9 ms·
What I want for all these services (Little Snitch, ESET, etc) is an EasyList-like ... list. A community-aggregated and reviewed list of servers that don't merit
by killjoywashere 9y ago
What I want for all these services (Little Snitch, ESET, etc) is an EasyList-like ... list. A community-aggregated and reviewed list of servers that don't merit my connection. I'd pay a monthly subscription fee for that.
I'd also like separate lists for
* "this wifi is public, be extra cautious"
* "this wifi is public, be nice and don't torrent, do backups, etc"
* "I'm on a metered connection (e.g. LTE), don't run torrents, backups, etc"
edit: for anyone looking for a monetizable idea: this post has 41, no 42, no 43 points in about an hour. Probably a good idea...
- lifty 9y agoI would pay for such a service as well. In addition to that, I would love if this service would allow companies like Apple and Google to maintains their own lists of IP's and update them regularly, so you can be 100% sure that an IP belongs to them.
- killjoywashere 9y agoperfect seed material for the list. Start from an empty Little Snitch config and whois everything that tries to connect.
- igravious 9y agoIs that not somehow auto-discoverable using DNS trickery?
- uxp 9y agoNot entirely. From what I understand, these outbound firewalls are working at the kernel level and interject themselves into a network connection outside of the DNS lookup process. You could reverse-dns lookup the IP, which Little Snitch tries, but with things like CDNs and AWS EC2, you end up with a lot of reports of applications trying to connect to "foo.akamai.com" OR bar.akamai.com", where foo and bar are entirely separate entities, or just simply to ec2-0.1.2.3.aws.amazonaws.com or what-have-you. Little Snitch appears to maintain it's own cache of DNS entries as well, so if you've got one application that connects to some CDN's IP via it's own CNAME, many times other applications will appear to be connecting to the first application's CNAME when they attempt to connect to the same IP because LS has resolved that IP to the first CNAME more times, or first, or something like that. It's not perfect, and frequently it isn't even helpful.
- inlined 9y ago[disclaimer, I work for google] I’m sure if Google made such a list there would be another HN article about how Google is evil and trying to cut out competition.
- iamdave 9y agotakes notes So would you want just the curated list, or an application that uses said list and provides feedback to the user? Either? Both? Because I've _sort_ of done this on my personal Mac-though for reasons more pertaining to an infrastructure I maintain for a client, scaling this to a type of service wouldn't be TOO difficult.
- killjoywashere 9y agoI want to drop that list into little snitch. In fact, when I install Little Snitch, I want it to ask me "would you like to subscribe to iamdave's list?"
- iamdave 9y agoHrm. I think you've given me something fun to spend my weekend on
- bwilliams18 9y agowould love to see whatever you end up with! -B
- AckSyn 9y agoI, too, would like to see this if you do it!
- artificial 9y agoShould you make some progress post back here, please.
- igravious 9y agoLike how a number of different ad blockers subscribe to the EasyList ad blocking list, correct? https://easylist.to/ https://easylist.to/ “ The links listed below allow you to select filter lists for use in your browser provided that you are using a compatible ad blocker (tested with Adblock Plus, AdBlock and uBlock Origin). Furthermore, EasyPrivacy Tracking Protection List is available for Internet Explorer 9 and higher. ”
- prepend 9y agoI’d do a one time fee of $10 or something. But a fee forever is not appealing. I would rather commit to running a certain number of compute jobs a month to trade cpu or storage or whatever. And do that forever. I barter my unused cpu for your whitelist service that aggregates community activity.
- killjoywashere 9y agoBartering cpu on a laptop sounds like a good way to have a hot lap and a short battery life.
- dylan604 9y agoor maybe the old skool option of paid upgrades? $10 first time fee to get the current list. then, as you start to notice things not getting blocked, purchase the upgrade/updated list? I guess it depends on the monthly fee? $10/month, nope. $12/year-$1/monthly or $10/year-1payment to get monthly updates, quite possibly. i do understand updating/maintaining a fresh list will cost someone somewhere money.
- simongr3dal 9y agoMy solution right now (on macOS) is Gas Mask[1] (a menubar hosts file manager) combined with some very nice hosts files[2]. It certainly kills of most of the pop-ups I run into. [1]: https://github.com/2ndalpha/gasmask https://github.com/2ndalpha/gasmask [2]: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- jachee 9y agoI handle this for my whole network with a pi-hole[0]. [0] https://pi-hole.net https://pi-hole.net
- 2dvisio 9y agoWhen I tried pi-hole I was amazed by it. Until the day I discovered someone in China hacked it :-///
- AckSyn 9y agoCould have been a number of things - most likely culprit I've seen is that it was left exposed to the internet, ssh most likely, and the default password wasn't changed.
