Wire Goose
Technical questions
Written by the people who built Wire Goose, describing what the code actually does.
Installing and running
Why must Wire Goose be in the Applications folder?
macOS installs a system extension only from there, and the network filter Wire Goose uses for blocking is one. The free build never needs the filter; the question comes up the first time you block something, and the app tells you then.
Will macOS say it cannot check the app for malware?
No. Wire Goose is signed with a Developer ID and notarised by Apple, so it opens like any other app. If you do see that dialog, the download was altered somewhere on the way: get it again from this site.
Does it need admin rights, Full Disk Access, Accessibility, Screen Recording or Location?
None of them. Watching traffic uses nettop, a tool that ships with macOS, and raises no permission dialog at all. Wire Goose never asks for your password.
What does it run on?
macOS 12 or later, on Apple silicon and Intel. One download works on both.
What happens when I close the window?
Recording continues from the menu bar. To stop everything, use Quit in the menu bar icon.
The network filter, for blocking
Why does Wire Goose ask to install a network filter?
Only when you first block an app, and only in Pro. A filter is the one way macOS lets an app stop another app's connections. Until you block something, there is no filter, and nothing to approve.
What do I switch on in System Settings?
General → Login Items & Extensions → Network Extensions → Wire Goose. The app opens that pane for you, and its Settings say what it is waiting for.
Why does macOS then ask whether Wire Goose may filter network content?
That is Apple's own prompt, raised the moment the filter is switched on. Allow it, or nothing is blocked. Wire Goose cannot answer it for you, on purpose.
Why does it say the filter starts after a restart?
macOS sometimes stages a new extension until the next start. Blocking begins after the restart; watching never stopped.
What does the filter see?
Which process opened a connection, and it answers allow or drop. It never reads what is sent: it works on sockets, not packets, and it holds no copy of anything.
Does it keep running after I quit Wire Goose?
Yes. It is a system extension with your block list in it, and it keeps blocking those apps until you turn it off: Settings → Turn the filter off.
How do I remove it?
Turn it off in Settings, then delete the app; macOS removes the extension with it. In Terminal, systemextensionsctl list shows whether it is still there.
Where it looks things up
Where does the server location come from?
A database inside the app, IPinfo Lite, updated with each release. Every lookup happens on your computer; nothing is looked up online.
What is operator jurisdiction?
Where the operator's parent company is based, from a table inside the app. An operator not in the table shows as unmapped. Wire Goose never guesses.
What is Local?
Traffic that never left this computer: a browser talking to a development server, Docker talking to itself. It is never counted as sent or received.
I use a VPN. What does the map show?
The arcs start where the tunnel comes out. The app reads that from the routing table, which names the VPN's server; nothing else changes, and nothing is sent anywhere to find out.
Privacy
Does Wire Goose connect to the internet?
It makes no network connections of its own. Get Pro opens your browser. There is no automatic update: new versions are downloaded from this site.
Where is history kept?
In ~/Library/Application Support/WireGoose, for 7 or 30 days as you choose in Settings. Reset history deletes all of it. Exports go where you say.
Does it follow my appearance settings?
Appearance and Reduce Motion follow System Settings, and change with them.
Updating and removing
How do I update?
Download the new disk image and drag the app over the old one. The filter, if you installed it, is replaced with the app.
How do I remove everything?
Turn the filter off, quit, delete the app, then delete the folder above. Nothing else was written anywhere.
Contact
admin@8thbyte.com.