# telltale
Telltale is an ask-first application firewall, in the spirit of Little Snitch but for Linux and Android. When an app opens a connection Telltale hasn’t seen before, the connection waits while you decide: allow or deny, for this destination or anywhere, for one connection, an hour, or for good. Nothing is ever denied behind your back, and rules belong to the verified app rather than to its name — so another app reusing the same package or binary doesn’t inherit them.
There is a GNOME desktop app and an Android app, and they share one Rust policy engine so rules, profiles and routes behave the same way underneath. Each platform enforces with what it has: the Linux daemon gates outbound TCP and UDP with nftables, NFQUEUE and eBPF, tying each connection to a verified application with a kernel socket proof, including browser helpers, Electron apps and Flatpaks. On Android a local VPN does the job, no root required.
The part that makes it more than a prompt machine: a route per app. Send an app through an imported WireGuard tunnel or through Tor, with .onion support via an embedded Arti client. Apps you allow can also reach a Tailnet through the embedded Tailscale node. Routed traffic blocks instead of leaking when its tunnel is down. On top of that come blocklists from a catalog or your own URLs, DNS over TLS so lookups don’t leave in the clear, per-app traffic history with charts in a local SQLite database — no external IP lookups, ever — and independent rule profiles for home, travel or work that can switch automatically per network.
Be honest with yourself before enabling enforcement: the desktop daemon fails closed, which means stopping or crashing it keeps the gate shut, and a firewall that fails closed can cut off your network. Enforcement needs a recent kernel with an active BPF LSM, and there are documented coverage limits — it does not protect other users, containers, or traffic hidden behind proxies and Unix IPC. Keep a local terminal available and read the validation notes first.
The GNOME app ships as an Arch package via a one-line installer, Android APKs are published with releases, and the source lives on the forge. Source available, not open source licensed — read it, don’t redistribute it.
~$