It may be a great idea in principle, but the reality is that it just constantly [and I mean CONSTANTLY!] throws dialogues in your face, asking you to approve/disapprove this that or the other. So much so that it just becomes an irritation.
I expected and accepted this during the learning period [I've been using LittleSnitch for years, so was prepared for this at the outset]. But even, after that was over and Little Flocker had created and imported its dozens of initial rules, I just kept seeing the pop-ups, over and over and over again.
There are a couple of major problems:
1: The choices made for rules, don't seem to work reliably. For example:
* I allow an app access 'forever' to any file in my '~/myusername/' directory. Then, a couple of seconds later it asks me again for access to ~/myusername/somesubdirectory and ~/myusername/someothersubdirectory...etc * I allow an app access 'forever' to some directory and then I get an alert telling me that some sub-process of that app wants access to the directory... then some other sub-process... etc. * I allow some app access to a directory 'forever' and then the next time I launch it, it asks for access again. The first couple of times this happened, I thought maybe I'd forgotten to select 'forever', but it continued to happen, even after I'd definitely made sure 'forever' was selected.
2: It's not possible to micromanage the number of system processes in a modern OS effectively.
There are literally dozens of cryptically named system processes which trigger alerts continually, even when you're doing the most innocuous thing like trying to open a file, or navigate to a directory in Finder. You get alert after alert asking permission to allow this or that daemon to view this or that file.
Naively, I'd expected that giving Finder permission to view any file forever would allow freedom to transverse the filesystem. But there are all these hanger-on processes like quicklook, icloud, spotlight and god knows whatever else, which are piggy-backing along for the ride and which all need to be given/denied individual permissions.
Multiply this by the number of apps you've got which provide Open/Save dialogues and it pretty quickly becomes unmanageable. In the end I was just clicking "Allow Forever" on everything that popped up, just so I could get the effing wall of dialogues out of the way and let me return to the task that should have taken a couple of seconds to complete.
It was after a week of this, with very little "easing off" of the amount of dialogues I was having to wade through that I decided enough was enough and uninstalled Little Flocker. There's a pain point beyond which the supposed security gains are just not worth the amount of hassle involved. LittleSnitch just about treads the right side of this line most of the time, but Little Flocker [in its current guise] is just way too much hassle.
I still think it's a worthwhile idea and will probably re-visit Little Flocker in the future, if these early niggles get ironed out. I also think it might be more tolerable to use, if you've got a fairly run-of-the-mill office work setup and spend most of your time using one or two apps and reading/writing files from one or two directories. For someone like me though, who does coding, graphics, command line stuff and spends a fair amount of time connecting to servers and other mounted resources, it's not workable, at the moment.
