How Bytesnare works

One portable core, thin native sensors, and a strict rule about which of them is allowed to be clever.

The clever part runs where a mistake is survivable

The pieces of Bytesnare that run with system privilege do as little as possible: they report what happened and apply decisions made elsewhere. Anything needing judgement runs as an ordinary program, where a mistake costs you a crashed helper rather than a crashed machine.

Watching and blocking are separate

Watching is allowed to fall behind, and when it does it tells you how far. Blocking is not: it answers immediately, on your machine, without waiting for anything on a network. Running the two together would ruin one of them.

It decides before it uploads

Bytesnare works out what it thinks and writes it down locally first. Only then does it decide what to send. What you choose not to upload is still on your machine, and a filter can change what leaves without changing what was found.

It knows how sure it is about a program

Where Bytesnare watched a program start, it knows what that program is. Where it arrived after the fact, it says the identity is a reconstruction. Where it can only guess, it says so — and refuses to act on a guess.

Detection is a signed download, not a lookup service

Bytesnare checks against a signed set of indicators and rules held on your own machine, verified before it is used. Nothing is asked of a server while a decision is being made, because a check that needs a server is a check that fails when the server cannot be reached — which is the moment it was supposed to earn its place.

With nothing loaded it says so rather than claiming to work, and it keeps what it could not check separate from what it checked and cleared.