Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All-in-One DNS block list

github.com

Post reply on HN
Print view View original

41–50 of 56 posts

Re: All-in-One DNS block list

#41

Post by stblack »

surround wrote: post #30

How to make a block list: 1) Find a bunch of high-quality block lists on the internet which have been painstakingly curated my their maintainers for many years 2) Combine it all into one big list. Tell everyone that you will quickly whitelist any domains if they are causing breakage. 3) Once enough people start using your list, get an advertiser to pay you to silently remove their domains. If anyone notices, just say…

I can see how it might seem that way — I'm Steven Black.

I can point to thousands of combined...

* issues https://github.com/StevenBlack/hosts/issues?q=is%3Aissue+is%...

* ...pull requests... https://github.com/StevenBlack/hosts/pulls?q=is%3Apr+is%3Acl...

* ... and commits https://github.com/StevenBlack/hosts/commits/master

...that indicate, it's not so easy.

The sources we use are all vetted. Some sources are remarkable in terms of activity, and responsiveness to problems as they occur.

Overall I think this area is far more dynamic than many realize. Some good people curate the lists we carry.

Re: All-in-One DNS block list

#43

Post by symfoniq »

rsyring wrote: post #31
Etheryte wrote: post #13

Earlier quoted context omitted.

I'm also using NextDNS and one thing that's a huge boon for me is that the default free tier covers my use case insanely well. Given the statistics for the last 3 months I seem to consistently fly under the free tier limit but if I ever do hit it, it will just default back to a regular DNS. A very user-friendly approach and I hope they keep it as they grow.

The other option would be to pay them. :) It's great service and pretty inexpensive, why not support them?

Agreed. They couldn't take my $20 fast enough. Such a great service.

Re: All-in-One DNS block list

#44

Post by contravariant »

willis936 wrote: post #40
ciarannolan wrote: post #37

Earlier quoted context omitted.

Perhaps they can point a particular host to a malicious IP rather than "0.0.0.0". In a list of several hundred thousand domains, you wouldn't be able to notice this manually. ex., make Bank of America resolve to a phishing site rather than the real BoA IP. Pi-Hole and others might check for this though, I don't know.

I am under the impression that the blocklist programs (such as ublock origin or pi-hole) do not have an option to redirect to anything other than the void. I can only see downsides to allowing this.

Actually ublock-origin has some options to replace Javascripts with custom (presumably less intrusive) scripts. Although I don't think 3rd party lists can do this.

Anyway the repository in this post also provides host files, which most definitely can redirect you to malicious IPs.

Edit: Turns out 3rd party block lists can use the redirect feature but only to Ublock Origin managed resources: https://github.com/gorhill/uBlock/wiki/Resources-Library

Re: All-in-One DNS block list

#45

Post by lightswitch05 »

Looks like my lists are intended to be included, but it was linking to the raw Github source instead of the hosted Github pages version. I went through a major refactor 21 days ago that moved my sources lists around a bit - but preserved the links that are supplied all over the README and the Github hosted pages. So, not only is the project linking to the wrong place, but my list has been broken in it for 21 days now without notice.

Its fine that people love creating these massive all-in-one lists. But I recommend just using the sources directly. That way, if a list gives you trouble, you know who to open a ticket with, or just disable that specific list if its too aggressive for your tastes.

My lists: https://www.github.developerdan.com/hosts/

Re: All-in-One DNS block list

#46

Post by csunbird »

ciarannolan wrote: post #37
willis936 wrote: post #19

Earlier quoted context omitted.

I'm no expert, but the most obvious answer is "you MITM yourself". If there is a userbase for a list, they have to trust the list to not filter out domains that shouldn't be filtered. I have a hard time thinking how this could lead to hidden repercussions, other than some security flaw that is only exploitable when some subset of requests go through.

Perhaps they can point a particular host to a malicious IP rather than "0.0.0.0". In a list of several hundred thousand domains, you wouldn't be able to notice this manually. ex., make Bank of America resolve to a phishing site rather than the real BoA IP. Pi-Hole and others might check for this though, I don't know.

HTTPS should protect you from that.

Re: All-in-One DNS block list

#47

Post by jlgaddis »

willis936 wrote: post #40
ciarannolan wrote: post #37

Earlier quoted context omitted.

Perhaps they can point a particular host to a malicious IP rather than "0.0.0.0". In a list of several hundred thousand domains, you wouldn't be able to notice this manually. ex., make Bank of America resolve to a phishing site rather than the real BoA IP. Pi-Hole and others might check for this though, I don't know.

I am under the impression that the blocklist programs (such as ublock origin or pi-hole) do not have an option to redirect to anything other than the void. I can only see downsides to allowing this.

> ... do not have an option to redirect to anything other than the void.

Pi-hole uses dnsmasq [0], a caching DNS resolver (among other things), and includes its own customized configuration files for it.

With that level of control, Pi-hole has the ability to redirect you anywhere on the Internet that they want.

We all hope that the folks behind Pi-hole would never do such a thing -- but they do have the "option".

---

[0]: http://www.thekelleys.org.uk/dnsmasq/doc.html

Re: All-in-One DNS block list

#48

Post by jlgaddis »

bertman wrote: post #3

I really appreciate projects like this because I'm sure keeping these lists up-to-date is not an easy task, and many people benefit from the efforts. That said: maybe it's just me, but I find their website[1] a bit...strange? It looks like one of those SAAS startup landing pages, you can pick your "pack of block list" ranging from "Tru lite" to "XTreme" etc... Or maybe it's supposed to be ironic and I just don't get…

> Let's make an annoyance free better open internet, altogether!

As a part-time grammar Nazi, there are several things here that annoy the hell outta me!

After reading that, I had to quickly abort and close the tab.

Re: All-in-One DNS block list

#49

Post by tetris11 »

stblack wrote: post #17

This repo has a 3-week track record, by one contributor. Disclosure: Some of us have been actively curating such amalgamated lists for a long time. https://github.com/StevenBlack/hosts

I have been using your lists for years, and is the first thing I install on all my machines. Thank you so much for your good and tireless work!

Re: All-in-One DNS block list

#50

Post by tejtm »

ciarannolan wrote: post #37
willis936 wrote: post #19

Earlier quoted context omitted.

I'm no expert, but the most obvious answer is "you MITM yourself". If there is a userbase for a list, they have to trust the list to not filter out domains that shouldn't be filtered. I have a hard time thinking how this could lead to hidden repercussions, other than some security flaw that is only exploitable when some subset of requests go through.

Perhaps they can point a particular host to a malicious IP rather than "0.0.0.0". In a list of several hundred thousand domains, you wouldn't be able to notice this manually. ex., make Bank of America resolve to a phishing site rather than the real BoA IP. Pi-Hole and others might check for this though, I don't know.

Back before security fatigue set in, I would filter the lists through my own sanity checks for this sort of thing (never found a single one amiss after years) then point my clients at my vetted lists.
Post reply on HN