not a thing I can get from a free tool.

That said, I want to be fair: if you’re someone who’s going to install it, click "allow" on everything, and never open the Network Monitor, don’t pay for this. You’re paying for visibility and control, and visibility only matters if you’re going to look. Lulu plus a decent blocklist is a better deal for that crowd.

Not affiliated with Objective Development. Paid full price. No referral.