Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocklist of all Facebook domains

github.com

Post reply on HN
Print view View original

111–120 of 152 posts

Re: Blocklist of all Facebook domains

#111

Post by pdkl95 »

r3bl wrote: post #47
Thasc wrote: post #31

Earlier quoted context omitted.

This is probably a reaction to the news that Facebook is now officially tracking non-users to create shadow profiles and serve adverts to them off Facebook itself. I think it's the serve-adverts-off-Facebook-itself part that's the actual news; all of the moderately chilling tracking and profile construction was of course happening already. http://www.theverge.com/2016/5/27/11795248/facebook-ad-netwo...

And yet, Google started going down a similar path since December 2009 when they introduced personalized searches for non-logged-in users and nobody tries to block them.

> nobody tries to block them

This is factually incorrect. Just because you haven't personally seen people block Google domains doesn't mean those people don't exist. I've blocked many Google domains for a long time. Not only was GA the first domain in my blacklist, it's also the domain that many of my non-technical friends/family wanted blocked.

Re: Blocklist of all Facebook domains

#112

Post by AnthonyMouse »

jethro_tell wrote: post #107
hueving wrote: post #98

Earlier quoted context omitted.

That doesn't make any sense. You can block outbound just fine by having your block rules followed by a default allow. You don't need anything to be stateful when you are blocking whole IP addresses.

So this has to assume that it's not a whitelisting setup and put a default allow. Which if you do outbound whitelisting, kinda fucks things up.

Nothing prevents you from having explicit deny rules followed by explicit allow rules followed by default deny.

And if you're already doing outbound whitelisting (which is generally much more trouble than it's worth) then unless you put Facebook on the whitelist you don't need to do anything anyway.

Re: Blocklist of all Facebook domains

#113

Post by hanspeter »

zxcvcxz wrote: post #52

Honest question because I seriously don't know: Is facebook really worse than google when it comes to privacy? I kind of wonder who exactly are the people telling everyone to block facebook everywhere while everyone seems to collectively ignore google. Google and facebook seem to both purposely ignore the known implications of their data collection programs. They likely have handed over data to the NSA, and we know t…

> Is facebook really worse than google when it comes to privacy?

No. In my view Google (has the potential to) collect a lot more sensitive data than Facebook. All Facebook knows is who my friends are and stuff like what things I like and where I've been - mostly things that I wouldn't mind being public anyway. Google knows everything I search for, every email I receive and every web page I visit.

Re: Blocklist of all Facebook domains

#114

Post by Animats »

marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Right. Since Facebook has

    fdda274d380ki4frcgi-rumjfjai1460158783-sonar.xx.fbcdn.net
there are probably many more like that.

Re: Blocklist of all Facebook domains

#115

Post by cheiVia0 »

gorhill wrote: post #79
cheiVia0 wrote: post #53

Earlier quoted context omitted.

uBlock Origin can handle hosts files, so you can just add it on the bottom of the Third Party Filters tab. It will auto-update it too. https://raw.githubusercontent.com/jmdugan/blocklists/master/...

Though hosts files can be fed to uBlock Origin ("uBO"), it will enforce their content differently. With uBO, a "facebook.com" entry in a hosts file will also cause all subdomains of "facebook.com" to also be blocked, so there is no need to list all subdomains as is done here if the goal is to block "facebook.com" with uBO. If one wants to block Facebook via uBO, I personally advise to do it through dynamic filtering[…

Well, if my goal is to block all of Facebook's domains, I wouldn't complain if uBO happens also to block new.sub.domain.fbcdn.net even if it's not in the hosts file :)

Does uBO optimize these cases, though? E.g. if there's "apps.facebook.com", "connect.facebook.net" and plain "facebook.com", does it collapse to just 1 filter (facebook.com)? I see it says "880 used out of 881" which is the number of entries in the file.

Re: Blocklist of all Facebook domains

#116

Post by cloudjacker »

marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

I was at a hackathon a few weekends ago, and to my surprise I needed to register a domain name and get an SSL certificate for it.

I thought I was unreconcilably blocked for the duration of the hackathon, as DNS propagation disclaimers give itself 72 hours, and SSL certificates require who knows what.

I was able to get a completely new domain with Amazon Route 53 and Amazon's free SSL certificates in 20 minutes.

So yeah, I would say these blocklists are futile now, in OP's format.

Re: Blocklist of all Facebook domains

#117

Post by Thaxll »

marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

If they use a CDN that CDIR doesn't belong to FB you're screwed. afair they're using Akamai

Re: Blocklist of all Facebook domains

#118

Post by djKianoosh »

Borating wrote: post #28
Namidairo wrote: post #14

Earlier quoted context omitted.

My first impression when I saw it was something along the lines of "this would be so much cleaner if one were writing this as a dnsmasq config"

I agree. From this project I discover FreeContributor [1], which use dnsmasq has a DNSBL. [1] https://github.com/tbds/FreeContributor

Is it possible to apply this at the network level? I want to update my home router easily so that all devices in my home can benefit, not just my own laptop (since most of these lists are just updating /etc/hosts)

Re: Blocklist of all Facebook domains

#119

Post by jlgaddis »

dredmorbius wrote: post #110
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

I'm surprised that AS-based blocking tools aren't already more prevalent and readily available. AS information isn't trivially available, though you can do a pretty good job through tools like the CIDR Report and ASN Routeviews. There are quite substantial portions of the Internet to which I'd generally provide very little or very limited access if I had my druthers.

ARIN, et al, provide WHOIS servers that will map IP address information to ASNs. The list of all registered ASNs is also public. Also, there are routing registries which can provide even more information on which ASNs announce which prefixes.

Most of what you'd want is out there, but you might have to obtain it all and doing a bit of work to combine/correlate i all.

Re: Blocklist of all Facebook domains

#120

Post by jlgaddis »

puddintane wrote: post #59
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Very interesting after looking up the AS number [1] you provided it includes domains that are not on that GitHub list - as you mentioned. I would have to agree with this being the better method to blocking facebook. [1] http://www.tcpiputils.com/browse/as/32934 * note there are more than average ads on this site and it's a bit plain but this was the only one I could find that, with my brief searching, showed ip prefi…

It's also possible that Facebook has prefixes they use that are announced by ASNs other than their own.
Post reply on HN