7 ms·
Block Adware and Malware with /etc/hosts
- nashashmi 3y agoA tech as old as Kazaa lite. But people like to use heavy ram chrome browser extension to do the same thing.
- jsheard 3y agoIt's not the same thing, browser extensions can block at a much more granular level than entire hostnames.
- yjftsjthsd-h 3y agoEr, is uBo a RAM hog? Glancing at mine right now it's consuming ~36 MB, i.e. about the same as a single small tab.
- dbg31415 3y agoWorks good for blocking fake news and sites you don’t want your elderly parents getting tangled with.
- alecco 3y agohttps://github.com/Ultimate-Hosts-Blacklist/Ultimate.Hosts.Blacklist https://github.com/Ultimate-Hosts-Blacklist/Ultimate.Hosts.B... Don't forget about hosts.deny (but you probably need it at your router if you are behind one).
- jarebear6expepj 3y agoShell scripts that download more shell scripts. Kind of terrifying, no? I feel like I would personally rather take my chances getting scammed out of a CS skin than running these installers as root at will.
- alecco 3y agoDownload the raw file.
- numpad0 3y agoDidn’t work well for me last time I tried, I think entire IPv4 stopped for ~5min on each reboot with this.
- miles 3y agoTo resolve in Windows 10[1]: Disable DNS Client by changing the value data for HKLM\SYSTEM\ControlSet001\Services\Dnscache\Start from 2 (automatic) to 4 (disabled) (recent versions of Windows 10 no longer allow disabling DNS Client via services.msc). [1] https://tinyapps.org/blog/201809300700_large_hosts_file.html https://tinyapps.org/blog/201809300700_large_hosts_file.html
- miles 3y agoTo ensure there are no nefarious redirects in such a massive list, this one-liner comes in handy[1]: grep -v '#' steves_hosts | awk '{print $1}'| sort | uniq -c [1] https://news.ycombinator.com/item?id=11456562 https://news.ycombinator.com/item?id=11456562
- hda111 3y agoWhat is a nefarious redirect? Does it look for entries without 127.0.0.1?
- miles 3y agoA redirect to some unexpected IP address. Here's what the output looks like: 190625 0.0.0.0 3 127.0.0.1 1 255.255.255.255 3 ::1 1 fe80::1%lo0 2 ff00::0 1 ff02::1 1 ff02::2 1 ff02::3
- 8organicbits 3y agoThere's a concern that a malicious list could point domain names to a malicious IP address. I don't think its a big concern with https:// https:// since the cert will be invalid, but it's still a concern.
- DaiPlusPlus 3y agoI suspect it’s very likely that somewhere in the world is a domain-validation server, used by a trusted CA, which has this very anti-advertising hosts file installed onto it.
- 8organicbits 3y agoWhy? A CA would be unable to issue certificates for advertising sites with that configuration.
- DaiPlusPlus 3y ago
- star-glider 3y agoThis is the default list used by the pihole project as well; it's a very good list. FWIW, something like ublock origin is going to be better for in-browser blocking (for example, DNS poisoning won't work with youtube ads, which are served from youtube.com, but addins like UBO can remove them because they can hook into the actual traffic). The ultimate adblocking solution is to use UBO in your browsers AND spin up a pihole to block ads on your entire network: https://pi-hole.net/ https://pi-hole.net/
- wnevets 3y agopi-hole also makes it super easy to block .zip and .mov TLDs.
- ozim 3y agoDon't forget .com which is executable extension.
- wnevets 3y agoI'm not worried about the non-techies being tricked into thinking .com is an executable, I doubt they even know its possible. They almost certainly know about .zips
- eli 3y agoI still don't understand the threat model here. Is there an example of how this could be used as part of an attack?
- wnevets 3y agohttps://thehackernews.com/2023/05/dont-click-that-zip-file-phishers.html https://thehackernews.com/2023/05/dont-click-that-zip-file-p... edit: HN is actually erroring out if I post an example .zip domain of the problem
- ndsipa_pomu 3y agoReminds me of SlashDot where there was a relatively well known submitter that was a huge proponent of host-based ad blocking on Windows and was also a proponent of getting very angry at almost anyone else. (Edit: typo)
- TheNewsIsHere 3y agoThat’s the most believable thing I’ve read on the Internet for ages. Slashdot has a, shall we say _engaged_, community.
- sumtechguy 3y agoheh I made the mistake of engaging with that once. oh boy.... They could not wrap their head around the idea that the hosts method is limited in some use cases. This could not be blocked without blocking the main host too. https://example.com/adverts-folder/advert.jpg https://example.com/adverts-folder/advert.jpg Now it sort of works in practice as most of the advert networks do not host on the same domain. It is good at catching out whole bad domains but partial ones it is not very good at. Which some domains will do using a reverse proxy. Also at one point a hosts file was linear scan. No sort of hashing or binary search lookup. Not sure if that was ever fixed in windows or linux. So a small number of hosts it was ok. But as the file grows it starts to add up.
- ndsipa_pomu 3y agoI'm half expecting a torrent of abuse in reply to you now from whoever that was
- sumtechguy 3y agooh no...
- fullstop 3y agoPlus you can't forget Natalie Portman and Hot grits down your pants. What a strange place that was.
- unethical_ban 3y agoThe only problem with this is that on interface up/down it can take a few minutes for the network to be available. This may not be an issue with a server or idle desktop but may be confusing for non tech people or laptop users. If you can manage it, a pihole/pivpn instance may be better. Both of those can be installed on any debian distro easily.
