31 ms·

Blocklist Facebook domains

1349 points by z0a 9y ago

reustle 9y ago
It's a shame /etc/hosts doesn't support wildcards 0.0.0.0 *.facebook.com
- rbritton 9y ago
  You could sort of work around that by just blocking their IP ranges: https://stackoverflow.com/a/11164738 https://stackoverflow.com/a/11164738
  - topranks 9y ago
    The ranges could change over time. If you run your own DNS resolver you can use the wildcard trick. Something like this in an RPZ zone should do it: facebook.com IN CNAME . *.facebook.com IN CNAME . facebook.net IN CNAME . *.facebook.net IN CNAME . fbcdn.com IN CNAME . *.fbcdn.com IN CNAME . fbcdn.net IN CNAME . *.fbcdn.net IN CNAME . fb.com IN CNAME . *.fb.com IN CNAME . fb.me IN CNAME . *.fb.me IN CNAME . tfbnw.com IN CNAME . *.tfbnw.com IN CNAME .
    - zaarn 9y ago
      *.facebook.com IN CNAME . should be unnecessary since the DNS zone above it, facebook.com is already CNAME'd. Most resolvers will take a CNAME as "any further requests go to here", which to my experience usually includes NS servers. (This is also why you don't CNAME your root domain, CNAME conflicts with any other record type)
- joeblau 9y ago
  That would only slightly help considering they own so many TLD’s.
  - topranks 9y ago
    Looking at that lists it'd be 16 wildcard entries vs. 895 hostnames. A significant improvement.
    - boardwaalk 9y ago
      It'd be more future-proof too.
    - joeblau 9y ago
      I don't use that list, I use Steven Black's [1] list has 1004 entries which is more complete than this list. It would be less, but more than 16. Even at that, you're right it would definitely reduce the size. - [1] https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/
- vortico 9y ago
  What software actually parses /etc/hosts, at least on Linux?
  - kazinator 9y ago
    > What software actually parses /etc/hosts, at least on Linux? glibc resolver A good entry point for reading more about it: $ man nsswitch.conf If your /etc/nsswitch.conf file's "hosts" line contains the keyword "files", then it potentially uses /etc/hosts. If "files" is first (typical default config), it looks there first, before the other places listed. This is done under the hood when programs use resolver functions like gethostbyname or getaddrinfo.
    - asamarin 9y ago
      You can see this in action on musl source code, which is arguably a much more readily understandable implementation of libc: - Function that actually parses /etc/hosts is name_from_hosts(), implemented here: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n48 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is called by __lookup_name() on the same file: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n287 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is, in turn, called directly from getaddrinfo() [http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c#n49 http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...], the actual function exposed to you as libc user.
- walrus01 9y ago
  you can do this with a DNS zonefile at your local resolver, though.
- strkek 9y ago
  You might want to take a look at dnsmasq. It's a nice choice for when you want a DNS server but BIND is overkill.
jiaweihli 9y ago
I highly recommend using uMatrix[1][2] if you're very privacy-conscious. It's the full-blown everything-at-your-fingertips console. By default, it blocks third-party scripts/cookies/XHRs/frames (with an additional explicit blacklist). You then manually whitelist on a matrix which types of requests from which domains you want to allow. Your preferences are saved. It is a bit annoying the first time you visit any new domain, because you need to go through a bootstrapping whitelist process to make it work. After a while I find I do it almost automatically though. I use it in conjunction with uBlock Origin and Disconnect, and it still catches the vast majority of things. As a nice side-effect, I find I keep pretty up-to-date with new SAAS companies coming out! --- [1] https://chrome.google.com/webstore/detail/umatrix/ogfcmafjalglgifnmanfmnieipoejdcf https://chrome.google.com/webstore/detail/umatrix/ogfcmafjal... [2] https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/
- kakarot 9y ago
  I'm continuing to have issues with frames not displaying unless I completely disable the addon. It's extremely frustrating. I'm in advanced mode and all options are as they should be.
- michel__ 9y ago
  How can you recommend these extensions without mentioning NoScript?
  - e40 9y ago
    Every time this is brought up, in this context, people say the other things do what NoScript does. And, btw, I use Privacy Badger instead of Disconnect.
  - BayesStreet 9y ago
    uMatrix supercedes NoScript by a wide margin.
    - wtallis 9y ago
malloreon 9y ago
does this include instagram, messenger, and whatsapp domains too? I'm not sure if these services use their own domains. 'fb' itself will eventually be, if it's not already, just a data holding company for these and other acquisitions.
- flixic 9y ago
  Yes it does. But you could have found this out way faster by just searching on the page.
deleted 9y ago
[deleted]
throwaway84742 9y ago
Does anyone have this for Google ads domains and/or YouTube?
- amarka 9y ago
  I don't have a list that I can easily share, but you can curate your own off of https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
  - throwaway84742 9y ago
    Didn’t know about this. Thanks for the link!
rvshchwl 9y ago
This is a good thing to enable, but I think that smartphones contribute exponentially more data to Facebook services than laptops and browsers do. Smartphones give easy access to location, background running services, microphone. Even if you block these permissions to the app, Facebook gets the data from their data providers that use Facebook ads.
- rs86 9y ago
  "Exponentially" means nothing here. Perhaps you are looking for "orders of magnitude"
  - squiggleblaz 9y ago
    Well, he could be referring to the relative changes over time of what is contributed by a desktop computer and what is contributed by a smart phone. Antiprivacy features on phones seem to get better at a much faster rate than antiprivacy features on a computer.
  - nostromo 9y ago
    [amount of data collected from phones]=[amount of data collected from desktops]^[some exponent]
    - btrettel 9y ago
      If the exponent is less than 1 then the amount of data collected from phones is less than that from desktops.
      - hueving 9y ago
        When you hear 'exponential back off algorithm', do you envision one that keeps retrying faster and faster?
        btrettel 9y ago
        I'd say better than 50% chance that the delay increases. But the phrase would be unambiguous if it were called an "exponentially increasing back off algorithm".
lwhsiao 9y ago
Pi-Hole [1] is another nice way to filter domains at the DNS level network wide, if you want a wider reaching solution that supports wildcards. Great way to use an extra Pi if you have one sitting around. --- [1] https://pi-hole.net/ https://pi-hole.net/
- LeoPanthera 9y ago
  If your router is running pfSense, pfblockerng is the equivalent of pi-hole. You can put the same blocklists into it, even. Though the Steven Black combined list is usually enough on its own.
- madez 9y ago
  Sadly, Pi-Hole is not integrated into Debian. I feel uneasy running software not from the Debian repository. I hope Pi-Hole will be packaged soon.
  - moviuro 9y ago
    More bare-bones than PiHole (no white/black list), simpler too: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me
  - arbitrage 9y ago
    Debian has had its share of fuck-ups in its package management system. There's very little difference between blindly trusting debian, vs blindly trusting pihole. Don't pretend you check out the contents of all the packages you use.
    - madez 9y ago
      That is unnecessarily aggressive. Also, besides the snarkyness, it is a bad argument. What you write seems to be an appeal to hypocrisy. To see that, the following analogon might be helpful: One doesn't need to personally comprehend every decision in a democracy to have more trust in it than in a dictatorship, and one can say that without living in a democracy.
RickS 9y ago
This list presumably updates/moves around often. Is there a service that, say, subscribes to a live list of this domain set (like adblock consumes easylist) and updates my hostfile automatically? If not, that is a piece of software that I would find useful and worth paying for (with the ability to audit the software's ability to phone home about the rest of my hosts file)
- eatbitseveryday 9y ago
  It would be useful to know how to generate this list in the first place, then just adopt that to create the list on our own, instead of coming back to this github repo to sync every so often. I do not see this in the repository, presumably to get people to come back to his github repo for updates, but that's my cynicism.
- dao- 9y ago
