
Blocklist Facebook domains - z0a
https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all
======
jiaweihli
I highly recommend using uMatrix[1][2] if you're very privacy-conscious. It's
the full-blown everything-at-your-fingertips console.

By default, it blocks third-party scripts/cookies/XHRs/frames (with an
additional explicit blacklist). You then manually whitelist on a matrix which
types of requests from which domains you want to allow. Your preferences are
saved.

It is a bit annoying the first time you visit any new domain, because you need
to go through a bootstrapping whitelist process to make it work. After a while
I find I do it almost automatically though.

I use it in conjunction with uBlock Origin and Disconnect, and it _still_
catches the vast majority of things. As a nice side-effect, I find I keep
pretty up-to-date with new SAAS companies coming out!

\---

[1]
[https://chrome.google.com/webstore/detail/umatrix/ogfcmafjal...](https://chrome.google.com/webstore/detail/umatrix/ogfcmafjalglgifnmanfmnieipoejdcf)

[2] [https://addons.mozilla.org/en-
US/firefox/addon/umatrix/](https://addons.mozilla.org/en-
US/firefox/addon/umatrix/)

~~~
joeblau
Any browser plugin is inferior to using a hosts file. Hosts file's blackhole
_any_ network request before even attempting to make a connection. These
browser plugins only help if you're using the specific browser — they aren't
going to help that electron/desktop app that's phoning home. They wont help
block inline media links (Messages on a Mac pre-rendering links) that show up
in your chat programs which attempt to resolve to Facebook. They also wont
block any software dependency library that you install without properly
checking if it's got some social media tracking engine built in.

I don't even waste time or cpu cycles with browser based blocking
applications. Steven Black's[1] maintained hosts files are the best for
blocking adware, malware, fakenews, gambling , porn and social media outlets.

[1] -
[https://github.com/StevenBlack/hosts/](https://github.com/StevenBlack/hosts/)

~~~
geofft
> _they aren 't going to help that electron/desktop app that's phoning home._

What's your threat model? Mine is third-party tracking cookies, and desktop
apps don't share my browser's cookie jar. So while technically I can be
tracked by IP from a desktop app, Facebook can't tell if it's me or someone
else at the same coffee shop.

In particular, one nice thing about Chrome extensions is that they _don 't_
apply to incognito windows. I regularly use HTTPS Everywhere in block-all-
HTTP-requests mode + an incognito window on wifi connections I don't trust,
because the incognito window will permit plaintext requests, but it doesn't
read my cookies or write to my cache, so it's sandboxed from my actual web
browsing. I can safely read some random website that doesn't support HTTPS
with my only concern being my own eyes reading a compromised page; none of my
logged-in sessions are at risk.

> _any software dependency library that you install without properly checking
> if it 's got some social media tracking engine built in._

... is this a thing? (I totally believe that it's becoming a thing, I just
haven't seen it yet and am morbidly curious.)

~~~
traviscj
Browser fingerprinting is an easy path toward a “stronger than ip”
correlation. [1] is an interesting starting point.

1: [https://panopticlick.eff.org](https://panopticlick.eff.org)

~~~
chopin
That works only with JavaScript active which uMatrix blocks for 3rd party. The
sites one visits mainly are not known for 1st party fingerprinting (that's
mainly done by the ad networks). The extra paranoids (like me) can also block
JS for certain 1st party sites.

I use uMatrix only experimentally (I rely on NoScript) but it offers a
fascinating flexibility of control if one is in the mood. As well, NoScript is
near useless when doing stuff with AWS where uMatrix offers the right
flexibility (allow from site Y, but only when fetched from site X).

~~~
traviscj
Derp, I missed the obvious. Thanks.

I had heard of uMatrix but didn't realize it had that functionality, which is
pretty cool! Thanks for sharing!

------
Digital-Citizen
Yet again, software freedom fighters got there years ago.

Free Software Foundation got there earlier. From publishing
[https://www.fsf.org/facebook](https://www.fsf.org/facebook) published on on
Dec 20, 2010. FSF & GNU Project founder Richard Stallman has been rightly
objecting to Facebook for years in his talks and on his personal website at
[https://stallman.org/facebook.html](https://stallman.org/facebook.html).

Long-time former FSF lawyer Eben Moglen rightly called Facebook "a monstrous
surveillance engine" and pointed out the ugliness of Facebook's endless
surveillance (at length in
[http://snowdenandthefuture.info/PartIII.html](http://snowdenandthefuture.info/PartIII.html)
but in other places in the same lecture series as well). See
[http://snowdenandthefuture.info/](http://snowdenandthefuture.info/) for the
entire series of talks.