- dfee 9y agoThat’s terrible. Did you move on to something else?
- chewyland 9y agoSounds like a poor or reused password.
- DavideNL 9y ago...and how did you come to the conclusion they hacked the pi-hole?
- edgartaor 9y agoI got tons of shh login attempts from Russia and China. I just install fail2ban.
- eddieplan9 9y agoLittle Snitch has this with automatic profile switching: https://blog.obdev.at/automatic-profile-switching/ https://blog.obdev.at/automatic-profile-switching/ though you will have to build the list of rules yourself
- j45 9y agoWith LS afaik it's not possible to run multiple profiles at the same time (say you have groups of rules for a particular app), otherwise it would be perfect. ie., turn Apple Telemetry on or off.
- zarify 9y agoI know it's not the same thing, but I use TripMode on macOS for your last two points, which selectively blocks app access based on what network you're connected to.
- adjohn 9y agoI second this! TripMode is a great product if you frequently tether with your phone, or connect to wifi networks with limited bandwidth (airplanes).
- nkristoffersen 9y agoThird it! Trip mode is great. I tether from my phone a lot and need to protect my data from background usage.
- kylehotchkiss 9y agoI also love TripMode. Uses a kernel extension which some users may dislike but so nice to turn off Dropbox/Google Drive/Arq/iClouds backup services while tethering at Panera
- AdmiralAsshat 9y agoThere used to be an application used by torrenters called PeerGuardian and then PeerBlock, which was basically just that. It was a curated list of IPs that were known to belong to domains at universities, companies, governments, etc. It probably had malicious domains in there as well.
- shibel 9y agoAn MVP for this would be quite simple to build. Do you happen to use Little Snitch? AFAIK, they don't really have an import/export option (their "backup" option is tied to the user account), but I've found a way around this limitation that is only a tad little more tedious than an auto-workflow.
- killjoywashere 9y agoI'm up to my ears in work. That's why I'm willing to pay. Please, be my guest. Build it, take my money.
- aplorbust 9y agoWhat if I start a DNS service that blocks every ad server domainname in the "EasyList"? Personally I avoid using third party DNS, but if there is demand for this...
- fjsolwmv 9y agohttps://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
- aplorbust 9y agoWhat if I let the user run it locally? I point a local dnscache at a local, customised "root.zone" that blocks all these EasyList ad server domains? User could have several alternate root.zones that provide different "profiles". To switch profiles simply switch root.zones. (I used to do this for myself. Then I stopped using caches altogether. Now I do everything with tinydns, cdb and a customized stub resolver.) Or what if I resolve all the ad server domains in the EasyList each day from various checkpoints around the world and publish an IP blocklist? Then users can import it into their application level firewalls.
- srett 9y agoA good bunch of these resolve to AWS/cloudflare/etc. nowadays, so good luck with that.. :-/
- aplorbust 9y agoNo luck needed. Authoritative DNS makes it easy. Even without using authoritative DNS, if we only have a blocklist of IP addresses and some application-level firewall solution, we can examine outgoing HTTP headers in a client-side proxy and filter accordingly. I also do not use a popular browser that runs Javascript to send and retrieve to and from the internet. That is the root cause of most users problems. This is the most effective solution, bar none. The third parties users want to avoid are almost almost always depending on Javascript to accomplish their goals. Connecting a powerful interpreter with potentially full control over the users computer to the open internet. Then believing this can be safe. The user is granting use of this interpreter to third parties. In this thread we can see how users struggle to know which third parties can be trusted. All for the sake of keeping that interpreter open to "good" third parties to access at will over the internet. (Why is a good question.) Early web browsers called on other, separate programs to do specific jobs outside of rendering HTML. Taking a cue from that history, I use simpler, limited programs with no built-in interpreter to do two specific jobs: sending and retrieving. Third parties can return code in response to requests for content, but I am under no obligation to run the code, let alone run it from a popular browser with a powerful interpreter that is connected to the internet. Cannot speak for others, but this approach has worked well for me as the www worsens.
- f4rker 9y agoAt some point a blocking list /app will break a site you use. Adblockers have broken sites for me countless times.
- deleted 9y ago[deleted]
- chewyland 9y agoPihole is your best friend.
- tpetry 9y agoAnd extend the idea with community-aggregated whitlists. If i wand to use a software like spotify it for sure hat to load the songs somehow from their servers, so the application-intended ntwork community should be whitelisted.