  Your host file, hmm. Maybe something based on disconnect.me. If you're mostly worried about the browser (which seems sensible for most users), you can just enable tracking protection in Firefox: https://support.mozilla.org/en-US/kb/tracking-protection https://support.mozilla.org/en-US/kb/tracking-protection
source99 9y ago
Its actually quite annoying to block all of facebook. There are a lot of innocuous sites that have at least some small reliability on facebook and blocking all of facebook makes using these sites a tad bit difficult / poor UX.
- checkyoursudo 9y ago
  Any examples? I have blocked Facebook for many years, and I can't think of a single time where it has mattered. I run without JavaScript by default, so maybe I just don't notice those kinds of things after years of conditioning.
  - __alias 9y ago
    you run without js by default? God your internet must be boring :)
    - __jal 9y ago
      Only whitelisted sites run JS in my browser. If by 'boring', you mean vastly less annoying, yes, it is terribly boring. I'd likely never look at the bulk of commercial websites if I had to render them the way owners intended them to render.
    - freedomben 9y ago
      I block all js by default and whitelist as I go. Ironically my user experience is far better because I don't deal with intrusive dynamic behavior.
  - geoelectric 9y ago
    I imagine running without JS would be way more impactful on site function, so yeah, it wouldn't change your experience much.
frawley 9y ago
I don't see https://messenger.com https://messenger.com or https://m.me https://m.me (which also leads to messenger)
- pksadiq 9y ago
  The last commit to the file is on 4 Oct 2016. So you could expect that.
  - dang 9y ago
    Ok, we've added 2016 above. Unsurprisingly, there is recent stuff on https://github.com/jmdugan/blocklists/pulls https://github.com/jmdugan/blocklists/pulls. If anyone notices it getting updated, could you tell us? hn@ycombinator.com is best.
bhauer 9y ago
Looks like this is already covered by the "Social" add-on to StevenBlack's hosts: https://github.com/StevenBlack/hosts/blob/master/extensions/social/hosts https://github.com/StevenBlack/hosts/blob/master/extensions/...
- joeblau 9y ago
  Steven Black's list is better. More complete and also has hosts for other social outlets, ad networks and trackers to block. https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/
  - thelittleone 9y ago
    Is there a way to redirect to a local HTML file for any blacklisted host file addresses? Something like "You tried to access a site that's blocked in hosts file"? I tend to add blacklists like this then few months later wonder why some site doesn't work.
    - pentagonpapers 9y ago
      127.0.0.1 baddomain.com Run Apache on your localhost and serve up a message
    - hjek 9y ago
      Yes. As the hosts file redirects to localhosts, you can run a local server, displaying a notification. As root: while true; do printf "blocked by hosts file" |nc -q 1 -l -p 80; done
    - bencollier49 9y ago
      That won't help if the site fails due to a backend request to FB falling over.
    - bfred_it 9y ago
      You can run a server at 127.0.0.1:80, but it won’t work for HTTPS sites… unless you also configure your own certificates on the server.
paxy 9y ago
I wish it were that easy. Good start, but Facebook will still: 1. Get your data from other websites/apps that you allow 2. Get your data through your friends that use Facebook
- dwighttk 9y ago
  shouldn't this keep javascript from facebook domains from loading?
  - paxy 9y ago
    Yes, but a lot of data transfer happens on the backend without the client being involved.
    - freedomben 9y ago
      This is certainly possible but hasn't been my experience. Most of Facebook stuff is xhr that is easy to block on the client side. It's certainly possible that services are doing this on the backend, but it seems far easier to plug in Facebook's libraries in the frontend.
anonu 9y ago
I might do this. Just curious if this will break the internet for me... Will certain non Facebook pages fail to load?
drchiu 9y ago
Any way to do this at the router level?
- spaceandshit 9y ago
  Pi-hole on a raspberry pi
  - mito88 8y ago
    Beavis? :)
- craftyguy 9y ago
  If you use dnsmasq you can just save this file, set 'addn-hosts=/path/to/list' in the dnsmasq config, and restart the service.
CiPHPerCoder 9y ago
Why would you block WhatsApp?
- binarysaurus 9y ago
  Owned by FB.
  - CiPHPerCoder 9y ago
    It may be owned by Facebook, but it's one of the viable secure messaging apps for people what don't use Signal. The other is Wire.
    - 908087 9y ago
      It's only viable if you're comfortable sharing your contact list and metadata with Facebook.
      - CiPHPerCoder 9y ago
        E2E encryption that isn't MTProto? Done.
odammit 9y ago
Man, that person put in some effort. That’s a lot of good lists. Scrolling through them it’s really interesting to see the other sites companies own. I always forget WhatsApp is Facebook.
jakeogh 9y ago
My setup: https://github.com/jakeogh/dnsgate https://github.com/jakeogh/dnsgate
nielsbjerg 9y ago
The whole conversation, without having read into everything here in absolute detail, seem to be very tool oriented. Am I the only one here overwhelmed by the sheer amount of domains involved?
- Moru 9y ago
  It's mostly subdomains since windows can't use wildcards (*.domain.com). Setting up such a large hosts-file might slow down your computer a bit though. There are some tools that lets you run wildcards in the hosts-file but can't remember the names at the moment.
  - nielsbjerg 9y ago
    Again, a tool concern. Not trying to downplay the possible solutions, but rather bring attention to the magnetude
    - Moru 9y ago
      I'm not sure what you mean, I see 13 different domains in that list, the rest is subdomains of the same 13 domains. You can't count that as "sheer amount of domains". Our company probably have 2000 different subdomains on 5 domains? Subdomains we can create as we want to, it's just some letters before the domain part of the adress. Eg: Subdomain.Domain.com. That is what the wildcard is for, *.Domain.com catches them all no matter how many extra we create. Wildcarddomain is needed for example on an SSL certificate to accept any subdomain for the domain you ordered.
- snowpanda 9y ago
  It's a ridiculous amount, looks like someone just created a pull request with 500+ more facebook domains.
epiapp 9y ago
For anyone who's interested, I also maintain a tracking protection list for Internet Explorer. It's based originally on the Ghostery and Disconnect lists, but I now update it independently. It's designed to be concise and speedy, yet also comprehensive. Note, however, that due to the limitations of tracking protection lists in IE, it can't block everything. You may need to supplement it with a small hosts file. Check it out here: https://github.com/amtopel/tpl https://github.com/amtopel/tpl
walrus01 9y ago
Similar solution to blocking things at your local recursive DNS resolver, assuming you have a captive pool of devices, let's say in 10.240.0.0/24) in a LAN, all of which are given DHCP addresses and DHCP-assigned DNS resolvers, and you're in control of a bind9 server that's on the same LAN. Not going to prevent people with admin rights on their workstations from using another DNS resolver (or VPN, or whatever), but a fairly low effort solution. https://community.jisc.ac.uk/library/janet-services-documentation/how-block-or-sinkhole-domains-bind https://community.jisc.ac.uk/library/janet-services-document...
angadsg 9y ago
Created a pi-hole friendly blocklist https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9ea3cfa2bb249f5/raw/7fd0fddc08dd23ed205ec488fd5068c195662fe0/facebook.txt https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9e...
stiangrindvoll 9y ago
This is quite a powerful message!
yorby 9y ago
block all of Google's IP addresses: https://support.google.com/a/answer/60764?hl=en https://support.google.com/a/answer/60764?hl=en (note: your internet (the web) will stop working properly if you do block all of those IPs, which is a big problem)
- cbdumas 9y ago
  Can you be more specific about your internet not working with those addresses blocked? What exactly doesn't work?
  - yorby 9y ago
    it depends on what sites you are using, but I beg you to try it and I can almost guarantee you that it will break your browsing experience... (even if you aren't using google search or gmail)
  - rphlx 9y ago
    A lot of sites pull in popular js libraries from google; the idea being that they'll already be in a user's cache and even if they're not, google has a better (cheaper, faster and/or lower latency) CDN than the site author.
    - yorby 9y ago
      it's an advertising company's dream to be able to load code on most computers browsing the web....
      - rphlx 9y ago
        In their defense I believe they do tend to host that stuff on domains that do not set or retrieve the regular google tracking cookies. Though there are other tracking methods that they might still be using.
    - 908087 9y ago
