see which of your apps phone home, for free

your apps are talking behind your back

every laptop you own has apps quietly calling home. some of that is normal, like your calendar syncing or your browser checking for updates. some of it is not normal, like a flashlight app or a pdf reader reaching out to a server in a country you've never been to, at 3am, for no reason anyone can explain. the problem is your mac and your linux box don't tell you any of this by default. no popup, no log you'd ever check, nothing. it just happens silently in the background.

that's what an outbound firewall fixes. it flips the default from "allow everything" to "ask me first." and the best tools that do this cost nothing.

what lulu actually does

lulu is a free, open source outbound firewall for macos made by objective-see, a group that builds mac security tools and gives them away. once it's installed, every time an app on your machine tries to make a new network connection, lulu pops up a little alert showing you which app, which domain or ip, and which port. you get to say allow or block, and you can make that decision permanent for that app.

that's the whole trick. most malware, most sketchy adware, most "free" apps that are quietly selling your data all rely on one thing: you never noticing the connection. lulu makes the connection visible.

installing it

if you have homebrew on your mac, this is a one line install:

brew install --cask lulu

breaking that down:

brew is the homebrew package manager, the thing most mac users already have for installing command line tools and apps without digging through random download sites. install --cask tells homebrew you want a full gui application, not a command line utility. lulu is the name of the app itself.

after it installs, open it from your applications folder, grant it the permissions it asks for (it needs a system extension to actually watch network traffic), and restart if prompted. that's it. no account, no subscription, no ads.

what to expect once it's running

the first day is going to feel like a lot of popups. that's normal and it's actually the point. you'll see your browser connecting to a dozen domains you've never heard of (that's usually ad and analytics trackers embedded in websites, not your browser's fault directly). you'll see your weather app phoning a cdn. you might see something that genuinely surprises you, like a photo editing app trying to reach a marketing server, or a game reaching out while it's not even open.

for each alert, ask two questions: does this app need internet access to do its job, and does this specific destination make sense for that job. a word processor connecting to its own update server, fine. that same word processor connecting to an ad network, block it. a vpn client connecting to random ips you don't recognize, worth investigating before you approve.

run it for about a week before you start locking things down aggressively. you want enough data to tell normal background noise apart from something actually weird.

if you're on linux, not mac

lulu is mac only, but the same category of tool exists on linux: opensnitch. it works on the same principle, application level outbound firewall, popup alerts, allow or deny per connection, and it's also free and open source. installation varies by distro, so check opensnitch's github for the package or install script that matches yours. the workflow once it's running is basically identical to lulu: watch, question, block what doesn't belong.

the takeaway

you don't need an enterprise security budget to see what your own machine is doing on the network. lulu and opensnitch are both free, both maintained, and both do one job really well: turning invisible outbound traffic into something you actually get to approve or deny. install one, let it run for a week, and pay attention to the apps that have no business being online but are online anyway. that's your actual exposure, not theoretical, not hypothetical, sitting right there in the alert log. block it, and you've just closed a door you didn't even know was open.