I have a fantastic HOSTS file (where can I post it for others tobenefit)?

On Sat, 30 Aug 2014 10:09:58 -0300, Shadow wrote:

Hey !!! That's MY hosts file. Thief !!

Here is a list of updated hosts files ...
https://github.com/StevenBlack/hosts

MVPs.org Hosts file
http://winhelp2002.mvps.org/hosts.htm, updated monthly, or thereabouts.
Dan Pollock
http://someonewhocares.org/hosts/ updated regularly.
Malware Domain List
http://www.malwaredomainlist.com/, updated regularly.
Peter Lowe
http://pgl.yoyo.org/adservers/, updated regularly.
hpHosts
http://hosts-file.net/, updated regularly

On Fri, 29 Aug 2014 23:46:37 +0000, Ned Turnbull wrote:

I have a fantastic hosts file, improved over years

As an aside, a friend *thought* he was contacting Toshiba
Technical Support based on this official-looking web page:
http:// toshibatechssupport (dot) com
But, it was the classic Indian Technical Support Scam, so,
I am adding that web page to my hosts file pronto!

On 2014-08-30, Big Al wrote:
Ned Turnbull wrote on 8/29/2014 7:46 PM:
Where can I post a 25,000 line text file for others to benefit?

I have a fantastic hosts file, improved over years, always adding
the MVP hosts file to it, and adding about a thousand obnoxious
domains that I've run into such that I almost never see a valid
popup browser (they pop up, but they are all unfound). I never
see in-page ads either.
snip

I'm going to ask, but let's not dwell on this, but in the vein of this
subject: How does one go about finding out all these bogus host
addresses so you can build your own HOST file. Or even, other than
the one link I did see, are there starter lists available?

running a tcpdump, or wireshark looking at traffic on port 53 will
tell you the names of all the hosts your computer is contacting
you then need to decide which ones you want to ban

This all sounds like a great idea, and everyone SHOULD be doing it.

it's a great way to break the internet, you have to be careful not to
break off any important bits. fortunately any breakage you cause is
localised to your computer.

You've all made a great case between all the posts. I just can't
figure out how to get the links. I do clear cookies from my browser,
and I guess those would be a good start. Things like click.net,
adtracket.com etc. You can be sure when the names are that clear.

yeah, I don't think the internet needs _them_.

--
umop apisdn


--- news://freenews.netfront.net/ - complaints: ---

On 2014-08-30, Ned Turnbull wrote:
On Sat, 30 Aug 2014 15:56:19 +0200, J.O. Aho wrote:

the hosts file was never intended for this amount of hosts and this
makes things slower...

On Linux, it does not seem to have any deleterious effect on speed.

yeah, I added 250000 entries to my hosts file and it has added about
52 milliseconds to host lookup times.

my test was :

time ping -c1 google.com

I took the best 3 of 7

I used this to add the entries,

d=google.com ; for ((x=0 ; x10000 ; ++x )) ; do echo 127.0.0.1 \
a$x.$d b$x.$d c$x.$d d$x.$d e$x.$d f$x.$d g$x.$d h$x.$d i$x.$d j$x.$d \
k$x.$d l$x.$d m$x.$d n$x.$d o$x.$d p$x.$d q$x.$d r$x.$d s$x.$d t$x.$d \
u$x.$d v$x.$d w$x.$d x$x.$d y$x.$d ; done /etc/hosts

--
umop apisdn


--- news://freenews.netfront.net/ - complaints: ---

On 2014-08-30, Ned Turnbull wrote:
On Sat, 30 Aug 2014 15:56:19 +0200, J.O. Aho wrote:

Hosts file has the negative side, you need to copy it to each and every
machine you have, including portable devices

Portable devices require root, unfortunately.

But, how can copying a text file to Windows, Linux, and Mac be harder
than trying to get a huge number of programs to perform the same task
to work on all these platforms?

opendns

--
umop apisdn


--- news://freenews.netfront.net/ - complaints: ---

On 2014-08-30, J.O. Aho wrote:
On 30/08/14 23:30, Ned Turnbull wrote:
On Sat, 30 Aug 2014 23:03:06 +0200, Peter Köhlmann wrote:

That task is "slowing down each and every network connection"?
Brilliant, you found it

I have noticed absolutely no slowdown, when I run a speedtest.net
with and without a hosts file.

It's not about the speed you get to a already connected site, it's about
the extra time it take to connect to the site, the time waisted on
looking through the hosts file.

Measure it.

I have work related experiences where some customers got into issues
where they even timed out on some connections.

the only way they'd time out is if a host they need is listed and the listed
destination is dropping packets.