      Most of this can be worked around by installing Decentraleyes, which replaces common CDN-loaded resources with local copies.
partycoder 9y ago
A blacklist approach to this is for sure a cat and mouse game. A better approach is to incrementally whitelist the domains you trust.
- cgmg 9y ago
  Not sure why you were downvoted, but this is correct. Facebook (or anyone else) can easily create more domains.
- rphlx 9y ago
  In general blacklists are a better choice overall for non-technical users. Do you really want an angry text message or phone call every time $FAMILY_MEMBER has some site that's rendering poorly because they haven't properly whitelisted one of the 12 legit domains it hits? And do you really trust them to not whitelist some ad & tracking domains?
  - megous 9y ago
    Presumably, $FAMILY_MEMBER would have to get past the phone number whitelist too. So it might not be that bad.
alcover 9y ago
I wonder how Facebook devs feel when they read such posts. Do they feel rejected ? shameful ? Does their salary really outweigh this collective disapproval of their peers ?
- madeofpalk 9y ago
  I worked for a less-than stellar online publication in Australia. Think low-budget Daily Mail. I didnt care, I still got paid and got to switch off and do my own thing when I wanted to. I'm not my job.
  - alcover 9y ago
    That is what I suspect but still.. Respect in the eye of peers is a human need. If I met a developper and learned he works for FB, it would be visible on my face that I feel somewhat put-off.
    - Analog24 9y ago
      A lot of people have more important things to worry about than the respect of their peers.
      - deleted 9y ago
        [deleted]
    - hueving 9y ago
      >Respect in the eye of peers is a human need 'Peer' is very flexible. This could be a comparison to people the same age in other careers. Also, keep in mind that Facebook engineers are constantly surrounded by other Facebook engineers so their SE peers probably do approve. They collectively don't think Facebook is a problem so they implicitly approve of each other.
  - dawnerd 9y ago
    I worked for eHow. We felt the same as the people complaining about it. But it paid the bills. Did get to learn how to scale REALLY fast.
mockindignant 9y ago
There is more coverage of this topic here: https://news.ycombinator.com/item?id=11791052 https://news.ycombinator.com/item?id=11791052
snowpanda 9y ago
Nice to see HackerNews create pull requests to make the list more up to date. I hope they get committed. https://github.com/jmdugan/blocklists/pulls https://github.com/jmdugan/blocklists/pulls
cyberferret 9y ago
Interesting to see several domain names/servers with 'mqtt' referenced. Wondering if Facebook interacts with IoT devices routinely, or perhaps they use MQTT for Messenger message transfers etc.?
Digital-Citizen 9y ago
Yet again, software freedom fighters got there years ago. Free Software Foundation got there earlier. From publishing https://www.fsf.org/facebook https://www.fsf.org/facebook published on on Dec 20, 2010. FSF & GNU Project founder Richard Stallman has been rightly objecting to Facebook for years in his talks and on his personal website at https://stallman.org/facebook.html https://stallman.org/facebook.html. Long-time former FSF lawyer Eben Moglen rightly called Facebook "a monstrous surveillance engine" and pointed out the ugliness of Facebook's endless surveillance (at length in http://snowdenandthefuture.info/PartIII.html http://snowdenandthefuture.info/PartIII.html but in other places in the same lecture series as well). See http://snowdenandthefuture.info/ http://snowdenandthefuture.info/ for the entire series of talks.
- heretoo 9y ago
  Yes, but where do they offer solutions to transition (emphasis on transition) from what people currently use to a more open ecosystem? At least in the software licensing arena, having personally visited a lecture from Stallman, I was left with the impression that he wasn't offering a solution, just a vision of a Utopia without any guidance on how to transition to it -- more specifically, how would we make money from open source software, when currently proprietary software is the default for making money.
  - hueving 9y ago
    >more specifically, how would we make money from open source software, See redhat.
  - cyphar 9y ago
    > how would we make money from open source software There are many existing examples, so this is clearly a solved problem already. You charge for support, or for feature requests, and so on. That's how SUSE and RedHat make their money. The flaw with looking at proprietary software's monitisation is that it usually just boils down to "pay for the binary". This obviously won't work with free software, you need to charge for development rather than access (though you can also use a seat-based model where you only provide support for machines that have valid licenses). (I work for SUSE.)
alpb 9y ago
This list must've updated a lot since 2016.
HenryBemis 9y ago
I want to share my favorite HOSTS file provider [1] which includes FB addresses. [1]: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/
- mito88 8y ago
  goatse! :)
computator 9y ago
I'd like to mention a problem with blocklists like this that you put into /etc/hosts. I've noticed that many sites trivially evade the blocklist by adding a redirect. I.e., if example.com is blocked, but it redirects to example.ru or example123.com or example.team, then it still works. The spammers and advertisers don't have to change all the existing links to example.com -- they simply need to add a new redirect every few weeks.
- rem7 9y ago
  that's not how /etc/hosts works. the domain listed in /etc/hosts (example.com) will point to 0.0.0.0 (or 127.0.0.1)... you'll never even make it to the server so you won't get the redirect.
  - computator 8y ago
    Oops, you're right. I discovered that it was my browser that was "helpfully" adding www in front of lots of domains I had blocked in /etc/hosts. For instance, if I blocked example.com, my browser would automatically try www.example.com (which might then redirect to something else entirely). In my case, I'm using Firefox. I can stop this behavior by setting "browser.fixup.alternate.enabled" to "false" in about:config.
ryanlol 9y ago
This is a terrible approach. Facebook can rotate many of these names whenever they feel like.
Froyoh 9y ago
Why not do something like *facebook.com?
- dredmorbius 8y ago
  Hosts syntax doesn't allow for that. DNSMasq would, however, allow you to only specify each TLD.
xyrouter 9y ago
I can block domains on my laptop, no problem. But I have not been able to figure out any convenient way to block websites on my Android phone. My Android phone comes with a Chrome browser. Any ideas about how to block websites reliably on an unrooted/jail-not-broken Android phone?
- bronco21016 9y ago
  Block at DNS level on a device (router or DNS server) and proxy all Android traffic to said device. I use a pfsense router running OpenVPN and pfblockerNG. PfblockerNG sinkholes all DNS requests to domains from a list such as this one. Then by using OpenVPN I simultaneously encrypt my connection when roaming remotely and I can specify to use my home DNS server to sinkhole ad/tracking domains.
  - xyrouter 9y ago
    Thanks for the suggestion. I think this will work fine in a home network that I can control. But this is not going to work when I am traveling and using my carrier's 4G network. Am I right? Is there any nifty solution to address the later? I am a little disappointed that I can't do something as simple as install plugins for my phone browser that can block sites.
    - moviuro 9y ago
      > But this is not going to work when I am traveling and using my carrier's 4G network. That's what VPNs are for. See openvpn, for example (or tinc, strongswan, etc)
halamadrid 9y ago
Wow the hate/dislike is very real.
knowThySelfx 9y ago
Why only Facebook? All companies which store data are suspect.
Mizza 9y ago
I made one of these for Google: https://github.com/Miserlou/nogoogle https://github.com/Miserlou/nogoogle also: https://github.com/Miserlou/Poop https://github.com/Miserlou/Poop
- throwahey 9y ago
  Your list does basically nothing for Google tracking domains. Here is mine: (note that this blocks recaptcha which a lot of websites are now using for login annoyingly). I add entries for IPv4 and IPv6 (0.0.0.0 and ::1 respectively). 0.0.0.0 google.com 0.0.0.0 www.google.com 0.0.0.0 fonts.googleapis.com 0.0.0.0 google-analytics.com 0.0.0.0 apis.google.com 0.0.0.0 tpc.googlesyndication.com 0.0.0.0 ssl.google-analytics.com 0.0.0.0 www.google-analytics.com 0.0.0.0 www-google-analytics.l.google.com 0.0.0.0 stats.g.doubleclick.net 0.0.0.0 clients.l.google.com 0.0.0.0 pagead.l.doubleclick.net 0.0.0.0 pagead2.googlesyndication.com 0.0.0.0 googleads.g.doubleclick.net 0.0.0.0 www-googletagmanager.l.google.com 0.0.0.0 googleadapis.l.google.com 0.0.0.0 gstatic.com 0.0.0.0 ssl.gstatic.com 0.0.0.0 www.gstatic.com 0.0.0.0 www.googletagservices.com 0.0.0.0 www.googletagmanager.com 0.0.0.0 securepubads.g.doubleclick.net 0.0.0.0 tpc.googlesyndication.com To login to a google service such as gmail or enable captcha, comment out the three (*.)gstatic domains.