~~~
heretoo
Yes, but where do they offer solutions to transition (emphasis on transition)
from what people currently use to a more open ecosystem?

At least in the software licensing arena, having personally visited a lecture
from Stallman, I was left with the impression that he wasn't offering a
solution, just a vision of a Utopia without any guidance on how to transition
to it -- more specifically, how would we make money from open source software,
when currently proprietary software is the default for making money.

~~~
cyphar
> how would we make money from open source software

There are many existing examples, so this is clearly a solved problem already.
You charge for support, or for feature requests, and so on. That's how SUSE
and RedHat make their money.

The flaw with looking at proprietary software's monitisation is that it
usually just boils down to "pay for the binary". This obviously won't work
with free software, you need to charge for development rather than access
(though you can also use a seat-based model where you only provide support for
machines that have valid licenses).

(I work for SUSE.)

~~~
heretoo
That definately is one solution, but perhaps made possible by restricting
distribution of software in the first place to get a leg up (see comments
regarding improvements and distribution restrictions regarding installer
scripts in SLS
[http://www.linuxjournal.com/article/2750](http://www.linuxjournal.com/article/2750)).
This suggests that it isn't a solved problem, because the initial conversion
to an open source model (or free software) with support on the side may have
required a different model to start the venture.

None the less, it's admirable, and hopefully a net benefit for everyone.

My point was more about Stallman and co calling foul with regards to software
freedom, codifying their own ideal, but not giving directions to reach that
ideal. This feels like a safe pulpit to sit upon, where their view isn't
falsifiable, useful when they want to say "I told you so", and eventually
taking all credit for everyone else's efforts in between to make the end goal
possible.

~~~
cyphar
> perhaps made possible by restricting distribution of software in the first
> place to get a leg up

This is incorrect, you can download the full ISOs for SLE from the SUSE
website, with 30 days worth of updates. The source code (and the system
required to build it) is all publicly available on
[https://buid.opensuse.org/](https://buid.opensuse.org/). I beleive RedHat
have something similar.

I'm also not sure that an interview _from 1994_ with the creator of Slackware
is a good indicator of the current state of distribution business models.
Though even in 1994, both RedHat and SUSE were selling enterprise
distributions.

~~~
heretoo
Since the past determines the future, the relevant part of the 1994 interview
is "... Instead, he claimed distribution rights on the Slackware install
scripts since they were derived from ones included in SLS...", which as I
understand it, is the restriction of distribution I was referring to (perhaps
redistribution is more accurate).

This suggests that the business model benefited from restricting
redistribution and modification of the source code, so breaks the assumptions
that the business model was purely based on making money from open source, and
so doesn't fully support the idea that proprietary software is unnecessary, in
the case where we take SUSE as an example of saying it is "already solved".

------
alcover
I wonder how Facebook devs feel when they read such posts. Do they feel
rejected ? shameful ? Does their salary really outweigh this collective
disapproval of their peers ?

~~~
secondarychris
I actually just got a job there out of school, starting in a few months.
Reading these comments is certainly interesting although it's not news to me
that Hacker News hates Facebook.

I've long been skeptical of the effects of social media though, and I'm taking
this job mostly just because doing otherwise seems like a really poor career
choice. Plus it seems like Facebook is here to stay, and I can dream of
helping to fix the problem instead of just enabling it.

~~~
not_kurt_godel
You are enabling it. You know that and it will gnaw at your soul and make you
deeply unhappy as long as you work there.

~~~
joering2
I spilled OJ at myself when I read his post. I mean its great he is so
gullible to believe he can change something at such big corp, and he reminds
me when I was 16 with big head of dreams how to change the world.

But seriously - do we know any single example of an intern coming to a big
corp and "saving it" \- by that I mean steering it off the dark and deceiving
waters and actually bringing it into light for the good of society and people
in general??

