Show HN: Hostsctl – Control /etc/hosts easily, block ads, social networks, etc | Hacker News Reader

hosts easily, block ads, social networks, etc

github.com

45 points0xl3vi26 comments

I think (on linux, at least), its better to implement this as a nss- module (/etc/nsswitch.conf). You can do things like lookup a hashtable, automatically update databases, etc without having to rewrite system config files.

Also this does not protect you from programs that perform their own dns lookups, and ignore /etc/hosts and /etc/resolv.conf entirely!

What's the advantage of that? How does it protect you against programs that perform their own lookups?

oh nss modules wouldn't either. Perhaps intercepting and rewriting every dns request would be needed.

I would reccomend PiHole [1] for something like this.

Not only is it more robust, it acts as a DNS/HTTP server that blocks this kind of stuff on a whole network.

1: https://github.com/pi-hole/pi-hole

This is pretty cool, I was not aware of this project, thanks for sharing.

I like this and could use something like it, but you should use POSIX sh (/bin/sh) and not rely on Bash in the shebang as well as non-portable functionality it introduces.

This wouldn't work out of the box on FreeBSD.

I recommend this tool: https://www.shellcheck.net/

Related discussion from several years ago: https://news.ycombinator.com/item?id=5264405

Interesting in the demo that pings to 127.0.0.1 fail. Is that a common setup for some distribution to block icmp on the localhost if?

No, it's my firewall setup. I blocked ICMP for security reasons on my servers (:

Which actual security benefits do you get from blocking ICMP? Is that really worth it, considering that you break Path MTU Discovery, rendering your servers unusable for some people?

For example: https://github.com/inquisb/icmpsh.

"my servers" is my home servers not some "web servers". Maybe it's just me (: ( paranoid on security )

http://shouldiblockicmp.com

While it's good to be proactive about security, it is also helpful to understand why blocking icmp (particularly wholesale) is a bad idea.

I had a network guy tell me the other day that he is blocking traceroute for "security reasons". I can't even... =(

I made the mistake the other day of reminding my work colleagues of a certain instructional video relating to traceroute that did the rounds some years ago. Now they are joyfully calling it "Tracer T" all of the time. (-:

Why resolve blocked domains to 127.0.0.1 anyway? Wouldn't 0.0.0.1 work better?

My thought exactly. I send to 0.0.0.0 instead of 127.0.0.1.

Also, my go to site for hosts is: http://someonewhocares.org/hosts/

and I am more than happy to share that on Windows/Firefox I use a combo of AdBlock+ and NoScript so I only allow FB, and the other "socials" to run their crap ONLY on their own websites and not on others (e.g. the -tracking- "like" buttons on CNN)

0.0.0.0 is not a valid host ip

0.0.0.1 will actually make a TCP connection on the network whereas the loopback won't.

    $ ping 0.0.0.1
    connect: Invalid argument
    $ ncat 0.0.0.1 80
    Ncat: Invalid argument.

How about the performance? Big host files AFAIK perform rather bad

With AWK? did you tesed this? we are not using sed(1).

no with the host file in general. I did this once (a while ago) and i did notice a difference in website loading speed when i put 1000 lines into that thing

This was a problem solved in 1983. Read RFC 882 and RFC 883.

One caveat: all your custom enabled/disabled hosts disappear after "update" command.

WIP

Use dnsmasq and then you can wildcard the subdomains

Hostctl => as sinkholectl

Reply on news.ycombinator.com