  - mito88 8y ago
    nice!
thetruthseeker1 9y ago
Can somebody elaborate why this link from 2016 is gaining steam here? Is it because Cambridge Analytica misused FB data? May be I am missing something, do we know if facebook was wittingly complicit?
- yeahdef 9y ago
  If Facebook is negligent or complicit, I'd certainly change how I interact with the platform. I haven't kept up with the details and would love to be pointed to some summation / analysis of the facts.
- RealityVoid 9y ago
  I'm not a big fan of Facebook but I do find it useful. That being said, this feels to me like a coordinated attack campaign. Take an issue, blow it up, attach various other nebulous bad things and push it to a public that was already primed against that very service. Seems to be working great. I do not know who or why is pushing this campaign but it definitely feels organized and calculated.
- Dirlewanger 9y ago
  The sudden mainstream outrage toward Facebook is most likely because the Cambridge event is the perfect confluence of "Facebook", "Trump", and "bad".
yumraj 9y ago
Minor segue, is there any easy way to Geo-block URLs, both by ccTLDs and by geolocation of IPs from certain countries. I have pi-hole running but it doesn't support that currently, best it does is wildcard but even for that it needs domain and won't do just on the ccTLD.
- dredmorbius 8y ago
  ASNs, kinda, maybe.
tartrate 9y ago
Is it really any use trying to enumerate all variants under *.facebook.com and similar? The counts: 307 facebook.com 295 fbcdn.net 250 tfbnw.net 12 whatsapp.com 9 instagram.com 3 fb.com 3 edgesuite.net 2 metrix.net 2 fbsbx.com 2 fbcdn.com 2 facebook.net 2 edgekey.net 2 cdninstagram.com 2 akamaihd.net 1 fb.me 1 appspot.com
- Jaruzel 9y ago
  Where/How did you get that list?
  - tartrate 9y ago
    grep -Po '\w+\.\w+$' | sort | uniq -c | sort -rhk1 Bit sloppy because it doesn't pick up the domain names with dashes. But my point was that if you want to blacklist *.facebook.com you shouldn't try to enumerate every single variant of it, that's not durable.
- wodenokoto 9y ago
  My thoughts were also, why so many subdomains? I wonder if it is to make the list seem more impressive and Facebook more all-encompassing. "If you want to block facebook you need to block almost a thousand websites!"
  - skocznymroczny 9y ago
    "Then we will browse in the shade."
- SjuulJanssen 9y ago
  A bit further down in the replies reustle mentions: `It's a shame /etc/hosts doesn't support wildcards`
  - TremendousJudge 9y ago
    I find that ridiculous. Is there a reason why it's that way?
digitalbase 9y ago
Someone should start a business for this: Provide people that care about privacy with a public DNS server they can use that auto blocks those domains (and update's its lists). I would pay for it (few dollars a month) Feature suggestion: allow people to add their own entries so I can purposely block reddit or hacker news to reduce distractions. Pretty sure I would set this DNS server on both my phone and desktop.
dontchooseanick 9y ago
I advocate for iptables instead of DNS filtering. Process of enumerating and rejecting facebook IPs : * Query the RAD http://radb.net/query/ http://radb.net/query/ , search for AS32934 * Enumerate ip ranges by http://radb.net/query/?advanced_query=1 http://radb.net/query/?advanced_query=1 * Check inverse query by origin, use AS32934 * Grep the response route and route6 CIDR ranges * Build a netfilter script with REJECT Gives those scripts for iptables (updated once in a while) : * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_in_ipv4.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_in_ipv6.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_out_ipv4.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_out_ipv6.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... To enable : * iptables -I OUTPUT -j no_facebook_out * iptables -I INPUT -j no_facebook_in * ip6tables -I OUTPUT -j no_facebook_out * ip6tables -I INPUT -j no_facebook_in By design, instagram and connect-with-facebook get muted too.
- DavideNL 8y ago
  To get a list of all Facebook ip's: whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebook.list whois -h whois.radb.net '!6AS32934' | tr ' ' '\n' | grep '::' >> facebook.list
amelius 9y ago
I need something like this that I can install on friend and family's phones/iPads/computers whenever they ask me to fix something for them >:)
- FabHK 9y ago
  Gas Mask is a neat macOS app to manage hosts. You can subscribe to a remote hosts file, too.
deleted 9y ago
[deleted]
rawland 9y ago
Let's put this in global context: Adblocking is a non-trivial task, but there are trivial solutions. 1.) Install hosts-gen from http://git.r-36.net/hosts-gen/ % git clone http://git.r-36.net/hosts-gen % cd hosts-gen % sudo make install # Make sure all your custom configuration from your current /etc/hosts is # preserved in a file in /etc/hosts.d. The files have to begin with a # number, a minus and then the name. % sudo hosts-gen 2.) Install the zerohosts script. # In the above directory. % sudo cp examples/gethostszero /bin % sudo chmod 775 /bin/gethostszero % sudo /bin/gethostszero % sudo hosts-gen Add a cron job, and enjoy your faster and adfree-er internet. Further, you can add your custom (this FB) block to the local files in /etc/hosts.d, which then will be concatenated automatically. [source]: https://surf.suckless.org/files/adblock-hosts/ https://surf.suckless.org/files/adblock-hosts/
jason_slack 9y ago
Are there any implications to having 40,000+ lines in your /etc/hosts?
- nomercy400 9y ago
  It's basically a big lookup table, trading storage for speed. The most noticable effect is that your web pages load faster, because a lot requests for unnecessary data (eg. Facebook in this example) complete immediately. Occasionally you will miss out on a webpage that depends on it. Think uBlock Origin, but not for just your browser but your entire system.
  - jason_slack 9y ago
    Thanks I have used /etc/hosts for a long time. I however just realized exactly how big mine is getting.
- dredmorbius 8y ago
  I've seen no noticeable impact to 100k+ lines.
  - jason_slack 8y ago
    This is good to know. Thank you for the reply.
heckanoobs 9y ago
Why would you block all the domains but still keep your account that you would no longer be able to access? The account is the problem not the domains. You would have to block the domains on every device you use. Just kill the problem at the source and delete your entire surveillance account with facebook.
- lnx01 9y ago
  Because facebook tracks you even if you don't have an account.
dandigangi 9y ago
One of the posts I wish I could upvote more than once. Thank you.
stirner 9y ago
I wrote a small tool that translates AdBlock Plus filter lists into hosts file format [1]. It can only translate simple domain-name rules but might be of interest to people in this thread. [1] https://github.com/wwalexander/hostsblock https://github.com/wwalexander/hostsblock
- zackmorris 9y ago
  Thank you, I didn't know about the `cat -` trick to read from stdin (works the same as `echo hi | cat /dev/stdin`). Even after all this time, I still learn something new every day.
  - stirner 8y ago
    echo hi | cat - is also equivalent to echo hi | cat You only need the - if you are concatenating other files with stdin [1]. Incidentally, any use of echo x | y can be replaced (at least in Bash) with y <<< "x" This is called a "here string" [2]. [1] https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBSD+9.1-RELEASE https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBS... [2] http://tldp.org/LDP/abs/html/x17837.html http://tldp.org/LDP/abs/html/x17837.html
imhelpingu 9y ago
It's pathetic that it takes a literal propaganda campaign to make people see the problem with facebook after 10 years, but whatever I'll take it.
Pete_D 9y ago
A lot of commenters mention dnsmasq. I wrote some scripts a while ago to help minimize a dnsmasq config that had been generated from a hosts file. People in this thread might find them useful. https://petedeas.co.uk/dnsmasq/ https://petedeas.co.uk/dnsmasq/
DavideNL 9y ago
on macOS i use a bash script to get all Facebook ip addresses: whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > "/etc/pf.anchors/usr.home.sub/facebook.list" and then use a pfctl anchor to block them all table <facebook> persist file "/etc/pf.anchors/usr.home.sub/facebook.list" block drop quick to <facebook>
mito88 8y ago
merci.
mito88 8y ago
what is the difference between 0.0.0.0 and 127.0.0.1 with respect to redire ction? will redirecting to localhost eat more cpu cycles?
- dredmorbius 8y ago
  0.0.0.0 is no host. 127.0.0.1 is localhost, and will still generate a query. If you've a webserver there, its logs might get busy with the blocked traffic requests.
ChoGGi 8y ago
The list has fbcdn-profile-a.akamaihd.net, but it missed fbcdn-creative-a.akamaihd.net If anyone wants it