--
umop apisdn


--- news://freenews.netfront.net/ - complaints: ---

On 2014-08-30, Ned Turnbull wrote:
On Sat, 30 Aug 2014 14:09:49 -0400, Mayayana wrote:

servers can just keep changing the subdomain to thwart your
HOSTS file. You might have entries for 200 Doubleclick subdomains,
but you don't have an entry for the one they might create next week.

Very true.

I, for one, wish the HOSTS file format allowed for regular expressions.


I think djbdns allows regular expressions.
bind will do wildcards
squid allows arbitrary expressions

--
umop apisdn


--- news://freenews.netfront.net/ - complaints: ---

On 2014-08-30, wrote:
On 8/29/2014 6:46 PM, Ned Turnbull wrote:
Where can I post a 25,000 line text file for others to benefit?

I have a fantastic hosts file, improved over years, always adding
the MVP hosts file to it, and adding about a thousand obnoxious
domains that I've run into such that I almost never see a valid
popup browser (they pop up, but they are all unfound). I never
see in-page ads either.

Yes, I know that many of you use pop up blockers, and hence you have
no need for a great hosts file. Yes I know many of you use noscript,
and ghostery and all sorts of spyware blasters.

This isn't about that.
This is simply about the hosts text file. Period.
And how to upload it so that others can benefit from my effort.

All this is asking is *where* I can post my excellent HOSTS file
so that others may benefit from using it?

It's looooooong (it's almost 25K lines long!).

I just want to post it, as a text file, so others can use it and
improve it. What location do you suggest?


You need to verify that the additions you have put
on your file over the years are still relevant. There
is a program available for download that will check
each and every one, and it takes hours, if not days,
to check as many as you have. I'm sorry but I can't
recall the name of this utility.

if linux I wouldn't waste time searching for it.

you just need to run nslookup on all the domain names,

n=0 ; cut '-d#' -f1 /etc/hosts | cut -f2- -d' ' | tr ' \t' '\n' |
grep . | while read x ; do ( nslookup $x | grep NXDOMAIN )&
(( (++n % 100) == 0 )) && wait ; done

--
umop apisdn


--- news://freenews.netfront.net/ - complaints: ---

I assume that " resolve this issue" refers to changing from 127.0.0.1
to 0.0.0.0

There's also a dhcp service that needs to be turned off,
which, on very long hosts files, would otherwise cause a problem.

This is a bug in Windows that is about 20 years old, so, they
"may" have finally fixed it by how (I don't know as I no longer
boot to Windows ever since they killed XP I went to Linux).

If you're referring to the Windows DNS service, there is debate as to
whether that service needs to be disabled with a large HOST file. I
allow it to run and notice no difference in Win8.

AFAIK, DHCP needs to be enabled to provide network IPs. I certainly
got nowhere when it was disabled.

On Sat, 30 Aug 2014 21:30:39 +0000 (UTC), Ned Turnbull
wrote:

On Sat, 30 Aug 2014 23:03:06 +0200, Peter Köhlmann wrote:

That task is "slowing down each and every network connection"?
Brilliant, you found it

I have noticed absolutely no slowdown, when I run a speedtest.net
with and without a hosts file.

I notice absolutely no slowdown when I access web pages, with
and without the hosts file.

In fact, things *speed* up, because far fewer background
sites are being connected to.

If the 127.0.0.1 syntax is "slowing" you down, the 0.0.0.0
synax on Win8 machines might help, but, this site says the
speed difference is minuscule.
http://someonewhocares.org/hosts/

http://www.dslreports.com/forum/r246...127001-vs-0000
quote
Using 0.0.0.0 instead of 127.0.0.1 is indeed faster because you don't
have to wait for a timeout. It also does not interfere if you are
running a web server on the local PC.
/quote

http://www.dslreports.com/forum/remark,16790135
quote
The browser doesn't know you don't have a server waiting for
connections on localhost - for instance proxomitron, or even a server
daemon web interface. So it has to try and make a connection, and
depending on your setup, wait for a time out (especially if you use a
SPF that "stealths" ports.

0 or 0.0.0.0 is not a valid IP address - it just errors the connection
immediately unless the program is really badly written without even
basic error checking. As others have said, it likely doesn't even
spend time creating the TCP connection, much less a packet to send...
/quote

Ned Turnbull wrote:
On Fri, 29 Aug 2014 23:46:37 +0000, Ned Turnbull wrote:

I have a fantastic hosts file, improved over years

As an aside, a friend *thought* he was contacting Toshiba
Technical Support based on this official-looking web page:
http:// toshibatechssupport (dot) com
But, it was the classic Indian Technical Support Scam, so,
I am adding that web page to my hosts file pronto!

