9 ms·

Any browser plugin is inferior to using a hosts file. Hosts file's blackhole any network request before even attempting to make a connection. These browser pl

Any browser plugin is inferior to using a hosts file. Hosts file's blackhole any network request before even attempting to make a connection. These browser plugins only help if you're using the specific browser — they aren't going to help that electron/desktop app that's phoning home. They wont help block inline media links (Messages on a Mac pre-rendering links) that show up in your chat programs which attempt to resolve to Facebook. They also wont block any software dependency library that you install without properly checking if it's got some social media tracking engine built in. I don't even waste time or cpu cycles with browser based blocking applications. Steven Black's[1] maintained hosts files are the best for blocking adware, malware, fakenews, gambling , porn and social media outlets. [1] - https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/

fwip 9y ago
apk, is that you?
- joeblau 9y ago
  LOL who is that? — I don't think I'm apk.
  - nneonneo 9y ago
    A troll on Slashdot who commonly advertises a HOSTS-based block list, claiming it superior to practically every security solution ever.
    - joeblau 9y ago
      Oh now I have to look this up. Whomever that person is sounds quite entertaining.
hiccuphippo 9y ago
What if the ad networks start using IPs directly instead of domains?
- colordrops 9y ago
  if this form of blocking becomes popular, they will.
- rphlx 9y ago
  Block all accesses to non-local (192.168, 10., etc) IP-based URLs. Will break some legit stuff, but, not that much for most users, and they can just whitelist that as it comes up. IP whitelists could also be aggregated and shared on github similar to the current DNS blacklists.
  - fouc 9y ago
    How can I do that? (osx or linux)
    - rphlx 9y ago
      I don't know of any way currently. :-\ You'd probably have to write a browser plugin or get one of the existing ones like uBlock to implement it.
- ryuuchin 9y ago
  If you're using uBlock Origin or uMatrix to block third party scripts it won't matter. That's what makes using the dynamic filtering in uBlock Origin so powerful. Easily the best bang for your buck ad blocking that you can do.
cheeze 9y ago
Many users can't modify HOSTS on work computers, etc but can install an extension. Hosts file is a real pain to disable/enable, at least quite a bit worse than clicking one button in your browser. I do something very similar to hosts file (at router level rather than os), but there are a few drawbacks over an extension.
- TAForObvReasons 9y ago
  what is the recommended iOS way of blocking the facebook domains?
  - dbg31415 9y ago
    This works great for keeping spam off your devices -- off your local network at any rate. Not possible to modify iOS hosts file without jailbreaking it. * Pi-hole®: A black hole for Internet advertisements – curl -sSL https://install.pi-hole.net https://install.pi-hole.net | bash || https://pi-hole.net/ https://pi-hole.net/
  - joeblau 9y ago
    On an iPhone without jailbreak you can use 1blocker[1]. Since every browser on the iPhone is basically a UIWebView/SFSafariViewController controlled by iOS, Safari Content Blockers[2] apply globally preventing web visits. Safari Content Blockers also prevent Messages from rendering Facebook content inline. My 1blocker rule called "Bye Facebook" is: https?://([a-z\.]*)?facebook\.com.* I should probably update it to factor in a lot of these other TLD URLs now that I think about it. - [1] https://1blocker.com https://1blocker.com (This costs money) - [2] https://developer.apple.com/library/content/documentation/Extensions/Conceptual/ContentBlockingRules/Introduction/Introduction.html https://developer.apple.com/library/content/documentation/Ex...
    - saagarjha 9y ago
      > Since every browser on the iPhone is basically a UIWebView/SFSafariViewController controlled by iOS Most browsers rely on WKWebView, which uses the Safari Nitro JavaScript engine but allows customization of the user interface as well. UIWebView is pretty much legacy at this point, and SFSafariViewController does not allow any customization beyond basic theming. > Safari Content Blockers apply globally preventing web visits Unfortunately, this is not true. They only work in Safari and Safari view controllers. > Safari Content Blockers also prevent Messages from rendering Facebook content inline Are you sure about this? As far as I know, Messages uses a web view.
isostatic 9y ago
Running your own DNS server, and intercepting DNs traffic on your routerC is better for two reasons 1) processes and machines that bypass hosts are also caught 2) a large hoss file takes time to parse, line by line, slowing every DNA lookup. A DNs server should cache the entire better. Dnsmasq takes entries in a hosts file format.
- feelin_googley 9y ago