~~~
Grangar
Didn't Snowden have intentions to leak NSA documents right from the start..?

------
lwhsiao
Pi-Hole [1] is another nice way to filter domains at the DNS level network
wide, if you want a wider reaching solution that supports wildcards. Great way
to use an extra Pi if you have one sitting around.

\---

[1] [https://pi-hole.net/](https://pi-hole.net/)

~~~
madez
Sadly, Pi-Hole is not integrated into Debian. I feel uneasy running software
not from the Debian repository. I hope Pi-Hole will be packaged soon.

~~~
arbitrage
Debian has had its share of fuck-ups in its package management system. There's
very little difference between blindly trusting debian, vs blindly trusting
pihole. Don't pretend you check out the contents of all the packages you use.

~~~
madez
That is unnecessarily aggressive. Also, besides the snarkyness, it is a bad
argument. What you write seems to be an appeal to hypocrisy. To see that, the
following analogon might be helpful: One doesn't need to personally comprehend
every decision in a democracy to have more trust in it than in a dictatorship,
and one can say that without living in a democracy.

------
bhauer
Looks like this is already covered by the "Social" add-on to StevenBlack's
hosts:

[https://github.com/StevenBlack/hosts/blob/master/extensions/...](https://github.com/StevenBlack/hosts/blob/master/extensions/social/hosts)

~~~
joeblau
Steven Black's list is better. More complete and also has hosts for other
social outlets, ad networks and trackers to block.

[https://github.com/StevenBlack/hosts/](https://github.com/StevenBlack/hosts/)

~~~
thelittleone
Is there a way to redirect to a local HTML file for any blacklisted host file
addresses? Something like "You tried to access a site that's blocked in hosts
file"? I tend to add blacklists like this then few months later wonder why
some site doesn't work.

~~~
hjek
Yes. As the hosts file redirects to localhosts, you can run a local server,
displaying a notification. As root:

    
    
        while true; do printf "blocked by hosts file" |nc -q 1 -l -p 80; done

------
tartrate
Is it really any use trying to enumerate all variants under *.facebook.com and
similar?

The counts:

    
    
        307 facebook.com
        295 fbcdn.net
        250 tfbnw.net
         12 whatsapp.com
          9 instagram.com
          3 fb.com
          3 edgesuite.net
          2 metrix.net
          2 fbsbx.com
          2 fbcdn.com
          2 facebook.net
          2 edgekey.net
          2 cdninstagram.com
          2 akamaihd.net
          1 fb.me
          1 appspot.com

~~~
SjuulJanssen
A bit further down in the replies reustle mentions: `It's a shame /etc/hosts
doesn't support wildcards`

~~~
TremendousJudge
I find that ridiculous. Is there a reason why it's that way?

~~~
lnx01
It's been around since the beginning of time itself I guess. You can try
something like dnsmasq. One liner in the conf file:
address=/.facebook.com/127.0.0.1

edit: For Ubuntu this should work (one versions from Trusty and newer):

sudo touch /etc/NetworkManager/dnsmasq.d/local

Put these lines into the above file and save:

    
    
      address=/.facebook.com/127.0.0.1
      address=/.fbcdn.net/127.0.0.1
      address=/.tfbnw.net/127.0.0.1
      address=/.whatsapp.com/127.0.0.1
      address=/.instagram.com/127.0.0.1
      address=/.fb.com/127.0.0.1
      address=/.edgesuite.net/127.0.0.1
      address=/.metrix.net/127.0.0.1
      address=/.fbsbx.com/127.0.0.1
      address=/.fbcdn.com/127.0.0.1
      address=/.facebook.net/127.0.0.1
      address=/.edgekey.net/127.0.0.1
      address=/.cdninstagram.com/127.0.0.1
      address=/.akamaihd.net/127.0.0.1
      address=/.fb.me/127.0.0.1
      address=/.appspot.com/127.0.0.1
    

And then: sudo systemctl restart network-manager

------
rawland
Let's put this in global context:

    
    
        Adblocking is a non-trivial task, but there are trivial solutions.
        
        1.) Install hosts-gen from http://git.r-36.net/hosts-gen/
        
        % git clone http://git.r-36.net/hosts-gen
        % cd hosts-gen
        % sudo make install
        
            # Make sure all your custom configuration from your current /etc/hosts is
            # preserved in a file in /etc/hosts.d. The files have to begin with a
            # number, a minus and then the name.
        
        % sudo hosts-gen
        
        2.) Install the zerohosts script.
        
        # In the above directory.
        % sudo cp examples/gethostszero /bin
        % sudo chmod 775 /bin/gethostszero
        % sudo /bin/gethostszero
        % sudo hosts-gen 
    

Add a cron job, and enjoy your faster and adfree-er internet. Further, you can
add your custom (this FB) block to the local files in /etc/hosts.d, which then
will be concatenated automatically.

[source]: [https://surf.suckless.org/files/adblock-
hosts/](https://surf.suckless.org/files/adblock-hosts/)

------
rvshchwl
This is a good thing to enable, but I think that smartphones contribute
exponentially more data to Facebook services than laptops and browsers do.
Smartphones give easy access to location, background running services,
microphone. Even if you block these permissions to the app, Facebook gets the
data from their data providers that use Facebook ads.

