HN Explorer

26 comments

[ 2.4 ms ] story [ 64.8 ms ] thread
tyingq
Interesting in the demo that pings to 127.0.0.1 fail. Is that a common setup for some distribution to block icmp on the localhost if?
0xl3vi
No, it's my firewall setup. I blocked ICMP for security reasons on my servers (:
mmarx
Which actual security benefits do you get from blocking ICMP? Is that really worth it, considering that you break Path MTU Discovery, rendering your servers unusable for some people?
0xl3vi
For example: https://github.com/inquisb/icmpsh.

"my servers" is my home servers not some "web servers". Maybe it's just me (: ( paranoid on security )

newman314
http://shouldiblockicmp.com

While it's good to be proactive about security, it is also helpful to understand why blocking icmp (particularly wholesale) is a bad idea.

I had a network guy tell me the other day that he is blocking traceroute for "security reasons". I can't even... =(

JdeBP
I made the mistake the other day of reminding my work colleagues of a certain instructional video relating to traceroute that did the rounds some years ago. Now they are joyfully calling it "Tracer T" all of the time. (-:
pwdisswordfish
Why resolve blocked domains to 127.0.0.1 anyway? Wouldn't 0.0.0.1 work better?
HenryBemis
My thought exactly. I send to 0.0.0.0 instead of 127.0.0.1.

Also, my go to site for hosts is: http://someonewhocares.org/hosts/

and I am more than happy to share that on Windows/Firefox I use a combo of AdBlock+ and NoScript so I only allow FB, and the other "socials" to run their crap ONLY on their own websites and not on others (e.g. the -tracking- "like" buttons on CNN)

simplehuman
0.0.0.1 will actually make a TCP connection on the network whereas the loopback won't.
pwdisswordfish 

    $ ping 0.0.0.1
    connect: Invalid argument
    $ ncat 0.0.0.1 80
    Ncat: Invalid argument.
theamk
One caveat: all your custom enabled/disabled hosts disappear after "update" command.
colemannugent
I would reccomend PiHole [1] for something like this.

Not only is it more robust, it acts as a DNS/HTTP server that blocks this kind of stuff on a whole network.

1: https://github.com/pi-hole/pi-hole

StreamBright
This is pretty cool, I was not aware of this project, thanks for sharing.
nopit
Use dnsmasq and then you can wildcard the subdomains
whacker
I think (on linux, at least), its better to implement this as a nss- module (/etc/nsswitch.conf). You can do things like lookup a hashtable, automatically update databases, etc without having to rewrite system config files.

Also this does not protect you from programs that perform their own dns lookups, and ignore /etc/hosts and /etc/resolv.conf entirely!

StavrosK
What's the advantage of that? How does it protect you against programs that perform their own lookups?
whacker
oh nss modules wouldn't either. Perhaps intercepting and rewriting every dns request would be needed.
git-pull
I like this and could use something like it, but you should use POSIX sh (/bin/sh) and not rely on Bash in the shebang as well as non-portable functionality it introduces.

This wouldn't work out of the box on FreeBSD.

I recommend this tool: https://www.shellcheck.net/

herbst
How about the performance? Big host files AFAIK perform rather bad
0xl3vi
With AWK? did you tesed this? we are not using sed(1).
herbst
no with the host file in general. I did this once (a while ago) and i did notice a difference in website loading speed when i put 1000 lines into that thing
JdeBP
This was a problem solved in 1983. Read RFC 882 and RFC 883.
gbraad
Hostctl => as sinkholectl