Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocklist of all Facebook domains

github.com

Post reply on HN
Print view View original

141–150 of 152 posts

Re: Blocklist of all Facebook domains

#141

Post by tripzilch »

maaaats wrote: post #9

Would wildcard support in hosts files be too heavy for the performance needed? Most of these are subdomains that *.facebook.com would have blocked.

> Would wildcard support in hosts files be too heavy for the performance needed?

Can anyone explain me why wildcard support for blocklists would require more performance?

Assuming it's just basic wildcards, not full regex.

Seems to me that 1) with wildcards you need to check less bytes per entry and 2) since the list itself will be shorter you need to check less entries.

Do any of these filtering tools compile the list (offline) to a minimal state machine or a trie? That would probably max performance (and benefits from wildcards too).

Re: Blocklist of all Facebook domains

#142

Post by iam-TJ »

With the help of a couple of prefix aggregation tools [1] [2], the BASH shell, and the RIPE database, it is straightforward to block any Autonomous System with, e.g:

    $ ASN=32934; for IP in 4 6; do \
     whois -h riswhois.ripe.net \!${IP/4/g}as${ASN} |\
      sed -n '2 p' | tr \  \\n | aggregate${IP/4/} |\
       while read NET; do echo ip${IP/4/}tables -I OUTPUT -d ${NET} -j REJECT;\
     done; done
(note this command uses echo to show the command it could execute)

[1] aggregate http://packages.ubuntu.com/source/xenial/aggregate

[2] aggregate6 https://github.com/job/aggregate6

Re: Blocklist of all Facebook domains

#143

Post by fanf2 »

yrro wrote: post #78
kazinator wrote: post #65

It's inefficient to specify a large number of hosts in the facebook.com domain instead of blocking the whole domain. For this, you can run dnsmasq and use the "--address" option or "address" command in dnsmasq.conf: $ man dnsmasq [...] -A, --address=/ /[domain/] Specify an IP address to return for any host in the given domains. Queries in the domains are never forwarded and always replied to with the specified IP add…

Is there the concept of an 'administratively prohibited' error in the DNS? So your resolver could return an error with that code rather than an incorrect result.

Sadly not. The closest match is probably SERVFAIL, but that covers all sorts of problems. (SERVFAIL is what a validating recursive server will return if its upstream tries to NXDOMAIN a signed domain.)

Re: Blocklist of all Facebook domains

#144

Post by mioelnir »

dredmorbius wrote: post #133
droopyEyelids wrote: post #44

Earlier quoted context omitted.

Facebook only has one AS?

That's fairly typical. An AS (identified by an ASN) is an autonomous system . It's comprised of multiple CIDR blocks , contiguous regions of IP addresses. The network definition (by CIDR block) is fairly dynamic, as blocks can be added, deleted, or consolidated. An autonomous system is a single administrative domain over public IP space. Essentially, autonomous systems are what the Internet is inter-networking betwee…

And if you end up with more than one AS due to a merge, you usually pick one them as your primary and connect the other ones to it, then announce their prefixes from your primary, ie. your primary AS becomes transit for your other ones. That way you only have to maintain one external border.

Re: Blocklist of all Facebook domains

#145

Post by chriswarbo »

elcapitan wrote: post #102
joeblau wrote: post #39

Will there be a point where the government will step in or is all of this tracking within fair use of non-logged in Facebook users visiting a website?

If they regulate it, they will probably do it like in the EU where you have to click on some super-annoying "I agree to cookies bla bla bla" thing entering any website, which just trains people to automatically agree.

That was really frustrating. As a UK Web developer at the time, I understood the ruling as preventing the use of client-side tracking technology without an opt-in; this would have included tracking cookies, supercookies, web beacons, etc., but wouldn't include non-tracking uses required for functionality, like "remember me" tickboxes.

It looked like a good first step to tackling rampant privacy violation, but at the last moment the Information Commissioner caved in to bullshit claims that the ruling would cause the collapse of all Web businesses. The enforcement was changed from "not allowed unless opted-in" into "visiting a site counts as opting in".

The end result is not only completely ineffective, as it basically changes nothing; it's also resulted in the profileration of ridiculous "by using our site you agree to our use of cookies" messages, which just annoy without doing anything.

Re: Blocklist of all Facebook domains

#146

Post by chriswarbo »

I've been blocking facebook for years (nowhere near as comprehensive as this list though).

Many of the most unfortunate problems with these sites are social in nature rather than technical. For example, no matter how much I plead with people not to, they keep uploading information about me to these type of sites, including photographs with timestamps and GPS location metadata, which they then "tag" my face as being me.

I don't have any idea how much of this information is even out there, since these sites require signing up in order to find out. Maybe I should look into my rights under data protection legislation...

Re: Blocklist of all Facebook domains

#147

Post by __DarkBlue »

DavideNL wrote: post #140
__DarkBlue wrote: post #137

Earlier quoted context omitted.

Blocking at the firewall works best for me. If any OS X users want to know how, I've covered it here: https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...

Awesome, thanks for posting this, i have been searching for exactly this...!

You're very welcome. :-)

Re: Blocklist of all Facebook domains

#150

Post by ew »

chriswarbo wrote: post #146

I've been blocking facebook for years (nowhere near as comprehensive as this list though). Many of the most unfortunate problems with these sites are social in nature rather than technical. For example, no matter how much I plead with people not to, they keep uploading information about me to these type of sites, including photographs with timestamps and GPS location metadata, which they then "tag" my face as being m…

Who are you that you are so worried about this?
Post reply on HN