~~~
rs86
"Exponentially" means nothing here. Perhaps you are looking for "orders of
magnitude"

~~~
nostromo
[amount of data collected from phones]=[amount of data collected from
desktops]^[some exponent]

~~~
btrettel
If the exponent is less than 1 then the amount of data collected from phones
is less than that from desktops.

~~~
hueving
When you hear 'exponential back off algorithm', do you envision one that keeps
retrying faster and faster?

~~~
btrettel
I'd say better than 50% chance that the delay increases. But the phrase would
be unambiguous if it were called an "exponentially _increasing_ back off
algorithm".

~~~
marksomnian
This is unnecessarily pedantic. An exponential back off algorithm has a 100%
chance of increasing the delay, that's the whole point. Nowhere other than
pure mathematics would I see the phrase "exponentially" and even consider a <1
exponent.

~~~
cmstoken
I think "needlessly" would work better than "unnecessarily" there.

------
dontchooseanick
I advocate for iptables instead of DNS filtering.

Process of enumerating and rejecting facebook IPs :

* Query the RAD [http://radb.net/query/](http://radb.net/query/) , search for AS32934

* Enumerate ip ranges by [http://radb.net/query/?advanced_query=1](http://radb.net/query/?advanced_query=1)

* Check inverse query by origin, use AS32934

* Grep the response route and route6 CIDR ranges

* Build a netfilter script with REJECT

Gives those scripts for iptables (updated once in a while) :

* [https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8...](https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_in_ipv4.sh)

* [https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8...](https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_in_ipv6.sh)

* [https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8...](https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_out_ipv4.sh)

* [https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8...](https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8dbd7237d35913f1/fbmute/no_facebook_out_ipv6.sh)

To enable :

* iptables -I OUTPUT -j no_facebook_out

* iptables -I INPUT -j no_facebook_in

* ip6tables -I OUTPUT -j no_facebook_out

* ip6tables -I INPUT -j no_facebook_in

By design, instagram and connect-with-facebook get muted too.

~~~
DavideNL
To get a list of all Facebook ip's:

    
    
      whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebook.list
      whois -h whois.radb.net '!6AS32934' | tr ' ' '\n' | grep '::' >> facebook.list

------
frawley
I don't see [https://messenger.com](https://messenger.com) or
[https://m.me](https://m.me) (which also leads to messenger)

~~~
pksadiq
The last commit to the file is on 4 Oct 2016. So you could expect that.

~~~
dang
Ok, we've added 2016 above.

Unsurprisingly, there is recent stuff on
[https://github.com/jmdugan/blocklists/pulls](https://github.com/jmdugan/blocklists/pulls).
If anyone notices it getting updated, could you tell us? hn@ycombinator.com is
best.

------
source99
Its actually quite annoying to block all of facebook. There are a lot of
innocuous sites that have at least some small reliability on facebook and
blocking all of facebook makes using these sites a tad bit difficult / poor
UX.

