5 ms·
Show HN: Hostsctl – Control /etc/hosts easily, block ads, social networks, etc
- tyingq 10y agoInteresting in the demo that pings to 127.0.0.1 fail. Is that a common setup for some distribution to block icmp on the localhost if?
- 0xl3vi 10y agoNo, it's my firewall setup. I blocked ICMP for security reasons on my servers (:
- mmarx 10y agoWhich actual security benefits do you get from blocking ICMP? Is that really worth it, considering that you break Path MTU Discovery, rendering your servers unusable for some people?
- 0xl3vi 10y agoFor example: https://github.com/inquisb/icmpsh https://github.com/inquisb/icmpsh. "my servers" is my home servers not some "web servers". Maybe it's just me (: ( paranoid on security )
- newman314 10y agohttp://shouldiblockicmp.com http://shouldiblockicmp.com While it's good to be proactive about security, it is also helpful to understand why blocking icmp (particularly wholesale) is a bad idea. I had a network guy tell me the other day that he is blocking traceroute for "security reasons". I can't even... =(
- JdeBP 10y agoI made the mistake the other day of reminding my work colleagues of a certain instructional video relating to traceroute that did the rounds some years ago. Now they are joyfully calling it "Tracer T" all of the time. (-:
- pwdisswordfish 10y agoWhy resolve blocked domains to 127.0.0.1 anyway? Wouldn't 0.0.0.1 work better?
- HenryBemis 10y agoMy thought exactly. I send to 0.0.0.0 instead of 127.0.0.1. Also, my go to site for hosts is: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ and I am more than happy to share that on Windows/Firefox I use a combo of AdBlock+ and NoScript so I only allow FB, and the other "socials" to run their crap ONLY on their own websites and not on others (e.g. the -tracking- "like" buttons on CNN)
- simplehuman 10y ago0.0.0.0 is not a valid host ip
- simplehuman 10y ago0.0.0.1 will actually make a TCP connection on the network whereas the loopback won't.
- pwdisswordfish 10y ago$ ping 0.0.0.1 connect: Invalid argument $ ncat 0.0.0.1 80 Ncat: Invalid argument.
- matheweis 10y agoRelated discussion from several years ago: https://news.ycombinator.com/item?id=5264405 https://news.ycombinator.com/item?id=5264405
- theamk 10y agoOne caveat: all your custom enabled/disabled hosts disappear after "update" command.
- 0xl3vi 10y agoWIP
- colemannugent 10y agoI would reccomend PiHole [1] for something like this. Not only is it more robust, it acts as a DNS/HTTP server that blocks this kind of stuff on a whole network. 1: https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole
- StreamBright 10y agoThis is pretty cool, I was not aware of this project, thanks for sharing.
- nopit 10y agoUse dnsmasq and then you can wildcard the subdomains
- whacker 10y agoI think (on linux, at least), its better to implement this as a nss- module (/etc/nsswitch.conf). You can do things like lookup a hashtable, automatically update databases, etc without having to rewrite system config files. Also this does not protect you from programs that perform their own dns lookups, and ignore /etc/hosts and /etc/resolv.conf entirely!
- git-pull 10y agoI like this and could use something like it, but you should use POSIX sh (/bin/sh) and not rely on Bash in the shebang as well as non-portable functionality it introduces. This wouldn't work out of the box on FreeBSD. I recommend this tool: https://www.shellcheck.net/ https://www.shellcheck.net/
- herbst 10y agoHow about the performance? Big host files AFAIK perform rather bad
- 0xl3vi 10y agoWith AWK? did you tesed this? we are not using sed(1).
- herbst 10y agono with the host file in general. I did this once (a while ago) and i did notice a difference in website loading speed when i put 1000 lines into that thing
- JdeBP 10y agoThis was a problem solved in 1983. Read RFC 882 and RFC 883.
- gbraad 10y agoHostctl => as sinkholectl