1349 points by z0a 9y ago

reustle 9y ago

It's a shame /etc/hosts doesn't support wildcards 0.0.0.0 *.facebook.com

rbritton 9y ago
You could sort of work around that by just blocking their IP ranges: https://stackoverflow.com/a/11164738 https://stackoverflow.com/a/11164738
- topranks 9y ago
  The ranges could change over time. If you run your own DNS resolver you can use the wildcard trick. Something like this in an RPZ zone should do it: facebook.com IN CNAME . *.facebook.com IN CNAME . facebook.net IN CNAME . *.facebook.net IN CNAME . fbcdn.com IN CNAME . *.fbcdn.com IN CNAME . fbcdn.net IN CNAME . *.fbcdn.net IN CNAME . fb.com IN CNAME . *.fb.com IN CNAME . fb.me IN CNAME . *.fb.me IN CNAME . tfbnw.com IN CNAME . *.tfbnw.com IN CNAME .
  - zaarn 9y ago
    *.facebook.com IN CNAME . should be unnecessary since the DNS zone above it, facebook.com is already CNAME'd. Most resolvers will take a CNAME as "any further requests go to here", which to my experience usually includes NS servers. (This is also why you don't CNAME your root domain, CNAME conflicts with any other record type)
joeblau 9y ago
That would only slightly help considering they own so many TLD’s.
- topranks 9y ago
  Looking at that lists it'd be 16 wildcard entries vs. 895 hostnames. A significant improvement.
  - boardwaalk 9y ago
    It'd be more future-proof too.
  - joeblau 9y ago
    I don't use that list, I use Steven Black's [1] list has 1004 entries which is more complete than this list. It would be less, but more than 16. Even at that, you're right it would definitely reduce the size. - [1] https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/
vortico 9y ago
What software actually parses /etc/hosts, at least on Linux?
- kazinator 9y ago
  > What software actually parses /etc/hosts, at least on Linux? glibc resolver A good entry point for reading more about it: $ man nsswitch.conf If your /etc/nsswitch.conf file's "hosts" line contains the keyword "files", then it potentially uses /etc/hosts. If "files" is first (typical default config), it looks there first, before the other places listed. This is done under the hood when programs use resolver functions like gethostbyname or getaddrinfo.
  - asamarin 9y ago
    You can see this in action on musl source code, which is arguably a much more readily understandable implementation of libc: - Function that actually parses /etc/hosts is name_from_hosts(), implemented here: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n48 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is called by __lookup_name() on the same file: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n287 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is, in turn, called directly from getaddrinfo() [http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c#n49 http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...], the actual function exposed to you as libc user.
walrus01 9y ago
you can do this with a DNS zonefile at your local resolver, though.
strkek 9y ago
You might want to take a look at dnsmasq. It's a nice choice for when you want a DNS server but BIND is overkill.

jiaweihli 9y ago

I highly recommend using uMatrix[1][2] if you're very privacy-conscious. It's the full-blown everything-at-your-fingertips console. By default, it blocks third-party scripts/cookies/XHRs/frames (with an additional explicit blacklist). You then manually whitelist on a matrix which types of requests from which domains you want to allow. Your preferences are saved. It is a bit annoying the first time you visit any new domain, because you need to go through a bootstrapping whitelist process to make it work. After a while I find I do it almost automatically though. I use it in conjunction with uBlock Origin and Disconnect, and it still catches the vast majority of things. As a nice side-effect, I find I keep pretty up-to-date with new SAAS companies coming out! --- [1] https://chrome.google.com/webstore/detail/umatrix/ogfcmafjalglgifnmanfmnieipoejdcf https://chrome.google.com/webstore/detail/umatrix/ogfcmafjal... [2] https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/

kakarot 9y ago
I'm continuing to have issues with frames not displaying unless I completely disable the addon. It's extremely frustrating. I'm in advanced mode and all options are as they should be.
michel__ 9y ago
How can you recommend these extensions without mentioning NoScript?
- e40 9y ago
  Every time this is brought up, in this context, people say the other things do what NoScript does. And, btw, I use Privacy Badger instead of Disconnect.
- BayesStreet 9y ago
  uMatrix supercedes NoScript by a wide margin.
  - wtallis 9y ago

malloreon 9y ago

does this include instagram, messenger, and whatsapp domains too? I'm not sure if these services use their own domains. 'fb' itself will eventually be, if it's not already, just a data holding company for these and other acquisitions.

flixic 9y ago
Yes it does. But you could have found this out way faster by just searching on the page.

deleted 9y ago

[deleted]

throwaway84742 9y ago

Does anyone have this for Google ads domains and/or YouTube?

amarka 9y ago
I don't have a list that I can easily share, but you can curate your own off of https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- throwaway84742 9y ago
  Didn’t know about this. Thanks for the link!

rvshchwl 9y ago

This is a good thing to enable, but I think that smartphones contribute exponentially more data to Facebook services than laptops and browsers do. Smartphones give easy access to location, background running services, microphone. Even if you block these permissions to the app, Facebook gets the data from their data providers that use Facebook ads.

rs86 9y ago
"Exponentially" means nothing here. Perhaps you are looking for "orders of magnitude"
- squiggleblaz 9y ago
  Well, he could be referring to the relative changes over time of what is contributed by a desktop computer and what is contributed by a smart phone. Antiprivacy features on phones seem to get better at a much faster rate than antiprivacy features on a computer.
- nostromo 9y ago
  [amount of data collected from phones]=[amount of data collected from desktops]^[some exponent]
  - btrettel 9y ago
    If the exponent is less than 1 then the amount of data collected from phones is less than that from desktops.
    - hueving 9y ago
      When you hear 'exponential back off algorithm', do you envision one that keeps retrying faster and faster?
      - btrettel 9y ago
        I'd say better than 50% chance that the delay increases. But the phrase would be unambiguous if it were called an "exponentially increasing back off algorithm".

lwhsiao 9y ago

Pi-Hole [1] is another nice way to filter domains at the DNS level network wide, if you want a wider reaching solution that supports wildcards. Great way to use an extra Pi if you have one sitting around. --- [1] https://pi-hole.net/ https://pi-hole.net/

LeoPanthera 9y ago
If your router is running pfSense, pfblockerng is the equivalent of pi-hole. You can put the same blocklists into it, even. Though the Steven Black combined list is usually enough on its own.
madez 9y ago
Sadly, Pi-Hole is not integrated into Debian. I feel uneasy running software not from the Debian repository. I hope Pi-Hole will be packaged soon.
- moviuro 9y ago
  More bare-bones than PiHole (no white/black list), simpler too: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me
- arbitrage 9y ago
  Debian has had its share of fuck-ups in its package management system. There's very little difference between blindly trusting debian, vs blindly trusting pihole. Don't pretend you check out the contents of all the packages you use.
  - madez 9y ago
    That is unnecessarily aggressive. Also, besides the snarkyness, it is a bad argument. What you write seems to be an appeal to hypocrisy. To see that, the following analogon might be helpful: One doesn't need to personally comprehend every decision in a democracy to have more trust in it than in a dictatorship, and one can say that without living in a democracy.

