Notifications settings

The Notifications page has fifteen switches, one for each kind of notice, plus the Rule Sounds control, in three groups: Protection, Rules & Blocklists, and Activity. macOS still has to allow notifications for Outbound. The first time an approval or an operational problem is posted, Outbound asks. The other kinds are posted only when that permission is already allowed or provisional. Sound on a notice is the system default sound, and only while “Play sounds when you allow or block” is on, on General.

The kinds

Group	Switch	Default
Protection	Approval needed	On
Protection	Show a notification when an answer cannot be applied	On
Protection	Operational problems	On
Protection	Security events	On
Protection	Connections blocked during a macOS update	On
Rules & Blocklists	Rule activity	On
Rules & Blocklists	Rule Sounds	On
Rules & Blocklists	Rules set to notify	On
Rules & Blocklists	Profile changed automatically	On
Rules & Blocklists	Blocklist or rule group updated	Off
Rules & Blocklists	Blocklist or rule group update failed	On
Rules & Blocklists	Connections waiting in Review	On
Activity	Heavy telemetry	On
Activity	New countries	On
Activity	New trackers	On
Activity	Upload spikes	On

Rule Sounds turns sounds on and off rather than a notice, and has its own menu; it is described below.

Under Upload spikes, Upload spike sensitivity chooses Low (10×) (the default), Normal (5×) or High (3×). The text under it: “Warns above 50 MB/hour and this multiple; never blocks; Expected mutes for 7 days.” It is dimmed while Upload spikes is off.

The footer under Activity: “Heavy telemetry: once a day per app. New countries: after a week of learning, up to five a day. New trackers: up to three a day, never during a Focus.”

Example data.

A few behaviours the switches do not spell out:

• Rule activity posts “A rule expired” when a rule that was in effect runs out. Rules already expired when Outbound launches are not announced. When you answer all of an app’s waiting requests at once, it posts one notice with Show Rule. A single answer in an alert posts nothing: the alert closing is the confirmation. An automatic answer, when an alert times out, posts nothing either.
• Show a notification when an answer cannot be applied, in the Protection section, posts “Answers are waiting for the filter” once when the filter has not taken your answers within a minute, because it is reconnecting. Open Outbound opens the Overview.
• Rules set to notify covers the rules you set to post a notification in the rule editor (Editing a rule). The notice is “A rule blocked a connection” or “A rule allowed a connection”, with the app and server. A busy rule posts at most one notice in a while and then adds “N more connections since the last notice.” Show Rule opens the rule. Turning the switch off silences every such rule at once; each rule keeps its own setting.
• Rule Sounds plays the sound a rule is set to play when it decides a connection. Its menu has Mute for 1 Hour, and Resume Rule Sounds while muted; the page then says “Muted until” a time. A busy rule plays its sound at most once in a while.
• A connection blocked during a macOS update is announced only when the block was unanswered (the filter recorded a timeout deny) while an update was really installing. The title is “Connection blocked during a macOS update”. A block from your own rule during an update is not announced as an update block.
• Review batches its notices: at most one every ten minutes. The title is “Connections waiting in Review”. One connection: “1 new connection is waiting for you to review.” More than one: the count, then “new connections are waiting for you to review.” Connections that arrive during the quiet window join the next notice.
• A kind that is off still marks its events seen. Turning it on later does not replay what happened while it was off.
• Heavy telemetry is at most one notice per app per day.

What clicking a notice does

The buttons in this table open a place in Outbound.

Kind	Button	Opens
Approval needed	Review…	Overview. Approving the change still needs Touch ID in the app.
Operational problems	Show Details	Overview
Security events	Show Rules	The rule in Rules. Titles include “A program changed” and “Look-alike domain”.
Rule activity	Show Rule	The rule in Rules
Profile changed automatically	Show Profiles	Profiles. The notice is “Profile changed”, and the body names the profile and the network. A switch you made yourself is not announced.
Blocklist or rule group updated	none	Clicking the notice opens Blocklists. A success that did not change the list is not announced.
Blocklist or rule group update failed	Show Blocklists	Blocklists. The title is “Blocklist update failed” or “Rule group update failed”.
Connections waiting in Review	Review Now	Review
Connections blocked during a macOS update	Show Rules	The rule in Rules

A successful list update’s title is “Blocklist updated” or “Rule group updated”, with the list’s name and rule count. A proposed rule group says it has entries ready to review.

Heavy telemetry has three buttons. Turn Off Telemetry stops that app’s telemetry being counted, and Don’t Warn for This App silences the daily warning for that app. Both act from the notification, without opening a window, when the notice carries a signing ID. With no signing ID they take the Show path. Show, and a click on the notice itself, opens that app’s Telemetry sheet, or Settings › Telemetry when the notice has neither a team ID nor a path. Telemetry is described in Trackers and telemetry and Telemetry.

Notices that share a switch

Two further notices are not their own switches.

Operational problems also covers an overload notice, at most one per app every 10 minutes: “Outbound held back 1 connection from Safari” (or “N connections”), with “Safari opened connections faster than you could answer. Allow Safari to connect?” Allow Safari (the app’s name) does not bring a window forward. If that app still has an alert waiting, Outbound allows it at the scope the alert is showing, or Once when rules cannot be edited. If nothing is waiting, Outbound allows that program to connect to any server and reports “Allowed Safari to connect to any server.” Open Alert, and a click on the notice, brings the connection alert forward.

Connections waiting in Review also covers a Strict-mode notice, at most one per app per hour. It is not posted when that app had an overload notice within the last 60 seconds. The notice reads: “Outbound blocked Safari”, with “Strict mode blocks apps you haven’t allowed.” It is a Strict denial that did not come from a rule. Allow Safari takes the same path as Allow on the overload notice. Review, and a click on the notice, opens Something Not Working? on that app. See Something not working?.