Skip to content

v1.9.0 — endpoint visibility on macOS

Choose a tag to compare

View all tags
@yo1t yo1t released this 12 Aug 22:09
· 552 commits to main since this release
v1.9.0
e2efa41
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A router shows what left the house but not which application sent it. This release closes that gap.

macOS Agent

egressview-agent-0.1.16.dmg is attached, notarised by Apple. It reports the process behind each outbound connection from a Mac, so a destination you do not recognise arrives with the name of the program that reached for it. Metadata only — never payloads, and it blocks nothing.

A machine becomes an agent only when an administrator approves it: it applies with a six-character code, and the host name in that application is claimed by the client, which the approval screen says plainly. Flows an agent reports are checked against the threat feeds, enriched, and recorded in the Detection Log exactly like flows a router saw.

It requires this release or newer. 1.8.0 has no agent endpoint at all. Install steps are in the agent guide.

An agent covers one Mac, not your network — the router is still what shows you the devices nobody can install software on.

The Detection Log no longer freezes the interface

Selecting a Mac in the Detection Log ran a correlated query with no supporting index. SQLite is synchronous, so that one request held the event loop: the site returned 504s and collection stopped until the process was restarted. The same query now takes about 1.1 seconds instead of over 30, and a watchdog restarts the process if anything else ever holds the loop for two minutes.

Upgrading

This upgrade runs database migrations (schema 12 → 16), unlike 1.8.0. They are append-only and fail-closed: free space is checked, a verified backup is taken, and the resulting database is validated before startup continues. Existing history is preserved. A restart is all that is required.

Full detail in the changelog.

Verifying this release

The archive is signed with the AWS KMS release key egressview-release-2026, whose private half cannot be exported. Verification needs neither an AWS account nor network access — openssl and the published public key are enough:

sha256  626fe1bf0808489d043f2e32e060de7e9de0b9b4fdcfbfdb0643d85a6b62d992
key fp  SHA256:6288265bd746d230a3637e3a520e2335f48dc939a4d76d7b05c44ea5baf3eccc

Compare that fingerprint against release-signing/trusted-fingerprints.json before trusting the archive. Procedure: release signing.

Assets 7
Loading