Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocklist of all Facebook domains

github.com

Post reply on HN
Print view View original

91–100 of 152 posts

Re: Blocklist of all Facebook domains

#91

Post by simunaga »

marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

what's AS number? how can I find out what a AS number for a domain or ip address is?

Re: Blocklist of all Facebook domains

#92

Post by coderholic »

droopyEyelids wrote: post #44
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Facebook only has one AS?

Yes, http://ipinfo.io/AS32934. True for most organizations: http://ipinfo.io/countries/us

Re: Blocklist of all Facebook domains

#93

Post by coderholic »

puddintane wrote: post #59
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Very interesting after looking up the AS number [1] you provided it includes domains that are not on that GitHub list - as you mentioned. I would have to agree with this being the better method to blocking facebook. [1] http://www.tcpiputils.com/browse/as/32934 * note there are more than average ads on this site and it's a bit plain but this was the only one I could find that, with my brief searching, showed ip prefi…

https://ipinfo.io/AS32934

You can also confirm this is the only ASN for Facebook by searching for Facebook at https://ipinfo.io/countries/us

Re: Blocklist of all Facebook domains

#94

Post by coderholic »

simunaga wrote: post #91
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

what's AS number? how can I find out what a AS number for a domain or ip address is?

You can use https://ipinfo.io - either search at https://ipinfo.io/countries/us, or use the API (note the org field):

    $ curl ipinfo.io/`dig +short facebook.com | head -n1`
    {
      "ip": "69.171.230.68",
      "hostname": "edge-star-mini-shv-17-prn1.facebook.com",
      "city": "Menlo Park",
      "region": "California",
     "country": "US",
      "loc": "37.4590,-122.1781",
      "org": "AS32934 Facebook, Inc.",
      "postal": "94025"
    }
See https://ipinfo.io/developers for more details

Re: Blocklist of all Facebook domains

#95

Post by Symbiote »

simunaga wrote: post #91
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

what's AS number? how can I find out what a AS number for a domain or ip address is?

http://lmgtfy.com/?q=AS+number

etc.

Re: Blocklist of all Facebook domains

#97

Post by renaudg »

barkbro wrote: post #73
r3bl wrote: post #47

Earlier quoted context omitted.

And yet, Google started going down a similar path since December 2009 when they introduced personalized searches for non-logged-in users and nobody tries to block them.

The problem with blocking all google doains is the amount of sites it would break. Youtube, gmail, googleapis for js libraries, google's blog platform, maps based on google maps and more would break.

Technically true, but blocking all Facebook domains breaks comments on many sites and the login feature on a few crucial ones too.

It also 100% breaks your social life, but maybe there's little of that left to disrupt anyway, amongst the typical target audience for these lists :P

Re: Blocklist of all Facebook domains

#98

Post by hueving »

jethro_tell wrote: post #85
bogomipz wrote: post #51

Earlier quoted context omitted.

Why would you wait and drop the traffic inbound? Why would you let your browser send the SYNs at all? This rule doesn't make any sense.

Because most people don't block outbound and certainly not in a stateful way which means it's a poor place or a blacklist. To get this to work outbound, you need to allow all other traffic out (fine that's probably what you are doing already) or have a curated whitelist of other traffic allowed out. I assume this package doesn't want to make that assumption so the safe thing to do is to make an inbound blacklist.

That doesn't make any sense. You can block outbound just fine by having your block rules followed by a default allow. You don't need anything to be stateful when you are blocking whole IP addresses.

Re: Blocklist of all Facebook domains

#100

Post by renaudg »

Namidairo wrote: post #7
curiousgal wrote: post #4

>On Windows 7, the default AV security scan will try to remove the # facebook.com entry Wat?

I'm guessing some sort of crude malware tried to MitM Facebook logins so they started cleaning host files?

This sounds like the most likely reason, rather than the "Microsoft is a FB investor" conspiracy BS.

Occam's razor, people.

Post reply on HN