Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocklist of all Facebook domains

github.com

Post reply on HN
Print view View original

131–140 of 152 posts

Re: Blocklist of all Facebook domains

#131

Post by dredmorbius »

jlgaddis wrote: post #119
dredmorbius wrote: post #110

Earlier quoted context omitted.

I'm surprised that AS-based blocking tools aren't already more prevalent and readily available. AS information isn't trivially available, though you can do a pretty good job through tools like the CIDR Report and ASN Routeviews. There are quite substantial portions of the Internet to which I'd generally provide very little or very limited access if I had my druthers.

ARIN, et al, provide WHOIS servers that will map IP address information to ASNs. The list of all registered ASNs is also public. Also, there are routing registries which can provide even more information on which ASNs announce which prefixes. Most of what you'd want is out there, but you might have to obtain it all and doing a bit of work to combine/correlate i all.

That's kind of what I was trying to say.

Re: Blocklist of all Facebook domains

#132

Post by dredmorbius »

lsaferite wrote: post #43
punnerud wrote: post #19

This does just the same: .facebook.com .facebook.com .fbcdn.com .fbcdn.net .facebook.com.edgekey.net .facebook.com.edgesuite.net .instagram.com .instagramstatic-a.akamaihd.net .instagramstatic-a.akamaihd.net.edgesuite.net .cdninstagram.com .tfbnw.net .whatsapp.com .fbsbx.com facebook-web-clients.appspot.com .fb.me fbcdn-profile-a.akamaihd.net h-ct-m-fbx.fbsbx.com.online-metrix.net ac-h-ct-m-fbx.fbsbx.com.online-metri…

You can't do wildcards in a hosts file.

You can with dnsmasq.

http://www.thekelleys.org.uk/dnsmasq/doc.html

Re: Blocklist of all Facebook domains

#133

Post by dredmorbius »

droopyEyelids wrote: post #44
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Facebook only has one AS?

That's fairly typical.

An AS (identified by an ASN) is an autonomous system. It's comprised of multiple CIDR blocks, contiguous regions of IP addresses. The network definition (by CIDR block) is fairly dynamic, as blocks can be added, deleted, or consolidated.

An autonomous system is a single administrative domain over public IP space. Essentially, autonomous systems are what the Internet is inter-networking between, through BGP (border gateway protocol). BGP and AS are what Cisco (and other router) gear are ultimately all about.

So yes: organisations typically have one AS. Exceptions are typically the result of corporate mergers (not uncommon) or government space (where the domains are large).

(Disclaimer: I'm not a networking bithead, don't muck with routers much, and have a rough knowledge of much of this, though it should be vaguely accurate.)

Re: Blocklist of all Facebook domains

#134

Post by pixl97 »

rochacon wrote: post #13
mfo wrote: post #2

I just want to say "Privacy matters, thanks you" (even more when FB decided to leverage their like/share button for a global ad netwotk) :-) non tech saavy guys may love a simple .sh / .bat to automatically add those entries to the /etc/hosts on windows & unix

curl https://raw.githubusercontent.com/jmdugan/blocklists/master/corporations/facebook/all | sudo tee -a /etc/hosts

Data straight from the net into a system file as root...

You are a bad, bad man Mr Rochacon.

Re: Blocklist of all Facebook domains

#135

Post by jmdugan »

marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

completely agree. unfortunately dnsmasq, firewalls, running your own bind, or PF, table, or the other solutions you mention -- these all require a level of technical expertise far, far beyond the norm, or even 2 standard deviations above the norm of Internet users' technical ability (for some of them, including me). I had maintained the Facebook blocklist for hosts files because it was super simple for me to use, and to share with others.

definitely not ideal, not even complete, and requires work - BUT, nearly any Internet user can implement the solution done this way.

It would be really interesting to autogenerate the domain lists by running background scripts on AS numbers, polling DNS for every IP in the range, and cataloging the domains by script - say, daily, and then printing the list into a 0.0.0.0 prefixed hosts list. Thank you!

disclaimer: github user maintaining linked resource

Re: Blocklist of all Facebook domains

#137

Post by __DarkBlue »

marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Blocking at the firewall works best for me. If any OS X users want to know how, I've covered it here: https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...

Re: Blocklist of all Facebook domains

#138

Post by simunaga »

coderholic wrote: post #94
simunaga wrote: post #91

Earlier quoted context omitted.

what's AS number? how can I find out what a AS number for a domain or ip address is?

You can use https://ipinfo.io - either search at https://ipinfo.io/countries/us , or use the API (note the org field): $ curl ipinfo.io/`dig +short facebook.com | head -n1` { "ip": "69.171.230.68", "hostname": "edge-star-mini-shv-17-prn1.facebook.com", "city": "Menlo Park", "region": "California", "country": "US", "loc": "37.4590,-122.1781", "org": "AS32934 Facebook, Inc.", "postal": "94025" } See https://ipinfo.io/d…

ipinfo.io retrieves this information from somewhere. can I and how obtain this information myself, from the very source?

Re: Blocklist of all Facebook domains

#139

Post by simunaga »

jlgaddis wrote: post #122
simunaga wrote: post #91

Earlier quoted context omitted.

what's AS number? how can I find out what a AS number for a domain or ip address is?

https://en.wikipedia.org/wiki/Autonomous_system_(Internet)

maybe you know.

can I and how obtain this information myself, from the very source, for a given domain name or company or whatever it is?

Re: Blocklist of all Facebook domains

#140

Post by DavideNL »

__DarkBlue wrote: post #137
marios wrote: post #15

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets). If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables…

Blocking at the firewall works best for me. If any OS X users want to know how, I've covered it here: https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...

Awesome, thanks for posting this, i have been searching for exactly this...!
Post reply on HN