It may be a rule precedence issue.
Right click the Little Snitch tray icon and select "Rules..."
Then in the Search box type in livefyre (or whatever hostname shows up in the LS popup), and then click on the "Rule" column to sort by precedence.
Check to see if there may be an "allow" (green circle) or "ask" (?) icon at the top of the list.
Do you see all of the previous "Deny forever" rules that were created before? Are each of the rules exactly the same, or are they using different ports or different hosts?
I tried pinging "foobar.cdn.livefyre.com" and it doesn't resolve, so I presume you are substituting something else with "foobar" in your example?
If there are multiple different hostnames (s1.cdn.livefyre.com, s2.cdn.livefyre.com), then that is why they keep popping up because each rule is only for one host. If this is the case, then edit one of the rules, and change the "Server" dropdown to "Domains" and enter in "cdn.livefyre.com" or "livefyre.com" and it will block all subdomains. If each rule has a different port, then you can change the "Port" to "any" to block all ports.
Is this an outbound attempt or inbound? Which program is it?
I know that LS can deny forever because I have it working for many, many rules.
Right click the Little Snitch tray icon and select "Rules..."
Then in the Search box type in livefyre (or whatever hostname shows up in the LS popup), and then click on the "Rule" column to sort by precedence.
Check to see if there may be an "allow" (green circle) or "ask" (?) icon at the top of the list.
Do you see all of the previous "Deny forever" rules that were created before? Are each of the rules exactly the same, or are they using different ports or different hosts?
I tried pinging "foobar.cdn.livefyre.com" and it doesn't resolve, so I presume you are substituting something else with "foobar" in your example?
If there are multiple different hostnames (s1.cdn.livefyre.com, s2.cdn.livefyre.com), then that is why they keep popping up because each rule is only for one host. If this is the case, then edit one of the rules, and change the "Server" dropdown to "Domains" and enter in "cdn.livefyre.com" or "livefyre.com" and it will block all subdomains. If each rule has a different port, then you can change the "Port" to "any" to block all ports.
Is this an outbound attempt or inbound? Which program is it?
I know that LS can deny forever because I have it working for many, many rules.