- microtonal 3y agoOn the Mac the new Little Snitch Mini is really nice for this: https://www.obdev.at/products/littlesnitch-mini/index.html https://www.obdev.at/products/littlesnitch-mini/index.html Sure, you could manage /etc/hosts manually, but Little Snitch Mini has a nice interface for managing blocklists, auto-updates them, and has nice visualization, and you can also manage blocks per app.
- Tarq0n 3y agoPortmaster is the best Windows alternative I've found.
- todorov84 3y agoDoes anyone have any updates on Mike Burgess (from winhelp2002.mvps.org)? He used to keep my go-to hosts file, but his health seems to have declined in the last few years. I would like to know if he is still around and if there is currently any method to donate or support him. Any news would be greatly appreciated.
- hungrigekatze 3y agoI used to use this hosts file some years ago: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/ Forgot about it for a few years, but this post jogged my memory. We currently use a PiHole for house-wide, network-wide ad and telemetry blocking, though, but perhaps that hosts list is useful to someone else.
- tobinfekkes 3y agoI've been using this list locally and on my PiHole for years. Love it!
- JdeBP 3y agoIt's almost the 40th anniversary of RFC 882. Back when the Domain Name System was being invented as the replacement for everyone sharing hosts files, I wonder whether anyone expected that 40 years later there'd be a shared hosts file with its own copyright licence, Docker file, and code of conduct. Interestingly, from what I remember of the April Fools columns of electronics magazines of the time, one thing that people would not have been surprised by is that the purpose was zapping advertisements. * https://worldradiohistory.com/UK/Electronics-Today-UK/80s/Electronics-Today-1986-04.pdf#page=26 https://worldradiohistory.com/UK/Electronics-Today-UK/80s/El...
- Havoc 3y agoMuch better to do so at router level via pihole or Adguard Home. That way it catches the calling home from all the various electronics too
- joeywas 3y agoYes. pihole coupled with a router that can intercept outbound traffic on port 53 and force it to the pihole is how my home network is configured. That way it catches all those sneaky devices that have hard coded dns servers.
- briHass 3y agoI've also added (pfSense with pfBlocker) a list-rule to block all Public DNS servers (https://public-dns.info/ https://public-dns.info/). If you want to resolve a name, you gotta go through my DNS server. The UDP:53 block gets almost everything, but I'm preparing for DoH.
- raptorraver 3y agoRelated to this, my best cure against procrastination has been adding some distracing websites to /etc/hosts and pointing them to localhost.
- commandlinefan 3y agoI use Brave (not so much for the built-in ad block, but mostly because it's not actually Chrome) and I've noticed that more and more sites have ad-block detection that appears to work by sending a unique token to their ad server and then not loading content until after the token has been verified to have been received. I imagine there are ways around this on a per-site basis, it's generally easier to just give in and disable the ad blocker.
- kevin_thibedeau 3y agoNoScript usually bypasses this behavior. Especially when the content is delivered but hidden with JS DOM manipulation.
- zeruch 3y agoI wish NS worked on Android as a generic domain blocker
- xenophonf 3y agoThose licenses are a little silly. You can't copyright a phonebook. https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._Rural_Telephone_Service_Co https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R....
- Dwedit 3y agoNot gonna help if the malware authors decide to embed their own implementation of DNS.
- danparsonson 3y agoI think the idea is to prevent downloading malware in the first place, not to hamper it while it's running.
- charcircuit 3y ago0.0.0.0 connects to your own machine. You should not "block" domains by assigning them to 0.0.0.0. You should instead return NXDOMAIN.
- numpad0 3y agoThere's no host file syntax for NXDOMAIN, it has to be an IP. 127.0.0.1 with Port 80 assigned to a dummy page can be an alternative solution if you don't like 0.0.0.0.
- charcircuit 3y agoThe hosts file is not the right tool to do this.
- justsomehnguy 3y agoPreach. 99% of people don't understand (because they don't even try) what you can run a full resolver even on Windows machines. butmuhpihole
- imoverclocked 3y agoI’m a fan of dbab. It’s DNS based as well but pretty light weight using dnsmasq in the backend. No fancy GUI and such like pi-hole, just simple domain blocking.
- mikae1 3y agoThis isn't a functional approach in the age of DNS over HTTPS (DoH).
- 0x49d1 3y agohosts file will grow with records + you need to run specific scripts to update it. One of the similar options will be to use DNS resolver with built in filters (like pi-hole, but "cloud"), for example: https://nextdns.io https://nextdns.io, even free version is OK.
- rldjbpin 3y agointiially i wanted to point out a potential issue with using large /etc/hosts file in windows, but ended up finding a (potential) fix in this thread. regardless, after using this list for a long time, i do recommend setting up your own dns server or use a service that does (such as pi-hole and nextdns already suggested by others) with this list enabled. on mobile, i found that ad-blocking dns services that offer DNS-over-HTTPS (such as adguard dns) offer a much more elegant option that does not require an app nor configuring every network you connect to.
- anatopa 3y agoAp akmbgusnnine
- stblack 3y agoHey this is my repo! I'm happy to answer any questions arising. I must say: the lists we offer — 31 variants in all — result from fine work by all our curators. Some are extremely diligent and maintain their lists every day. It's just remarkable what dedicated people can do together over time.
- ibay770 3y agoI've noticed a speed increase by running these tools along with the hosts file: http://www.analogx.com/contents/download/Network/qdns/Freeware.htm http://www.analogx.com/contents/download/Network/qdns/Freewa... http://www.analogx.com/contents/download/network/fc/freeware.htm http://www.analogx.com/contents/download/network/fc/freeware... And https://mayakron.altervista.org/support/acrylic/Home.htm https://mayakron.altervista.org/support/acrylic/Home.htm works as well, and it also accepts wildcards.