Did you actually call the freephone number, Ned?

1-866-283-6613

Did your friend?

--
First they ignore you, then they laugh at you, then they fight you, then
you win.

On Sun, 31 Aug 2014 03:17:26 -0500, M.L. wrote:

On Sat, 30 Aug 2014 21:30:39 +0000 (UTC), Ned Turnbull
wrote:

On Sat, 30 Aug 2014 23:03:06 +0200, Peter Köhlmann wrote:

That task is "slowing down each and every network connection"?
Brilliant, you found it

I have noticed absolutely no slowdown, when I run a speedtest.net
with and without a hosts file.

I notice absolutely no slowdown when I access web pages, with
and without the hosts file.

In fact, things *speed* up, because far fewer background
sites are being connected to.

If the 127.0.0.1 syntax is "slowing" you down, the 0.0.0.0
synax on Win8 machines might help, but, this site says the
speed difference is minuscule.
http://someonewhocares.org/hosts/

http://www.dslreports.com/forum/r246...127001-vs-0000
quote
Using 0.0.0.0 instead of 127.0.0.1 is indeed faster because you don't
have to wait for a timeout. It also does not interfere if you are
running a web server on the local PC.
/quote

http://www.dslreports.com/forum/remark,16790135
quote
The browser doesn't know you don't have a server waiting for
connections on localhost - for instance proxomitron, or even a server
daemon web interface. So it has to try and make a connection, and
depending on your setup, wait for a time out (especially if you use a
SPF that "stealths" ports.

0 or 0.0.0.0 is not a valid IP address - it just errors the connection
immediately unless the program is really badly written without even
basic error checking. As others have said, it likely doesn't even
spend time creating the TCP connection, much less a packet to send...
/quote

0.0.0.0/0 is a network address in CIDR notation. It's used in routing to
say send packets whose destination address either by network or host isn't
described in the routing table to the default gateway. You cannot assign
any network address to a host. That's just gibberish. The IP stack would
just drop it if it even got that far.

--
p-0.0-h the cat

Internet Terrorist, Mass sock puppeteer, Agent provocateur, Gutter rat,
Devil incarnate, Linux user#666, ******* hacker, Resident evil, Monkey Boy,
Certifiable criminal, Spineless cowardly scum, textbook Psychopath,
the SCOURGE, l33t p00h d3 tr0ll, p00h == lam3r, p00h == tr0ll, troll
infâme, the OVERCAT [The BEARPAIR are dead, and we are its
murderers], lowlife troll, shyster [pending approval by STATE_TERROR],
cripple, sociopath, kook, smug prick, smartarse, arsehole, moron, idiot,
imbecile, snittish scumbag, liar, total ******* retard, and shill.

Honorary SHYSTER and FRAUD awarded for services to Haberdashery.
By Appointment to God Frank-Lin.

Signature integrity check
md5 Checksum: be0b2a8c486d83ce7db9a459b26c4896

On Sun, 31 Aug 2014 02:46:50 -0500, M.L. wrote:

If you're referring to the Windows DNS service,

Ah, yes. My bad. That was it.

On Sun, 31 Aug 2014 03:17:26 -0500, M.L. wrote:

0 or 0.0.0.0 is not a valid IP address - it just errors the connection

Does the 0.0.0.0 work on Linux also?
Or just Windows?

| There's also a dhcp service that needs to be turned off,
| which, on very long hosts files, would otherwise cause a problem.
|
| This is a bug in Windows that is about 20 years old, so, they
| "may" have finally fixed it by how (I don't know as I no longer
| boot to Windows ever since they killed XP I went to Linux).
|
| If you're referring to the Windows DNS service, there is debate as to
| whether that service needs to be disabled with a large HOST file. I
| allow it to run and notice no difference in Win8.
|
| AFAIK, DHCP needs to be enabled to provide network IPs. I certainly
| got nowhere when it was disabled.

I don't know about problems with DHCP and HOSTS file,
but for most people neither DHCP nor DNS service is
necessary. I'm not sure exactly what DNS service is. It
seems to be for use only within an intranet. DHCP is needed
if your machine is being assigned a dynamic IP address.

I have both services disabled and use a fixed IP address
for the router. There's no problem with leaving DHCP enabled,
as far as I know, but I found that it was one of the few things
running under svchost that actually needs to go outbound.
Svchost, by wrapping numerous services, is a veiled security
and privacy risk. By using a fixed IP I can disable DHCP and
that allows me to block svchost through the firewall.