I am considering installing a per-app-triggered filter, something that I found very efficient on macOSX in the past.
On OSX the name was "little snitch", on Ubuntu I see there are a couple of wannabees, like the one called Douane. ("Douane" meaning "Customs" in french)
The idea is that each time an app asks for a new connection to somewhere a dialog appears and then one either allows everything, or just that address, forever, or just for now...
After some ten minutes setting things up it flies silently (in my former OSX experience), and still would trigger a warning if, say, the updater would phone an unexpected place.
Anyone with a Mate experience with Douane or the like here?
I am strongly interested in advice 
Thank you!