  I have scripts and compiled utilities that transform HOSTS file to tinydns format. I use nsd as well which uses BIND format. I prefer the tinydns format. Zone files are more flexible than HOSTS files, but I still use HOSTS as well. I have never had a concern about the speed of using HOSTS. It is certainly faster than DNS. There is a comment in this thread where someone asserts that HOSTS was never designed to handle "millions of entries". I would be interested in reading about a user who visits "millions" of websites or otherwise needs to do lookups on "millions" of domains. I maintain a database of every IP address I am likely to use on a repeated basis, in several formats, with kdb+ as the "master" format. I believe most users will never come close to intentionally accessing "millions" of IP addresses in their entire lifetime.FN1 I could be mistaken and it would be interesting to learn of a user who can dispel this belief. FN1. If you think about this, it may cause you to question the necessity of DNS for such users. Or not. Times have changed since the advent of HOSTS. They have also changed since the advent of DNS. For example, using "consumer" hardware, I can fit all the major ICANN TLD zones on external storage and the entire com zone (IMO, by far the most important) in memory. This is many, many more domains than I will ever need to look up. Assuming at best I will not live much longer than 100 years, I could not and will not explore them all or even a significant fraction.
  - isostatic 9y ago
    If you know which DNS names you will need to know, then yes, there's no need for more than a hosts file. Until DNS changes. If I move a server from one IP to another, I change DNS, and in $TTL time everyone's pointing at the new server. Apart from you with a hosts file. How does that work if everyone has a hosts file? If I say "check out this interesting story on blahblah.com", you don't have it in your hosts file, how do you get it? I maintain a list of every phone number I am likely to use on a repeated basis, but sometimes I need to look up a phone number I don't know (in the old days this was a phone book locally, and directory inquiries further afield. Now it's ddg and assume they have a website. Which isn't in my hosts file or dns cache, and I've never visited before) I maintain DNS entries for my home network of a dozen devices -- I host it on my mikrotik, but it's handy to have, when I type "ssh laptop" rather than remembering if it's on .71 or .73. It's one step better than a plain text file, as there's a standard based way to remotely query it. At work I maintain a DNS server with 2000 entries on my network, which is actually hosts file powered, but again I use dnsmasq for the DNS server rather than rsyncing that hosts file to 2000 machines.
fbelzile 9y ago
Windows 8-10 users that use Windows Defender will notice that some hosts file entries will be ignored (like popular domains like facebook.com). You will also need to add an exception to the hosts file in Windows Defender.
- retox 9y ago
  I wonder what their rational for this is. I know in the past malware have modified the hosts file to block malware removal tool domains but why ignore entries for Facebook? I heard that blackholing requests to Microsoft telemetry URLs also has no effect. Any way of finding the unlockable list I wonder.
  - ReverseCold 9y ago
    > why ignore entries for Facebook? Malware would redirect facebook.com to some scam site probably. Given how popular FB is, Microsoft decided to "fix" this. (This is all a hypothetical, I don't actually know this for sure.)
    - Skunkleton 9y ago
      I mean, considering the use of 99.9% of Windows PCs out there it probably make sense.
- RachelF 9y ago
  Windows 8-10 users will also notice that host file entries for any Microsoft or Bing entries will be ignored. I guess they hardware the IPs into Windows.
  - dspillett 9y ago
    > I guess they hardware the IPs into Windows. More likely they just bypass looking at the local hosts file for such names, so the request always goes out to your DNS servers. Therefore blocking these names by redirecting to 127.0.0.1 will work if done at your DNS server (for instance if you run an instance of https://pi-hole.net/ https://pi-hole.net/ for that). Unless of course they make the lookup use specific name servers that they run, instead of the local resolvers that your machine is configured to look at, for those names but that is less likely.
stephengillie 9y ago
uBlock has much the same effect. Requests err in the console with "ERR_BLOCKED_BY_CLIENT" instead of a 404, so technically it is possible to detect this with a first-party JavaScript file.
- 0xfeba 9y ago
  That's how the "please don't use an ad-blocker" stuff works.
katastic 9y ago
This is downright silly. HOSTS files are static. They were never designed for blocking ads or tracking. And for all we know, every connection does a linear search through the HOSTS file so the larger it gets, the more wasted time, because it was never designed to have millions of entries.
- MertsA 9y ago
  To add to this, I've seen that stupid hosts file blacklist from SpyBot cause some Windows network service get locked up for 40 seconds every time the laptop was resumed from suspend or booted up in Windows 7. Parsing the hosts file took a relatively extreme amount of time for exactly this reason, massive hosts files are a kludge at best.