RickS 9y ago

This list presumably updates/moves around often. Is there a service that, say, subscribes to a live list of this domain set (like adblock consumes easylist) and updates my hostfile automatically? If not, that is a piece of software that I would find useful and worth paying for (with the ability to audit the software's ability to phone home about the rest of my hosts file)

eatbitseveryday 9y ago
It would be useful to know how to generate this list in the first place, then just adopt that to create the list on our own, instead of coming back to this github repo to sync every so often. I do not see this in the repository, presumably to get people to come back to his github repo for updates, but that's my cynicism.
dao- 9y ago
Your host file, hmm. Maybe something based on disconnect.me. If you're mostly worried about the browser (which seems sensible for most users), you can just enable tracking protection in Firefox: https://support.mozilla.org/en-US/kb/tracking-protection https://support.mozilla.org/en-US/kb/tracking-protection

source99 9y ago

Its actually quite annoying to block all of facebook. There are a lot of innocuous sites that have at least some small reliability on facebook and blocking all of facebook makes using these sites a tad bit difficult / poor UX.

checkyoursudo 9y ago
Any examples? I have blocked Facebook for many years, and I can't think of a single time where it has mattered. I run without JavaScript by default, so maybe I just don't notice those kinds of things after years of conditioning.
- __alias 9y ago
  you run without js by default? God your internet must be boring :)
  - __jal 9y ago
    Only whitelisted sites run JS in my browser. If by 'boring', you mean vastly less annoying, yes, it is terribly boring. I'd likely never look at the bulk of commercial websites if I had to render them the way owners intended them to render.
  - freedomben 9y ago
    I block all js by default and whitelist as I go. Ironically my user experience is far better because I don't deal with intrusive dynamic behavior.
- geoelectric 9y ago
  I imagine running without JS would be way more impactful on site function, so yeah, it wouldn't change your experience much.

frawley 9y ago

I don't see https://messenger.com https://messenger.com or https://m.me https://m.me (which also leads to messenger)

pksadiq 9y ago
The last commit to the file is on 4 Oct 2016. So you could expect that.
- dang 9y ago
  Ok, we've added 2016 above. Unsurprisingly, there is recent stuff on https://github.com/jmdugan/blocklists/pulls https://github.com/jmdugan/blocklists/pulls. If anyone notices it getting updated, could you tell us? hn@ycombinator.com is best.

bhauer 9y ago

Looks like this is already covered by the "Social" add-on to StevenBlack's hosts: https://github.com/StevenBlack/hosts/blob/master/extensions/social/hosts https://github.com/StevenBlack/hosts/blob/master/extensions/...

joeblau 9y ago
Steven Black's list is better. More complete and also has hosts for other social outlets, ad networks and trackers to block. https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/
- thelittleone 9y ago
  Is there a way to redirect to a local HTML file for any blacklisted host file addresses? Something like "You tried to access a site that's blocked in hosts file"? I tend to add blacklists like this then few months later wonder why some site doesn't work.
  - pentagonpapers 9y ago
    127.0.0.1 baddomain.com Run Apache on your localhost and serve up a message
  - hjek 9y ago
    Yes. As the hosts file redirects to localhosts, you can run a local server, displaying a notification. As root: while true; do printf "blocked by hosts file" |nc -q 1 -l -p 80; done
  - bencollier49 9y ago
    That won't help if the site fails due to a backend request to FB falling over.
  - bfred_it 9y ago
    You can run a server at 127.0.0.1:80, but it won’t work for HTTPS sites… unless you also configure your own certificates on the server.

paxy 9y ago

I wish it were that easy. Good start, but Facebook will still: 1. Get your data from other websites/apps that you allow 2. Get your data through your friends that use Facebook

dwighttk 9y ago
shouldn't this keep javascript from facebook domains from loading?
- paxy 9y ago
  Yes, but a lot of data transfer happens on the backend without the client being involved.
  - freedomben 9y ago
    This is certainly possible but hasn't been my experience. Most of Facebook stuff is xhr that is easy to block on the client side. It's certainly possible that services are doing this on the backend, but it seems far easier to plug in Facebook's libraries in the frontend.

anonu 9y ago

I might do this. Just curious if this will break the internet for me... Will certain non Facebook pages fail to load?

drchiu 9y ago

Any way to do this at the router level?

spaceandshit 9y ago
Pi-hole on a raspberry pi
- mito88 8y ago
  Beavis? :)
craftyguy 9y ago
If you use dnsmasq you can just save this file, set 'addn-hosts=/path/to/list' in the dnsmasq config, and restart the service.

CiPHPerCoder 9y ago

Why would you block WhatsApp?

binarysaurus 9y ago
Owned by FB.
- CiPHPerCoder 9y ago
  It may be owned by Facebook, but it's one of the viable secure messaging apps for people what don't use Signal. The other is Wire.
  - 908087 9y ago
    It's only viable if you're comfortable sharing your contact list and metadata with Facebook.
    - CiPHPerCoder 9y ago
      E2E encryption that isn't MTProto? Done.

odammit 9y ago

Man, that person put in some effort. That’s a lot of good lists. Scrolling through them it’s really interesting to see the other sites companies own. I always forget WhatsApp is Facebook.

jakeogh 9y ago

My setup: https://github.com/jakeogh/dnsgate https://github.com/jakeogh/dnsgate

nielsbjerg 9y ago

The whole conversation, without having read into everything here in absolute detail, seem to be very tool oriented. Am I the only one here overwhelmed by the sheer amount of domains involved?

Moru 9y ago
It's mostly subdomains since windows can't use wildcards (*.domain.com). Setting up such a large hosts-file might slow down your computer a bit though. There are some tools that lets you run wildcards in the hosts-file but can't remember the names at the moment.
- nielsbjerg 9y ago
  Again, a tool concern. Not trying to downplay the possible solutions, but rather bring attention to the magnetude
  - Moru 9y ago
    I'm not sure what you mean, I see 13 different domains in that list, the rest is subdomains of the same 13 domains. You can't count that as "sheer amount of domains". Our company probably have 2000 different subdomains on 5 domains? Subdomains we can create as we want to, it's just some letters before the domain part of the adress. Eg: Subdomain.Domain.com. That is what the wildcard is for, *.Domain.com catches them all no matter how many extra we create. Wildcarddomain is needed for example on an SSL certificate to accept any subdomain for the domain you ordered.
snowpanda 9y ago
It's a ridiculous amount, looks like someone just created a pull request with 500+ more facebook domains.

epiapp 9y ago

For anyone who's interested, I also maintain a tracking protection list for Internet Explorer. It's based originally on the Ghostery and Disconnect lists, but I now update it independently. It's designed to be concise and speedy, yet also comprehensive. Note, however, that due to the limitations of tracking protection lists in IE, it can't block everything. You may need to supplement it with a small hosts file. Check it out here: https://github.com/amtopel/tpl https://github.com/amtopel/tpl

walrus01 9y ago

Similar solution to blocking things at your local recursive DNS resolver, assuming you have a captive pool of devices, let's say in 10.240.0.0/24) in a LAN, all of which are given DHCP addresses and DHCP-assigned DNS resolvers, and you're in control of a bind9 server that's on the same LAN. Not going to prevent people with admin rights on their workstations from using another DNS resolver (or VPN, or whatever), but a fairly low effort solution. https://community.jisc.ac.uk/library/janet-services-documentation/how-block-or-sinkhole-domains-bind https://community.jisc.ac.uk/library/janet-services-document...

angadsg 9y ago

Created a pi-hole friendly blocklist https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9ea3cfa2bb249f5/raw/7fd0fddc08dd23ed205ec488fd5068c195662fe0/facebook.txt https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9e...

stiangrindvoll 9y ago

This is quite a powerful message!

yorby 9y ago

block all of Google's IP addresses: https://support.google.com/a/answer/60764?hl=en https://support.google.com/a/answer/60764?hl=en (note: your internet (the web) will stop working properly if you do block all of those IPs, which is a big problem)

cbdumas 9y ago
Can you be more specific about your internet not working with those addresses blocked? What exactly doesn't work?
- yorby 9y ago
  it depends on what sites you are using, but I beg you to try it and I can almost guarantee you that it will break your browsing experience... (even if you aren't using google search or gmail)
- rphlx 9y ago
  A lot of sites pull in popular js libraries from google; the idea being that they'll already be in a user's cache and even if they're not, google has a better (cheaper, faster and/or lower latency) CDN than the site author.
  - yorby 9y ago
    it's an advertising company's dream to be able to load code on most computers browsing the web....
    - rphlx 9y ago
      In their defense I believe they do tend to host that stuff on domains that do not set or retrieve the regular google tracking cookies. Though there are other tracking methods that they might still be using.
  - 908087 9y ago
    Most of this can be worked around by installing Decentraleyes, which replaces common CDN-loaded resources with local copies.

partycoder 9y ago

A blacklist approach to this is for sure a cat and mouse game. A better approach is to incrementally whitelist the domains you trust.