~~~
checkyoursudo
Any examples? I have blocked Facebook for many years, and I can't think of a
single time where it has mattered.

I run without JavaScript by default, so maybe I just don't notice those kinds
of things after years of conditioning.

~~~
__alias
you run without js by default? God your internet must be boring :)

~~~
__jal
Only whitelisted sites run JS in my browser. If by 'boring', you mean vastly
less annoying, yes, it is terribly boring.

I'd likely never look at the bulk of commercial websites if I had to render
them the way owners intended them to render.

------
epiapp
For anyone who's interested, I also maintain a tracking protection list for
Internet Explorer. It's based originally on the Ghostery and Disconnect lists,
but I now update it independently. It's designed to be concise and speedy, yet
also comprehensive. Note, however, that due to the limitations of tracking
protection lists in IE, it can't block everything. You may need to supplement
it with a small hosts file. Check it out here:
[https://github.com/amtopel/tpl](https://github.com/amtopel/tpl)

------
angadsg
Created a pi-hole friendly blocklist
[https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9e...](https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9ea3cfa2bb249f5/raw/7fd0fddc08dd23ed205ec488fd5068c195662fe0/facebook.txt)

------
reustle
It's a shame /etc/hosts doesn't support wildcards

0.0.0.0 *.facebook.com

~~~
rbritton
You could sort of work around that by just blocking their IP ranges:

[https://stackoverflow.com/a/11164738](https://stackoverflow.com/a/11164738)

~~~
topranks
The ranges could change over time.

If you run your own DNS resolver you can use the wildcard trick.

Something like this in an RPZ zone should do it:

    
    
        facebook.com    IN CNAME .
        *.facebook.com  IN CNAME .
        facebook.net    IN CNAME .
        *.facebook.net  IN CNAME .
        fbcdn.com       IN CNAME .
        *.fbcdn.com     IN CNAME .
        fbcdn.net       IN CNAME .
        *.fbcdn.net     IN CNAME .
        fb.com          IN CNAME .
        *.fb.com        IN CNAME .
        fb.me           IN CNAME .
        *.fb.me         IN CNAME .
        tfbnw.com       IN CNAME .
        *.tfbnw.com     IN CNAME .

~~~
zaarn

        *.facebook.com IN CNAME .
    

should be unnecessary since the DNS zone above it, facebook.com is already
CNAME'd. Most resolvers will take a CNAME as "any further requests go to
here", which to my experience usually includes NS servers.

(This is also why you don't CNAME your root domain, CNAME conflicts with any
other record type)

------
digitalbase
Someone should start a business for this:

Provide people that care about privacy with a public DNS server they can use
that auto blocks those domains (and update's its lists). I would pay for it
(few dollars a month)

Feature suggestion: allow people to add their own entries so I can purposely
block reddit or hacker news to reduce distractions.

Pretty sure I would set this DNS server on both my phone and desktop.

------
thetruthseeker1
Can somebody elaborate why this link from 2016 is gaining steam here? Is it
because Cambridge Analytica misused FB data? May be I am missing something, do
we know if facebook was wittingly complicit?

~~~
RealityVoid
I'm not a big fan of Facebook but I do find it useful. That being said, this
feels to me like a coordinated attack campaign. Take an issue, blow it up,
attach various other nebulous bad things and push it to a public that was
already primed against that very service. Seems to be working great.

I do not know who or why is pushing this campaign but it definitely feels
organized and calculated.

------
nielsbjerg
The whole conversation, without having read into everything here in absolute
detail, seem to be very tool oriented. Am I the only one here overwhelmed by
the sheer amount of domains involved?

~~~
Moru
It's mostly subdomains since windows can't use wildcards (*.domain.com).
Setting up such a large hosts-file might slow down your computer a bit though.

There are some tools that lets you run wildcards in the hosts-file but can't
remember the names at the moment.