geofft 9y ago
> they aren't going to help that electron/desktop app that's phoning home. What's your threat model? Mine is third-party tracking cookies, and desktop apps don't share my browser's cookie jar. So while technically I can be tracked by IP from a desktop app, Facebook can't tell if it's me or someone else at the same coffee shop. In particular, one nice thing about Chrome extensions is that they don't apply to incognito windows. I regularly use HTTPS Everywhere in block-all-HTTP-requests mode + an incognito window on wifi connections I don't trust, because the incognito window will permit plaintext requests, but it doesn't read my cookies or write to my cache, so it's sandboxed from my actual web browsing. I can safely read some random website that doesn't support HTTPS with my only concern being my own eyes reading a compromised page; none of my logged-in sessions are at risk. > any software dependency library that you install without properly checking if it's got some social media tracking engine built in. ... is this a thing? (I totally believe that it's becoming a thing, I just haven't seen it yet and am morbidly curious.)
- nurettin 9y ago
  While I acknowledge that your use case may be confined to browsing the internet, I still don't see what prevents a desktop app from reading your cookie jar. Edit: your browser history (which may contain your profile URI) might be pretty out in the open, too.
  - geofft 9y ago
    Oh, yes, none of it is sandboxed from an actively malicious app—but an actively malicious app can just ignore your hosts file, too. My threat model is a developer who includes a standard tracking snippet from a third party but is not going out of their way to reliably violate my privacy at all costs (because they have other features to ship, and the tracking snippet works on most computers). If your threat model includes actively malicious developers, stop running native apps from them at all.
    - nurettin 9y ago
      >> stop running native apps from them at all. I would dearly love to, if all OSes came with a permission system other than just "run in admin mode/sudo".
beagle3 9y ago
That doesn't stop anyone using IP addresses directly, and I find that a small minority does (but that minority does including, e.g. Microsoft for some Win10 updates). Depending on your threat model, you might need to go the proxy/firewall route. Hosts file is a weird middle ground - that has to be installed and maintained on every device, many of which (e.g. iphone/ipad) won't let you do that. It's better to set up a local DNS, which will serve every local machine; and as I mentioned, doing this at a firewall level is better yet.
- kgwxd 9y ago
  That only works on your local network. You always need something on the device if you want to take it anywhere.
  - vaseem 9y ago
    Homelab: pi-hole, pfsense, openvpn Mobile Devices: openvpn client
    - vanadium 9y ago
      This is pretty much my jam at home and away. Works great.
    - deevolution 9y ago
      I started using the brave browser, which i noticed blocks alot of network requests. Loading the NYT took about 25 seconds to finish all requests using chrome. With brave it took 4 seconds. Also brave gives you the option to pay the sites you visit with BAT tokens, if you want. Brave in conjunction with Pi-hole looks like even more secure and perhaps further page load speed. Edit: spelling
    - win32x86 9y ago
      I use urlfilterservice on my Windows 10 laptop. It works well for me. https://www.urlfilterservice.net https://www.urlfilterservice.net
    - 9y ago
javajosh 9y ago
The trade-off is that hosts file blocks more processes, but the browser plugin updates more frequently.
Amezarak 9y ago
Just browsing through the "fake news" section that hosts file is ridiculous. There's a tremendous number of completely legitimate news sources that are blocked and many that, while lurid, are not in any sense "fake news." The list includes both liberal and conservative legitimate news sites.
FabHK 9y ago
A convenient GUI app for managing the hosts file on macOS machines is Gas Mask, btw. You can have a local hosts file to block your pet peeves, then subscribe to a remote hosts file (such as the one linked above), and activate the combined hosts file. https://github.com/2ndalpha/gasmask/releases https://github.com/2ndalpha/gasmask/releases
- DavideNL 9y ago
  I personally find this one better: SwitchHosts https://github.com/oldj/SwitchHosts https://github.com/oldj/SwitchHosts
Metaception 9y ago
Any browser plugin is inferior to using a hosts file. This is objectively false. A hosts file blocklist cannot: - Global blacklist and whitelist select URLs - Block all sub-domains of a given URL - Block third-party iframes and scripts (with whitelist) A hosts file's feature set is not a superset of a browser based solution and the two complement each other.
- dredmorbius 9y ago
  DNSMasq can and does accomplish the first two items on your list, largely in hosts-file format. Mind, I use both hosts and uMatrix. Each has its place.
flsh42 9y ago
And together with the tool gasmask on Mac OS the list is a perfect tool to really block FB.