cgmg 9y ago
Not sure why you were downvoted, but this is correct. Facebook (or anyone else) can easily create more domains.
rphlx 9y ago
In general blacklists are a better choice overall for non-technical users. Do you really want an angry text message or phone call every time $FAMILY_MEMBER has some site that's rendering poorly because they haven't properly whitelisted one of the 12 legit domains it hits? And do you really trust them to not whitelist some ad & tracking domains?
- megous 9y ago
  Presumably, $FAMILY_MEMBER would have to get past the phone number whitelist too. So it might not be that bad.

alcover 9y ago

I wonder how Facebook devs feel when they read such posts. Do they feel rejected ? shameful ? Does their salary really outweigh this collective disapproval of their peers ?

madeofpalk 9y ago
I worked for a less-than stellar online publication in Australia. Think low-budget Daily Mail. I didnt care, I still got paid and got to switch off and do my own thing when I wanted to. I'm not my job.
- alcover 9y ago
  That is what I suspect but still.. Respect in the eye of peers is a human need. If I met a developper and learned he works for FB, it would be visible on my face that I feel somewhat put-off.
  - Analog24 9y ago
    A lot of people have more important things to worry about than the respect of their peers.
    - deleted 9y ago
      [deleted]
  - hueving 9y ago
    >Respect in the eye of peers is a human need 'Peer' is very flexible. This could be a comparison to people the same age in other careers. Also, keep in mind that Facebook engineers are constantly surrounded by other Facebook engineers so their SE peers probably do approve. They collectively don't think Facebook is a problem so they implicitly approve of each other.
- dawnerd 9y ago
  I worked for eHow. We felt the same as the people complaining about it. But it paid the bills. Did get to learn how to scale REALLY fast.

mockindignant 9y ago

There is more coverage of this topic here: https://news.ycombinator.com/item?id=11791052 https://news.ycombinator.com/item?id=11791052

snowpanda 9y ago

Nice to see HackerNews create pull requests to make the list more up to date. I hope they get committed. https://github.com/jmdugan/blocklists/pulls https://github.com/jmdugan/blocklists/pulls

cyberferret 9y ago

Interesting to see several domain names/servers with 'mqtt' referenced. Wondering if Facebook interacts with IoT devices routinely, or perhaps they use MQTT for Messenger message transfers etc.?

Digital-Citizen 9y ago

Yet again, software freedom fighters got there years ago. Free Software Foundation got there earlier. From publishing https://www.fsf.org/facebook https://www.fsf.org/facebook published on on Dec 20, 2010. FSF & GNU Project founder Richard Stallman has been rightly objecting to Facebook for years in his talks and on his personal website at https://stallman.org/facebook.html https://stallman.org/facebook.html. Long-time former FSF lawyer Eben Moglen rightly called Facebook "a monstrous surveillance engine" and pointed out the ugliness of Facebook's endless surveillance (at length in http://snowdenandthefuture.info/PartIII.html http://snowdenandthefuture.info/PartIII.html but in other places in the same lecture series as well). See http://snowdenandthefuture.info/ http://snowdenandthefuture.info/ for the entire series of talks.

heretoo 9y ago
Yes, but where do they offer solutions to transition (emphasis on transition) from what people currently use to a more open ecosystem? At least in the software licensing arena, having personally visited a lecture from Stallman, I was left with the impression that he wasn't offering a solution, just a vision of a Utopia without any guidance on how to transition to it -- more specifically, how would we make money from open source software, when currently proprietary software is the default for making money.
- hueving 9y ago
  >more specifically, how would we make money from open source software, See redhat.
- cyphar 9y ago
  > how would we make money from open source software There are many existing examples, so this is clearly a solved problem already. You charge for support, or for feature requests, and so on. That's how SUSE and RedHat make their money. The flaw with looking at proprietary software's monitisation is that it usually just boils down to "pay for the binary". This obviously won't work with free software, you need to charge for development rather than access (though you can also use a seat-based model where you only provide support for machines that have valid licenses). (I work for SUSE.)

alpb 9y ago

This list must've updated a lot since 2016.

HenryBemis 9y ago

I want to share my favorite HOSTS file provider [1] which includes FB addresses. [1]: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/

mito88 8y ago
goatse! :)

computator 9y ago

I'd like to mention a problem with blocklists like this that you put into /etc/hosts. I've noticed that many sites trivially evade the blocklist by adding a redirect. I.e., if example.com is blocked, but it redirects to example.ru or example123.com or example.team, then it still works. The spammers and advertisers don't have to change all the existing links to example.com -- they simply need to add a new redirect every few weeks.

rem7 9y ago
that's not how /etc/hosts works. the domain listed in /etc/hosts (example.com) will point to 0.0.0.0 (or 127.0.0.1)... you'll never even make it to the server so you won't get the redirect.
- computator 8y ago
  Oops, you're right. I discovered that it was my browser that was "helpfully" adding www in front of lots of domains I had blocked in /etc/hosts. For instance, if I blocked example.com, my browser would automatically try www.example.com (which might then redirect to something else entirely). In my case, I'm using Firefox. I can stop this behavior by setting "browser.fixup.alternate.enabled" to "false" in about:config.

ryanlol 9y ago

This is a terrible approach. Facebook can rotate many of these names whenever they feel like.

Froyoh 9y ago

Why not do something like *facebook.com?

dredmorbius 8y ago
Hosts syntax doesn't allow for that. DNSMasq would, however, allow you to only specify each TLD.

xyrouter 9y ago

I can block domains on my laptop, no problem. But I have not been able to figure out any convenient way to block websites on my Android phone. My Android phone comes with a Chrome browser. Any ideas about how to block websites reliably on an unrooted/jail-not-broken Android phone?

bronco21016 9y ago
Block at DNS level on a device (router or DNS server) and proxy all Android traffic to said device. I use a pfsense router running OpenVPN and pfblockerNG. PfblockerNG sinkholes all DNS requests to domains from a list such as this one. Then by using OpenVPN I simultaneously encrypt my connection when roaming remotely and I can specify to use my home DNS server to sinkhole ad/tracking domains.
- xyrouter 9y ago
  Thanks for the suggestion. I think this will work fine in a home network that I can control. But this is not going to work when I am traveling and using my carrier's 4G network. Am I right? Is there any nifty solution to address the later? I am a little disappointed that I can't do something as simple as install plugins for my phone browser that can block sites.
  - moviuro 9y ago
    > But this is not going to work when I am traveling and using my carrier's 4G network. That's what VPNs are for. See openvpn, for example (or tinc, strongswan, etc)

halamadrid 9y ago

Wow the hate/dislike is very real.

knowThySelfx 9y ago

Why only Facebook? All companies which store data are suspect.

Mizza 9y ago

I made one of these for Google: https://github.com/Miserlou/nogoogle https://github.com/Miserlou/nogoogle also: https://github.com/Miserlou/Poop https://github.com/Miserlou/Poop

throwahey 9y ago
Your list does basically nothing for Google tracking domains. Here is mine: (note that this blocks recaptcha which a lot of websites are now using for login annoyingly). I add entries for IPv4 and IPv6 (0.0.0.0 and ::1 respectively). 0.0.0.0 google.com 0.0.0.0 www.google.com 0.0.0.0 fonts.googleapis.com 0.0.0.0 google-analytics.com 0.0.0.0 apis.google.com 0.0.0.0 tpc.googlesyndication.com 0.0.0.0 ssl.google-analytics.com 0.0.0.0 www.google-analytics.com 0.0.0.0 www-google-analytics.l.google.com 0.0.0.0 stats.g.doubleclick.net 0.0.0.0 clients.l.google.com 0.0.0.0 pagead.l.doubleclick.net 0.0.0.0 pagead2.googlesyndication.com 0.0.0.0 googleads.g.doubleclick.net 0.0.0.0 www-googletagmanager.l.google.com 0.0.0.0 googleadapis.l.google.com 0.0.0.0 gstatic.com 0.0.0.0 ssl.gstatic.com 0.0.0.0 www.gstatic.com 0.0.0.0 www.googletagservices.com 0.0.0.0 www.googletagmanager.com 0.0.0.0 securepubads.g.doubleclick.net 0.0.0.0 tpc.googlesyndication.com To login to a google service such as gmail or enable captcha, comment out the three (*.)gstatic domains.
- mito88 8y ago
  nice!

thetruthseeker1 9y ago

Can somebody elaborate why this link from 2016 is gaining steam here? Is it because Cambridge Analytica misused FB data? May be I am missing something, do we know if facebook was wittingly complicit?

