5 ms·

Windows 8-10 users that use Windows Defender will notice that some hosts file entries will be ignored (like popular domains like facebook.com). You will also ne

Windows 8-10 users that use Windows Defender will notice that some hosts file entries will be ignored (like popular domains like facebook.com). You will also need to add an exception to the hosts file in Windows Defender.

retox 9y ago
I wonder what their rational for this is. I know in the past malware have modified the hosts file to block malware removal tool domains but why ignore entries for Facebook? I heard that blackholing requests to Microsoft telemetry URLs also has no effect. Any way of finding the unlockable list I wonder.
- ReverseCold 9y ago
  > why ignore entries for Facebook? Malware would redirect facebook.com to some scam site probably. Given how popular FB is, Microsoft decided to "fix" this. (This is all a hypothetical, I don't actually know this for sure.)
  - Skunkleton 9y ago
    I mean, considering the use of 99.9% of Windows PCs out there it probably make sense.
RachelF 9y ago
Windows 8-10 users will also notice that host file entries for any Microsoft or Bing entries will be ignored. I guess they hardware the IPs into Windows.
- dspillett 9y ago
  > I guess they hardware the IPs into Windows. More likely they just bypass looking at the local hosts file for such names, so the request always goes out to your DNS servers. Therefore blocking these names by redirecting to 127.0.0.1 will work if done at your DNS server (for instance if you run an instance of https://pi-hole.net/ https://pi-hole.net/ for that). Unless of course they make the lookup use specific name servers that they run, instead of the local resolvers that your machine is configured to look at, for those names but that is less likely.
  - stordoff 9y ago
    In that last case, you can often redirect those queries if they are standard DNS requests on your router. That's how my local network is configured -- all DNS requests are sent to my Pi-hole instance, except those coming from the Pi-hole itself. Even something like: nslookup google-analytics.com 8.8.8.8 will return a local IP: Server: google-public-dns-a.google.com Address: 8.8.8.8 Name: google-analytics.com Addresses: 192.168.1.2
jocoda 9y ago
citation please. I've seen claims that the hosts file on Windows get modified by Microsoft, but that has not been my experience to date, so would like some proof of Microsoft modifying, ignoring the hosts file. Would be extremely pissed to learn this.

retox 9y ago

I wonder what their rational for this is. I know in the past malware have modified the hosts file to block malware removal tool domains but why ignore entries for Facebook? I heard that blackholing requests to Microsoft telemetry URLs also has no effect. Any way of finding the unlockable list I wonder.

ReverseCold 9y ago
> why ignore entries for Facebook? Malware would redirect facebook.com to some scam site probably. Given how popular FB is, Microsoft decided to "fix" this. (This is all a hypothetical, I don't actually know this for sure.)
- Skunkleton 9y ago
  I mean, considering the use of 99.9% of Windows PCs out there it probably make sense.

RachelF 9y ago

Windows 8-10 users will also notice that host file entries for any Microsoft or Bing entries will be ignored. I guess they hardware the IPs into Windows.

dspillett 9y ago
> I guess they hardware the IPs into Windows. More likely they just bypass looking at the local hosts file for such names, so the request always goes out to your DNS servers. Therefore blocking these names by redirecting to 127.0.0.1 will work if done at your DNS server (for instance if you run an instance of https://pi-hole.net/ https://pi-hole.net/ for that). Unless of course they make the lookup use specific name servers that they run, instead of the local resolvers that your machine is configured to look at, for those names but that is less likely.
- stordoff 9y ago
  In that last case, you can often redirect those queries if they are standard DNS requests on your router. That's how my local network is configured -- all DNS requests are sent to my Pi-hole instance, except those coming from the Pi-hole itself. Even something like: nslookup google-analytics.com 8.8.8.8 will return a local IP: Server: google-public-dns-a.google.com Address: 8.8.8.8 Name: google-analytics.com Addresses: 192.168.1.2

jocoda 9y ago

citation please. I've seen claims that the hosts file on Windows get modified by Microsoft, but that has not been my experience to date, so would like some proof of Microsoft modifying, ignoring the hosts file. Would be extremely pissed to learn this.