fwip 9y ago

apk, is that you?

joeblau 9y ago
LOL who is that? — I don't think I'm apk.
- nneonneo 9y ago
  A troll on Slashdot who commonly advertises a HOSTS-based block list, claiming it superior to practically every security solution ever.
  - joeblau 9y ago
    Oh now I have to look this up. Whomever that person is sounds quite entertaining.

hiccuphippo 9y ago

What if the ad networks start using IPs directly instead of domains?

colordrops 9y ago
if this form of blocking becomes popular, they will.
rphlx 9y ago
Block all accesses to non-local (192.168, 10., etc) IP-based URLs. Will break some legit stuff, but, not that much for most users, and they can just whitelist that as it comes up. IP whitelists could also be aggregated and shared on github similar to the current DNS blacklists.
- fouc 9y ago
  How can I do that? (osx or linux)
  - rphlx 9y ago
    I don't know of any way currently. :-\ You'd probably have to write a browser plugin or get one of the existing ones like uBlock to implement it.
ryuuchin 9y ago
If you're using uBlock Origin or uMatrix to block third party scripts it won't matter. That's what makes using the dynamic filtering in uBlock Origin so powerful. Easily the best bang for your buck ad blocking that you can do.

cheeze 9y ago

Many users can't modify HOSTS on work computers, etc but can install an extension. Hosts file is a real pain to disable/enable, at least quite a bit worse than clicking one button in your browser. I do something very similar to hosts file (at router level rather than os), but there are a few drawbacks over an extension.

TAForObvReasons 9y ago
what is the recommended iOS way of blocking the facebook domains?
- dbg31415 9y ago
  This works great for keeping spam off your devices -- off your local network at any rate. Not possible to modify iOS hosts file without jailbreaking it. * Pi-hole®: A black hole for Internet advertisements – curl -sSL https://install.pi-hole.net https://install.pi-hole.net | bash || https://pi-hole.net/ https://pi-hole.net/
- joeblau 9y ago
  On an iPhone without jailbreak you can use 1blocker[1]. Since every browser on the iPhone is basically a UIWebView/SFSafariViewController controlled by iOS, Safari Content Blockers[2] apply globally preventing web visits. Safari Content Blockers also prevent Messages from rendering Facebook content inline. My 1blocker rule called "Bye Facebook" is: https?://([a-z\.]*)?facebook\.com.* I should probably update it to factor in a lot of these other TLD URLs now that I think about it. - [1] https://1blocker.com https://1blocker.com (This costs money) - [2] https://developer.apple.com/library/content/documentation/Extensions/Conceptual/ContentBlockingRules/Introduction/Introduction.html https://developer.apple.com/library/content/documentation/Ex...
  - saagarjha 9y ago
    > Since every browser on the iPhone is basically a UIWebView/SFSafariViewController controlled by iOS Most browsers rely on WKWebView, which uses the Safari Nitro JavaScript engine but allows customization of the user interface as well. UIWebView is pretty much legacy at this point, and SFSafariViewController does not allow any customization beyond basic theming. > Safari Content Blockers apply globally preventing web visits Unfortunately, this is not true. They only work in Safari and Safari view controllers. > Safari Content Blockers also prevent Messages from rendering Facebook content inline Are you sure about this? As far as I know, Messages uses a web view.

isostatic 9y ago

Running your own DNS server, and intercepting DNs traffic on your routerC is better for two reasons 1) processes and machines that bypass hosts are also caught 2) a large hoss file takes time to parse, line by line, slowing every DNA lookup. A DNs server should cache the entire better. Dnsmasq takes entries in a hosts file format.

