What exactly is the use case of such an application firewall?
I mean I get what it is supposed to do, but if I already have a means of blocking certain spam/telemetry URLs that I don't want (via etc/hosts, or PiHole), is there any real benefit of using an application firewall on top?
As others have said, micro-managing all these connections is not really feasible in most cases. And if I have a domain I don't trust, I can just globally block that.
What are some real-world use-case scenarios of a domain that I want to block for one application, but not generally for all applications? It sounds cool in theory to be able to fine-tune all that on an application basis, but is this actually useful/sensible in practice?
For example I have allowed only my mail servers for Thunderbird. And then I have discovered that Thunderbird sends filenames and SHA-256 hashes of all received email attachments to Google (browser.safebrowsing.downloads.remote.url, https://brmlab.cz/project/spyzilla#thunderbird) and that it sends telemetry saying "you have disabled telemetry" when you disable telemetry.
It also allows you to deny all internet access per-app. For example, should there be an exploit for a MP3 parser in Audacity (presume that Audacity has no use for internet normally -- at least that's my use case), it will probably try to download a second stage from the internet, and you want to block this. Unfortunately, OpenSnitch probably cannot detect "Audacity has spawned wget and you have allowed wget, but only as a child of bash in your terminal launched from your DE startup script, not as a child of Audacity".
As another real-life example, I have discovered that Stardict scans clipboard by default and tries to translate what it finds there using an online dictionary. This includes passwords in your clipboard. https://jenda.hrach.eu/w/et#stardict (the linked page contains several other less severe examples discovered about 2014-2016; I'm not in infosec anymore, so I'm not looking for this that much)
Again, the key is block vs allow by default, not whether it's per application.
But yes there's real world use cases for per application filtering -- you want Facebook messenger to reach Facebook.com but probably not any other applications.
Ah, but if I use the FB messenger, I probably trust FB enough that I also regularly visit/use it in my browser, and probably even use it to authorize other apps and services through it... So I'll have to unblock every app that uses FB services anyways.
And FB's trackers and ad-services and other privacy-invading stuff is all on different sub-domains that PiHole or any other "generic" firewall blocks anyways, so again I'm fine without application-level firewalling
> Ah, but if I use the FB messenger, I probably trust FB enough that I also regularly […]
Except if someone sends you a specially crafted message that causes an exploit to be triggered which could contact some other site to download malware on your system.
I mean I get what it is supposed to do, but if I already have a means of blocking certain spam/telemetry URLs that I don't want (via etc/hosts, or PiHole), is there any real benefit of using an application firewall on top?
As others have said, micro-managing all these connections is not really feasible in most cases. And if I have a domain I don't trust, I can just globally block that.
What are some real-world use-case scenarios of a domain that I want to block for one application, but not generally for all applications? It sounds cool in theory to be able to fine-tune all that on an application basis, but is this actually useful/sensible in practice?