Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocklist of all Facebook domains

github.com

Post reply on HN
Print view View original

81–90 of 152 posts

Re: Blocklist of all Facebook domains

#81

Post by Borating »

yrro wrote: post #78
kazinator wrote: post #65

It's inefficient to specify a large number of hosts in the facebook.com domain instead of blocking the whole domain. For this, you can run dnsmasq and use the "--address" option or "address" command in dnsmasq.conf: $ man dnsmasq [...] -A, --address=/ /[domain/] Specify an IP address to return for any host in the given domains. Queries in the domains are never forwarded and always replied to with the specified IP add…

Is there the concept of an 'administratively prohibited' error in the DNS? So your resolver could return an error with that code rather than an incorrect result.

NXDOMAIN [1] ?

Dnsmasq can return nxdomain responses

echo 'server=/.example.tld/' >> /etc/dnsmasq.conf

Check dnsgate [2] or FreeContributor [3]

[1] https://www.dnsknowledge.com/whatis/nxdomain-non-existent-do...

[2] https://github.com/jakeogh/dnsgate

[3] https://github.com/tbds/FreeContributor

Re: Blocklist of all Facebook domains

#83

Post by superuser2 »

zxcvcxz wrote: post #52

Honest question because I seriously don't know: Is facebook really worse than google when it comes to privacy? I kind of wonder who exactly are the people telling everyone to block facebook everywhere while everyone seems to collectively ignore google. Google and facebook seem to both purposely ignore the known implications of their data collection programs. They likely have handed over data to the NSA, and we know t…

Not really. We know that they sell ads which can be targeted to users with specific characteristics. If you have discovered actual user data for sale from Google or Facebook, that's news.

Re: Blocklist of all Facebook domains

#84

Post by alecco »

barkbro wrote: post #73
r3bl wrote: post #47

Earlier quoted context omitted.

And yet, Google started going down a similar path since December 2009 when they introduced personalized searches for non-logged-in users and nobody tries to block them.

The problem with blocking all google doains is the amount of sites it would break. Youtube, gmail, googleapis for js libraries, google's blog platform, maps based on google maps and more would break.

Pretty terrible. We should be able to block Google tracking, too.

Re: Blocklist of all Facebook domains

#85

Post by jethro_tell »

bogomipz wrote: post #51
Borating wrote: post #30

Earlier quoted context omitted.

Like this [1], More details at [2] [1] http://www.commandlinefu.com/commands/view/16096/block-all-f... [2] http://www.tcpiputils.com/browse/as/32934

Why would you wait and drop the traffic inbound? Why would you let your browser send the SYNs at all? This rule doesn't make any sense.

Because most people don't block outbound and certainly not in a stateful way which means it's a poor place or a blacklist. To get this to work outbound, you need to allow all other traffic out (fine that's probably what you are doing already) or have a curated whitelist of other traffic allowed out. I assume this package doesn't want to make that assumption so the safe thing to do is to make an inbound blacklist.

Re: Blocklist of all Facebook domains

#86

Post by jethro_tell »

cm2187 wrote: post #20

I can understand the multiplication of sub domains, to be able to use multiple connections. But what's the rationale for the multiplication of domain names? Ad blocker avoidance?

Also literally separate domains in the sense that one team probably owns authoritative DNS for fbcdn.com and another probably owns facebook.com. with a big infrastructure, it would be negligent to allow everyone permissions to edit a domain like that. But you probably want to do permissions more like an org chart and less of a hand curated list of people who both have business reason to edit and steady hands/full understanding of DNS.

Lots of big infrastructures are pretty much put together like the internet.

Re: Blocklist of all Facebook domains

#88

Post by wmccullough »

Borating wrote: post #30
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Like this [1], More details at [2] [1] http://www.commandlinefu.com/commands/view/16096/block-all-f... [2] http://www.tcpiputils.com/browse/as/32934

O[1]k[2]

[1] https://en.m.wikipedia.org/wiki/O [2] https://en.m.wikipedia.org/wiki/K

Post reply on HN