Why a firewall should fail open, not closed

There’s a quiet design decision buried in every outbound firewall: what happens when the rule engine itself isn’t available? The lazy answer is to block everything until the daemon is back. The humane answer — and the one the good Mac tools have converged on — is to fail open: if the thing that decides is down, don’t punish the user by severing their network.

We think about this a lot. A privacy tool that bricks your connection the moment it hiccups isn’t protecting you; it’s holding your machine hostage to its own uptime. The whole point is to sit quietly between you and the network and get out of the way when it can’t do its job well.

More on how we’re thinking about this as we build.