6 ms·

Think twice before using someone else's hosts file, unless you can actually review every entry. Not that I really think anything funny is happening here, but it

by lysol 14y ago

Think twice before using someone else's hosts file, unless you can actually review every entry. Not that I really think anything funny is happening here, but it is a huge security risk to use non-authoritative DNS like this by taking someone else on their word that their hosts file is legit.

stblack 14y ago
What's the concern? It's pretty easy to see all entries point to 127.0.0.1.
- ebbv 14y ago
  You've just illustrated his point because not all entries do point to loopback.
  - deleted 14y ago
    [deleted]
  - to3m 14y ago
    if you pass it through grep, you can see that virtually every non-comment line refers to 127.0.0.1: ~/tmp% grep -v "^[[:space:]]*#" fred.txt | grep -v "^[[:space:]]*$" | grep -v 127.0.0.1 books guestbook hosts text file rss feed 0.0.0.0 0 text file old macs 0 old macs math links origami photos polls siteoftheday home Hosted by: theorem.ca how to make the internet not suck (as much) 255.255.255.255 broadcasthost ::1 localhost fe80::1%lo0 localhost Fri Feb 22 08:05:36 2013top ~/tmp% And I just realised now that the junk at the top of the output comes from me doing a Select All on the web page to highlight everything first, and it picked up the headers! Ooops. So there's in fact 3 non-comment lines that don't refer to localhost.
  - WestCoastJustin 14y ago
    Looking at the body of the text, rather than the head/footer, and excluding comments lines, here is what I get with counts: [~]$ cat hosts_example.txt | grep -v '#' | awk '{print $1}'| sort | uniq -c 56 1 ::1 9674 127.0.0.1 1 255.255.255.255 1 fe80::1%lo0
  - deleted 14y ago
    [deleted]
fwr 14y ago
If every entry routes to 127.0.0.1, what's the worst that could happen?
- yareally 14y ago
  One can also null route them as well via 0.0.0.0. Hosts tend to die instantly that way versus timing out with 127.0.0.1
  - TazeTSchnitzel 14y ago
    Routing to 127.0.0.1 is dumb for this reason, especially since you may be running something on port 80.
  - thwarted 14y ago
    Unless you have something listening on the ports that doesn't respond or a firewall that is dropping packets on the loopback interface, "connection refused" is returned right away.
  - drzaiusapelord 14y ago
    Years ago I maintained a popular ad blocking hosts file. I got a lot of complaints when I switched from 127.0.0.1 to 0.0.0.0. Some TCPIP stacks just didn't like it. Others had little webservers running on 127.0.0.1 that quickly served up 404's for speed or black jpegs to make things pretty. Someone out there maintained a little httpd for windows that did just that. If it saw a GET for blahblah.jpg it would serve up a black graphic of some random size. It sure beat the default FF or IE error message. Honestly, there's no need for this stuff in the age of browser based ad blocking. I gave up on it when I saw how easy it was to write rules and wildcards in ad block plus. Interest in it fell. I'm surprised to see one still maintained.
  - gbaygon 14y ago
    Here is the 0.0.0.0 version: http://someonewhocares.org/hosts/zero/ http://someonewhocares.org/hosts/zero/
- Zuider 14y ago

by lysol 14y ago

stblack 14y ago

What's the concern? It's pretty easy to see all entries point to 127.0.0.1.

ebbv 14y ago
You've just illustrated his point because not all entries do point to loopback.
- deleted 14y ago
  [deleted]
- to3m 14y ago
  if you pass it through grep, you can see that virtually every non-comment line refers to 127.0.0.1: ~/tmp% grep -v "^[[:space:]]*#" fred.txt | grep -v "^[[:space:]]*$" | grep -v 127.0.0.1 books guestbook hosts text file rss feed 0.0.0.0 0 text file old macs 0 old macs math links origami photos polls siteoftheday home Hosted by: theorem.ca how to make the internet not suck (as much) 255.255.255.255 broadcasthost ::1 localhost fe80::1%lo0 localhost Fri Feb 22 08:05:36 2013top ~/tmp% And I just realised now that the junk at the top of the output comes from me doing a Select All on the web page to highlight everything first, and it picked up the headers! Ooops. So there's in fact 3 non-comment lines that don't refer to localhost.
- WestCoastJustin 14y ago
  Looking at the body of the text, rather than the head/footer, and excluding comments lines, here is what I get with counts: [~]$ cat hosts_example.txt | grep -v '#' | awk '{print $1}'| sort | uniq -c 56 1 ::1 9674 127.0.0.1 1 255.255.255.255 1 fe80::1%lo0
- deleted 14y ago
  [deleted]

fwr 14y ago

If every entry routes to 127.0.0.1, what's the worst that could happen?

yareally 14y ago
One can also null route them as well via 0.0.0.0. Hosts tend to die instantly that way versus timing out with 127.0.0.1
- TazeTSchnitzel 14y ago
  Routing to 127.0.0.1 is dumb for this reason, especially since you may be running something on port 80.
- thwarted 14y ago
  Unless you have something listening on the ports that doesn't respond or a firewall that is dropping packets on the loopback interface, "connection refused" is returned right away.
- drzaiusapelord 14y ago
  Years ago I maintained a popular ad blocking hosts file. I got a lot of complaints when I switched from 127.0.0.1 to 0.0.0.0. Some TCPIP stacks just didn't like it. Others had little webservers running on 127.0.0.1 that quickly served up 404's for speed or black jpegs to make things pretty. Someone out there maintained a little httpd for windows that did just that. If it saw a GET for blahblah.jpg it would serve up a black graphic of some random size. It sure beat the default FF or IE error message. Honestly, there's no need for this stuff in the age of browser based ad blocking. I gave up on it when I saw how easy it was to write rules and wildcards in ad block plus. Interest in it fell. I'm surprised to see one still maintained.
- gbaygon 14y ago
  Here is the 0.0.0.0 version: http://someonewhocares.org/hosts/zero/ http://someonewhocares.org/hosts/zero/
Zuider 14y ago