Hacker News Reader

Comment by lysol | Hacker News Reader

Think twice before using someone else's hosts file, unless you can actually review every entry. Not that I really think anything funny is happening here, but it is a huge security risk to use non-authoritative DNS like this by taking someone else on their word that their hosts file is legit.

View on HN

If every entry routes to 127.0.0.1, what's the worst that could happen?

One can also null route them as well via 0.0.0.0. Hosts tend to die instantly that way versus timing out with 127.0.0.1

Years ago I maintained a popular ad blocking hosts file. I got a lot of complaints when I switched from 127.0.0.1 to 0.0.0.0. Some TCPIP stacks just didn't like it. Others had little webservers running on 127.0.0.1 that quickly served up 404's for speed or black jpegs to make things pretty. Someone out there maintained a little httpd for windows that did just that. If it saw a GET for blahblah.jpg it would serve up a black graphic of some random size. It sure beat the default FF or IE error message.

Honestly, there's no need for this stuff in the age of browser based ad blocking. I gave up on it when I saw how easy it was to write rules and wildcards in ad block plus. Interest in it fell. I'm surprised to see one still maintained.

Routing to 127.0.0.1 is dumb for this reason, especially since you may be running something on port 80.

Unless you have something listening on the ports that doesn't respond or a firewall that is dropping packets on the loopback interface, "connection refused" is returned right away.

Here is the 0.0.0.0 version: http://someonewhocares.org/hosts/zero/

If you were malevolent and stupid enough, you could 'remotely' hack yourself (and set your own HP printer on fire).

What's the concern? It's pretty easy to see all entries point to 127.0.0.1.

You've just illustrated his point because not all entries do point to loopback.

Looking at the body of the text, rather than the head/footer, and excluding comments lines, here is what I get with counts:

  [~]$ cat hosts_example.txt | grep -v '#' | awk '{print $1}'| sort | uniq -c
       56 
        1 ::1
     9674 127.0.0.1
        1 255.255.255.255
        1 fe80::1%lo0

if you pass it through grep, you can see that virtually every non-comment line refers to 127.0.0.1:

    ~/tmp% grep -v "^[[:space:]]*#" fred.txt | grep -v "^[[:space:]]*$" | grep -v 127.0.0.1
    books
    guestbook
    hosts
      text file
      rss feed
      0.0.0.0
      0 text file
      old macs
      0 old macs
    math links
    origami
    photos
    polls
    siteoftheday
    home
     Hosted by:
      theorem.ca
    how to make the internet not suck (as much)
    255.255.255.255	broadcasthost
    ::1		localhost
    fe80::1%lo0     localhost
    Fri Feb 22 08:05:36 2013top
    ~/tmp%

And I just realised now that the junk at the top of the output comes from me doing a Select All on the web page to highlight everything first, and it picked up the headers! Ooops. So there's in fact 3 non-comment lines that don't refer to localhost.

Reply on news.ycombinator.com