feelin_googley 9y ago
I have scripts and compiled utilities that transform HOSTS file to tinydns format. I use nsd as well which uses BIND format. I prefer the tinydns format. Zone files are more flexible than HOSTS files, but I still use HOSTS as well. I have never had a concern about the speed of using HOSTS. It is certainly faster than DNS. There is a comment in this thread where someone asserts that HOSTS was never designed to handle "millions of entries". I would be interested in reading about a user who visits "millions" of websites or otherwise needs to do lookups on "millions" of domains. I maintain a database of every IP address I am likely to use on a repeated basis, in several formats, with kdb+ as the "master" format. I believe most users will never come close to intentionally accessing "millions" of IP addresses in their entire lifetime.FN1 I could be mistaken and it would be interesting to learn of a user who can dispel this belief. FN1. If you think about this, it may cause you to question the necessity of DNS for such users. Or not. Times have changed since the advent of HOSTS. They have also changed since the advent of DNS. For example, using "consumer" hardware, I can fit all the major ICANN TLD zones on external storage and the entire com zone (IMO, by far the most important) in memory. This is many, many more domains than I will ever need to look up. Assuming at best I will not live much longer than 100 years, I could not and will not explore them all or even a significant fraction.
- isostatic 9y ago
  If you know which DNS names you will need to know, then yes, there's no need for more than a hosts file. Until DNS changes. If I move a server from one IP to another, I change DNS, and in $TTL time everyone's pointing at the new server. Apart from you with a hosts file. How does that work if everyone has a hosts file? If I say "check out this interesting story on blahblah.com", you don't have it in your hosts file, how do you get it? I maintain a list of every phone number I am likely to use on a repeated basis, but sometimes I need to look up a phone number I don't know (in the old days this was a phone book locally, and directory inquiries further afield. Now it's ddg and assume they have a website. Which isn't in my hosts file or dns cache, and I've never visited before) I maintain DNS entries for my home network of a dozen devices -- I host it on my mikrotik, but it's handy to have, when I type "ssh laptop" rather than remembering if it's on .71 or .73. It's one step better than a plain text file, as there's a standard based way to remotely query it. At work I maintain a DNS server with 2000 entries on my network, which is actually hosts file powered, but again I use dnsmasq for the DNS server rather than rsyncing that hosts file to 2000 machines.

fbelzile 9y ago

Windows 8-10 users that use Windows Defender will notice that some hosts file entries will be ignored (like popular domains like facebook.com). You will also need to add an exception to the hosts file in Windows Defender.

retox 9y ago
I wonder what their rational for this is. I know in the past malware have modified the hosts file to block malware removal tool domains but why ignore entries for Facebook? I heard that blackholing requests to Microsoft telemetry URLs also has no effect. Any way of finding the unlockable list I wonder.
- ReverseCold 9y ago
  > why ignore entries for Facebook? Malware would redirect facebook.com to some scam site probably. Given how popular FB is, Microsoft decided to "fix" this. (This is all a hypothetical, I don't actually know this for sure.)
  - Skunkleton 9y ago
    I mean, considering the use of 99.9% of Windows PCs out there it probably make sense.
RachelF 9y ago
Windows 8-10 users will also notice that host file entries for any Microsoft or Bing entries will be ignored. I guess they hardware the IPs into Windows.
- dspillett 9y ago
  > I guess they hardware the IPs into Windows. More likely they just bypass looking at the local hosts file for such names, so the request always goes out to your DNS servers. Therefore blocking these names by redirecting to 127.0.0.1 will work if done at your DNS server (for instance if you run an instance of https://pi-hole.net/ https://pi-hole.net/ for that). Unless of course they make the lookup use specific name servers that they run, instead of the local resolvers that your machine is configured to look at, for those names but that is less likely.

stephengillie 9y ago

uBlock has much the same effect. Requests err in the console with "ERR_BLOCKED_BY_CLIENT" instead of a 404, so technically it is possible to detect this with a first-party JavaScript file.

0xfeba 9y ago
That's how the "please don't use an ad-blocker" stuff works.

katastic 9y ago

This is downright silly. HOSTS files are static. They were never designed for blocking ads or tracking. And for all we know, every connection does a linear search through the HOSTS file so the larger it gets, the more wasted time, because it was never designed to have millions of entries.

