Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn any link into a suspicious-looking one

verylegit.link

Post reply on HN
Print view View original

11–20 of 103 posts

Re: Turn any link into a suspicious-looking one

#14

Post by dredmorbius »

jessaustin wrote: post #9
dredmorbius wrote: post #4

I've DNS blackholed the entire .link TLD, along with .science, .country, .click, and .rocks. So, there's that. (DNSMasq, router-based blocklist.)

Do you care to share the reasons you've taken this decision?

Direct personal realisation, an increasingly take-no-prisoners approach to online abuse, and a considerable amount of evidence from elsewhere that such TLDs are almost entirely void of value.

My router doesn't have sufficient resources to list individual hosts, particularly where widespread abuse is found. Plus it's just too much fucking work.

BlueCoat Security (now part of Symantec) have been publishing a "Shady TLD series".

https://www.symantec.com/connect/blogs/floating-down-stream-...

Basically: to 2-3 nines, these TLDs are nothing but trouble. If they can't clean up their own acts, fuck 'em.

And let that be warning to other TLD registrars.

Re: Turn any link into a suspicious-looking one

#16

Post by dredmorbius »

dlgeek wrote: post #15
dredmorbius wrote: post #4

I've DNS blackholed the entire .link TLD, along with .science, .country, .click, and .rocks. So, there's that. (DNSMasq, router-based blocklist.)

Should also consider .top. It's along with .science as the biggest offenders for me.

That's on Bluecoat's list.

My set (dnsmasq format):

     # Shady TLDs (see BlueCoat)
     address=/.accountant/0.0.0.0
     address=/.christmas/0.0.0.0
     address=/.click/0.0.0.0
     address=/.country/0.0.0.0
     address=/.cricket/0.0.0.0
     address=/.date/0.0.0.0
     address=/.download/0.0.0.0
     address=/.faith/0.0.0.0
     address=/.gdn/0.0.0.0
     address=/.gq/0.0.0.0
     address=/.kim/0.0.0.0
     address=/.link/0.0.0.0
     address=/.loan/0.0.0.0
     address=/.mom/0.0.0.0
     address=/.ninja/0.0.0.0
     address=/.online/0.0.0.0
     address=/.racing/0.0.0.0
     address=/.rocks/0.0.0.0
     address=/.science/0.0.0.0
     address=/.space/0.0.0.0
     address=/.stream/0.0.0.0
     address=/.top/0.0.0.0
     address=/.win/0.0.0.0
     address=/.work/0.0.0.0
     address=/.xin/0.0.0.0
     address=/.xyz/0.0.0.0
     address=/.zip/0.0.0.0
Checking:

    $ host i.am.the.top
    i.am.the.top has address 0.0.0.0

Re: Turn any link into a suspicious-looking one

#17

Post by nandhp »

SimeVidas wrote: post #7
nandhp wrote: post #5

Is there any way to get SSL error messages in Firefox? https://irc.verylegit.link/0x8c*download()194mobiads(windows... is supposed to redirect to Facebook, and it does if you use HTTP. However, over HTTPS Firefox just gives me a very generic "Secure Connection Failed" message. (Chrome is rather more helpful, giving me "ERR_CONNECTION_CLOSED".)

Click the (i) icon to the left of the URL in the address bar, the the `>` button, then “More information” at the bottom. The technical details say the connection is not encrypted.

Yes, I found that, but that's not even an inadequate error message -- it's just wrong. Firefox has no way to tell if the connection is encrypted or not because the connection is being dropped while the encryption is being established.

Re: Turn any link into a suspicious-looking one

#18

Post by geofft »

dredmorbius wrote: post #4

I've DNS blackholed the entire .link TLD, along with .science, .country, .click, and .rocks. So, there's that. (DNSMasq, router-based blocklist.)

How's your signal-to-noise ratio? Is this the first legit site you've wanted to access on one of those TLDs?

Re: Turn any link into a suspicious-looking one

#19

Post by cyphar »

dredmorbius wrote: post #14
jessaustin wrote: post #9

Earlier quoted context omitted.

Do you care to share the reasons you've taken this decision?

Direct personal realisation, an increasingly take-no-prisoners approach to online abuse, and a considerable amount of evidence from elsewhere that such TLDs are almost entirely void of value. My router doesn't have sufficient resources to list individual hosts, particularly where widespread abuse is found. Plus it's just too much fucking work. BlueCoat Security (now part of Symantec) have been publishing a "Shady TLD…

As an aside, BlueCoat is not a very reputable company. They are responsible for the government-sponsored censorship of Burma's and Syria's internet[1]. Which means that Symantec is currently the (American) company responsible for the censorship blacklist of Syria and Burma.

[1]: http://surveillance.rsf.org/en/blue-coat-2/

Post reply on HN