yeahdef 9y ago
If Facebook is negligent or complicit, I'd certainly change how I interact with the platform. I haven't kept up with the details and would love to be pointed to some summation / analysis of the facts.
RealityVoid 9y ago
I'm not a big fan of Facebook but I do find it useful. That being said, this feels to me like a coordinated attack campaign. Take an issue, blow it up, attach various other nebulous bad things and push it to a public that was already primed against that very service. Seems to be working great. I do not know who or why is pushing this campaign but it definitely feels organized and calculated.
Dirlewanger 9y ago
The sudden mainstream outrage toward Facebook is most likely because the Cambridge event is the perfect confluence of "Facebook", "Trump", and "bad".

yumraj 9y ago

Minor segue, is there any easy way to Geo-block URLs, both by ccTLDs and by geolocation of IPs from certain countries. I have pi-hole running but it doesn't support that currently, best it does is wildcard but even for that it needs domain and won't do just on the ccTLD.

dredmorbius 8y ago
ASNs, kinda, maybe.

tartrate 9y ago

Is it really any use trying to enumerate all variants under *.facebook.com and similar? The counts: 307 facebook.com 295 fbcdn.net 250 tfbnw.net 12 whatsapp.com 9 instagram.com 3 fb.com 3 edgesuite.net 2 metrix.net 2 fbsbx.com 2 fbcdn.com 2 facebook.net 2 edgekey.net 2 cdninstagram.com 2 akamaihd.net 1 fb.me 1 appspot.com

Jaruzel 9y ago
Where/How did you get that list?
- tartrate 9y ago
  grep -Po '\w+\.\w+$' | sort | uniq -c | sort -rhk1 Bit sloppy because it doesn't pick up the domain names with dashes. But my point was that if you want to blacklist *.facebook.com you shouldn't try to enumerate every single variant of it, that's not durable.
wodenokoto 9y ago
My thoughts were also, why so many subdomains? I wonder if it is to make the list seem more impressive and Facebook more all-encompassing. "If you want to block facebook you need to block almost a thousand websites!"
- skocznymroczny 9y ago
  "Then we will browse in the shade."
SjuulJanssen 9y ago
A bit further down in the replies reustle mentions: `It's a shame /etc/hosts doesn't support wildcards`
- TremendousJudge 9y ago
  I find that ridiculous. Is there a reason why it's that way?

digitalbase 9y ago

Someone should start a business for this: Provide people that care about privacy with a public DNS server they can use that auto blocks those domains (and update's its lists). I would pay for it (few dollars a month) Feature suggestion: allow people to add their own entries so I can purposely block reddit or hacker news to reduce distractions. Pretty sure I would set this DNS server on both my phone and desktop.

dontchooseanick 9y ago

I advocate for iptables instead of DNS filtering. Process of enumerating and rejecting facebook IPs : * Query the RAD http://radb.net/query/ http://radb.net/query/ , search for AS32934 * Enumerate ip ranges by http://radb.net/query/?advanced_query=1 http://radb.net/query/?advanced_query=1 * Check inverse query by origin, use AS32934 * Grep the response route and route6 CIDR ranges * Build a netfilter script with REJECT Gives those scripts for iptables (updated once in a while) : * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_in_ipv4.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_in_ipv6.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_out_ipv4.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_out_ipv6.sh https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... To enable : * iptables -I OUTPUT -j no_facebook_out * iptables -I INPUT -j no_facebook_in * ip6tables -I OUTPUT -j no_facebook_out * ip6tables -I INPUT -j no_facebook_in By design, instagram and connect-with-facebook get muted too.

DavideNL 8y ago
To get a list of all Facebook ip's: whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebook.list whois -h whois.radb.net '!6AS32934' | tr ' ' '\n' | grep '::' >> facebook.list

amelius 9y ago

I need something like this that I can install on friend and family's phones/iPads/computers whenever they ask me to fix something for them >:)

FabHK 9y ago
Gas Mask is a neat macOS app to manage hosts. You can subscribe to a remote hosts file, too.

deleted 9y ago

[deleted]

rawland 9y ago

Let's put this in global context: Adblocking is a non-trivial task, but there are trivial solutions. 1.) Install hosts-gen from http://git.r-36.net/hosts-gen/ % git clone http://git.r-36.net/hosts-gen % cd hosts-gen % sudo make install # Make sure all your custom configuration from your current /etc/hosts is # preserved in a file in /etc/hosts.d. The files have to begin with a # number, a minus and then the name. % sudo hosts-gen 2.) Install the zerohosts script. # In the above directory. % sudo cp examples/gethostszero /bin % sudo chmod 775 /bin/gethostszero % sudo /bin/gethostszero % sudo hosts-gen Add a cron job, and enjoy your faster and adfree-er internet. Further, you can add your custom (this FB) block to the local files in /etc/hosts.d, which then will be concatenated automatically. [source]: https://surf.suckless.org/files/adblock-hosts/ https://surf.suckless.org/files/adblock-hosts/

jason_slack 9y ago

Are there any implications to having 40,000+ lines in your /etc/hosts?

nomercy400 9y ago
It's basically a big lookup table, trading storage for speed. The most noticable effect is that your web pages load faster, because a lot requests for unnecessary data (eg. Facebook in this example) complete immediately. Occasionally you will miss out on a webpage that depends on it. Think uBlock Origin, but not for just your browser but your entire system.
- jason_slack 9y ago
  Thanks I have used /etc/hosts for a long time. I however just realized exactly how big mine is getting.
dredmorbius 8y ago
I've seen no noticeable impact to 100k+ lines.
- jason_slack 8y ago
  This is good to know. Thank you for the reply.

heckanoobs 9y ago

Why would you block all the domains but still keep your account that you would no longer be able to access? The account is the problem not the domains. You would have to block the domains on every device you use. Just kill the problem at the source and delete your entire surveillance account with facebook.

lnx01 9y ago
Because facebook tracks you even if you don't have an account.

dandigangi 9y ago

One of the posts I wish I could upvote more than once. Thank you.

stirner 9y ago

I wrote a small tool that translates AdBlock Plus filter lists into hosts file format [1]. It can only translate simple domain-name rules but might be of interest to people in this thread. [1] https://github.com/wwalexander/hostsblock https://github.com/wwalexander/hostsblock

zackmorris 9y ago
Thank you, I didn't know about the `cat -` trick to read from stdin (works the same as `echo hi | cat /dev/stdin`). Even after all this time, I still learn something new every day.
- stirner 8y ago
  echo hi | cat - is also equivalent to echo hi | cat You only need the - if you are concatenating other files with stdin [1]. Incidentally, any use of echo x | y can be replaced (at least in Bash) with y <<< "x" This is called a "here string" [2]. [1] https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBSD+9.1-RELEASE https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBS... [2] http://tldp.org/LDP/abs/html/x17837.html http://tldp.org/LDP/abs/html/x17837.html

imhelpingu 9y ago

It's pathetic that it takes a literal propaganda campaign to make people see the problem with facebook after 10 years, but whatever I'll take it.

Pete_D 9y ago

A lot of commenters mention dnsmasq. I wrote some scripts a while ago to help minimize a dnsmasq config that had been generated from a hosts file. People in this thread might find them useful. https://petedeas.co.uk/dnsmasq/ https://petedeas.co.uk/dnsmasq/

DavideNL 9y ago

on macOS i use a bash script to get all Facebook ip addresses: whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > "/etc/pf.anchors/usr.home.sub/facebook.list" and then use a pfctl anchor to block them all table <facebook> persist file "/etc/pf.anchors/usr.home.sub/facebook.list" block drop quick to <facebook>

mito88 8y ago

merci.

mito88 8y ago

what is the difference between 0.0.0.0 and 127.0.0.1 with respect to redire ction? will redirecting to localhost eat more cpu cycles?

dredmorbius 8y ago
0.0.0.0 is no host. 127.0.0.1 is localhost, and will still generate a query. If you've a webserver there, its logs might get busy with the blocked traffic requests.

ChoGGi 8y ago

The list has fbcdn-profile-a.akamaihd.net, but it missed fbcdn-creative-a.akamaihd.net If anyone wants it