MertsA 9y ago
To add to this, I've seen that stupid hosts file blacklist from SpyBot cause some Windows network service get locked up for 40 seconds every time the laptop was resumed from suspend or booted up in Windows 7. Parsing the hosts file took a relatively extreme amount of time for exactly this reason, massive hosts files are a kludge at best.

geofft 9y ago

> they aren't going to help that electron/desktop app that's phoning home. What's your threat model? Mine is third-party tracking cookies, and desktop apps don't share my browser's cookie jar. So while technically I can be tracked by IP from a desktop app, Facebook can't tell if it's me or someone else at the same coffee shop. In particular, one nice thing about Chrome extensions is that they don't apply to incognito windows. I regularly use HTTPS Everywhere in block-all-HTTP-requests mode + an incognito window on wifi connections I don't trust, because the incognito window will permit plaintext requests, but it doesn't read my cookies or write to my cache, so it's sandboxed from my actual web browsing. I can safely read some random website that doesn't support HTTPS with my only concern being my own eyes reading a compromised page; none of my logged-in sessions are at risk. > any software dependency library that you install without properly checking if it's got some social media tracking engine built in. ... is this a thing? (I totally believe that it's becoming a thing, I just haven't seen it yet and am morbidly curious.)

nurettin 9y ago
While I acknowledge that your use case may be confined to browsing the internet, I still don't see what prevents a desktop app from reading your cookie jar. Edit: your browser history (which may contain your profile URI) might be pretty out in the open, too.
- geofft 9y ago
  Oh, yes, none of it is sandboxed from an actively malicious app—but an actively malicious app can just ignore your hosts file, too. My threat model is a developer who includes a standard tracking snippet from a third party but is not going out of their way to reliably violate my privacy at all costs (because they have other features to ship, and the tracking snippet works on most computers). If your threat model includes actively malicious developers, stop running native apps from them at all.
  - nurettin 9y ago
    >> stop running native apps from them at all. I would dearly love to, if all OSes came with a permission system other than just "run in admin mode/sudo".

beagle3 9y ago

That doesn't stop anyone using IP addresses directly, and I find that a small minority does (but that minority does including, e.g. Microsoft for some Win10 updates). Depending on your threat model, you might need to go the proxy/firewall route. Hosts file is a weird middle ground - that has to be installed and maintained on every device, many of which (e.g. iphone/ipad) won't let you do that. It's better to set up a local DNS, which will serve every local machine; and as I mentioned, doing this at a firewall level is better yet.

kgwxd 9y ago
That only works on your local network. You always need something on the device if you want to take it anywhere.
- vaseem 9y ago
  Homelab: pi-hole, pfsense, openvpn Mobile Devices: openvpn client
  - vanadium 9y ago
    This is pretty much my jam at home and away. Works great.
  - deevolution 9y ago
    I started using the brave browser, which i noticed blocks alot of network requests. Loading the NYT took about 25 seconds to finish all requests using chrome. With brave it took 4 seconds. Also brave gives you the option to pay the sites you visit with BAT tokens, if you want. Brave in conjunction with Pi-hole looks like even more secure and perhaps further page load speed. Edit: spelling
  - win32x86 9y ago
    I use urlfilterservice on my Windows 10 laptop. It works well for me. https://www.urlfilterservice.net https://www.urlfilterservice.net
  - 9y ago

javajosh 9y ago

The trade-off is that hosts file blocks more processes, but the browser plugin updates more frequently.

Amezarak 9y ago

Just browsing through the "fake news" section that hosts file is ridiculous. There's a tremendous number of completely legitimate news sources that are blocked and many that, while lurid, are not in any sense "fake news." The list includes both liberal and conservative legitimate news sites.

FabHK 9y ago

A convenient GUI app for managing the hosts file on macOS machines is Gas Mask, btw. You can have a local hosts file to block your pet peeves, then subscribe to a remote hosts file (such as the one linked above), and activate the combined hosts file. https://github.com/2ndalpha/gasmask/releases https://github.com/2ndalpha/gasmask/releases

DavideNL 9y ago
I personally find this one better: SwitchHosts https://github.com/oldj/SwitchHosts https://github.com/oldj/SwitchHosts

Metaception 9y ago

Any browser plugin is inferior to using a hosts file. This is objectively false. A hosts file blocklist cannot: - Global blacklist and whitelist select URLs - Block all sub-domains of a given URL - Block third-party iframes and scripts (with whitelist) A hosts file's feature set is not a superset of a browser based solution and the two complement each other.

dredmorbius 9y ago
DNSMasq can and does accomplish the first two items on your list, largely in hosts-file format. Mind, I use both hosts and uMatrix. Each has its place.

flsh42 9y ago

And together with the tool gasmask on Mac OS the list is a perfect tool to really block FB.