Newly discovered domains

[yoshimo]

New App versions might introduce new SDKS, new hosts used.
Same for webpages that might connect to a new advertiser or sdk partner.
I think having a learning phase where you whitelist a set of hosts per app would be great.
After that any other target host is blocked by default and has to be accepted manually.

Would also be nice for the statistic if you had a filter "first seen" and "last seen" for domains.
I am not really interested in seeing the same blocked hosts in the protocol over and over again that i already knew about 3 weeks ago.
It's more interesting to discover new things that might not be in any lists so far or interesting for analysis in other ways.
Especially when you can drill down to "show all apps connecting to this host".

[ignoramous]

Hi: Thanks. It isn't clear what Rethink should implement (besides last seen / first seen) for the given usecase. Can you be a bit more specific? Once it is clear, I'll create GitHub issues to then track those feature requests.

[yoshimo]

Once Rethink knows these two things about a host you can do two things.
You can filter the protocol by them so you only see calls where the URL was seen first less than a week ago or any other timeframe. That way usual suspects like Google APIs don't clutter the display.

You can also say, I have vetted the app x and I know what connections it makes and blocked all of the unnecessary ones. Now everything that changed later due to an update is worth an alert.