~~~
nielsbjerg
Again, a tool concern. Not trying to downplay the possible solutions, but
rather bring attention to the magnetude

~~~
Moru
I'm not sure what you mean, I see 13 different domains in that list, the rest
is subdomains of the same 13 domains. You can't count that as "sheer amount of
domains". Our company probably have 2000 different subdomains on 5 domains?
Subdomains we can create as we want to, it's just some letters before the
domain part of the adress. Eg: Subdomain.Domain.com. That is what the wildcard
is for, *.Domain.com catches them all no matter how many extra we create.
Wildcarddomain is needed for example on an SSL certificate to accept any
subdomain for the domain you ordered.

------
yorby
block all of Google's IP addresses:
[https://support.google.com/a/answer/60764?hl=en](https://support.google.com/a/answer/60764?hl=en)
(note: your internet (the web) will stop working properly if you do block all
of those IPs, which is a big problem)

~~~
cbdumas
Can you be more specific about your internet not working with those addresses
blocked? What exactly doesn't work?

~~~
rphlx
A lot of sites pull in popular js libraries from google; the idea being that
they'll already be in a user's cache and even if they're not, google has a
better (cheaper, faster and/or lower latency) CDN than the site author.

~~~
908087
Most of this can be worked around by installing Decentraleyes, which replaces
common CDN-loaded resources with local copies.

~~~
geokon
I'd like something so I can use the web from China (without a VPN) . Right now
a lot of the common JS/fonts/etc from Google break - and webpages go wonky. Is
there a way to preload a cache?

------
malloreon
does this include instagram, messenger, and whatsapp domains too? I'm not sure
if these services use their own domains.

'fb' itself will eventually be, if it's not already, just a data holding
company for these and other acquisitions.

~~~
flixic
Yes it does. But you could have found this out way faster by just searching on
the page.

------
paxy
I wish it were that easy. Good start, but Facebook will still:

1\. Get your data from other websites/apps that you allow

2\. Get your data through your friends that use Facebook

~~~
dwighttk
shouldn't this keep javascript from facebook domains from loading?

~~~
paxy
Yes, but a lot of data transfer happens on the backend without the client
being involved.

~~~
freedomben
This is certainly possible but hasn't been my experience. Most of Facebook
stuff is xhr that is easy to block on the client side.

It's certainly possible that services are doing this on the backend, but it
seems far easier to plug in Facebook's libraries in the frontend.

------
heckanoobs
Why would you block all the domains but still keep your account that you would
no longer be able to access? The account is the problem not the domains. You
would have to block the domains on every device you use. Just kill the problem
at the source and delete your entire surveillance account with facebook.

~~~
lnx01
Because facebook tracks you even if you don't have an account.

------
knowThySelfx
Why only Facebook? All companies which store data are suspect.

------
walrus01
Similar solution to blocking things at your local recursive DNS resolver,
assuming you have a captive pool of devices, let's say in 10.240.0.0/24) in a
LAN, all of which are given DHCP addresses and DHCP-assigned DNS resolvers,
and you're in control of a bind9 server that's on the same LAN.

Not going to prevent people with admin rights on their workstations from using
another DNS resolver (or VPN, or whatever), but a fairly low effort solution.

[https://community.jisc.ac.uk/library/janet-services-
document...](https://community.jisc.ac.uk/library/janet-services-
documentation/how-block-or-sinkhole-domains-bind)

------
mockindignant
There is more coverage of this topic here:
[https://news.ycombinator.com/item?id=11791052](https://news.ycombinator.com/item?id=11791052)

------
throwaway84742
Does anyone have this for Google ads domains and/or YouTube?

~~~
amarka
I don't have a list that I can easily share, but you can curate your own off
of
[https://github.com/StevenBlack/hosts](https://github.com/StevenBlack/hosts)

~~~
throwaway84742
Didn’t know about this. Thanks for the link!

------
odammit
Man, that person put in some effort. That’s a lot of good lists.

Scrolling through them it’s really interesting to see the other sites
companies own.

I always forget WhatsApp is Facebook.

------
RickS
This list presumably updates/moves around often.

Is there a service that, say, subscribes to a live list of this domain set
(like adblock consumes easylist) and updates my hostfile automatically?

If not, that is a piece of software that I would find useful and worth paying
for (with the ability to audit the software's ability to phone home about the
rest of my hosts file)

~~~
dao-
Your host file, hmm. Maybe something based on disconnect.me. If you're mostly
worried about the browser (which seems sensible for most users), you can just
enable tracking protection in Firefox: [https://support.mozilla.org/en-
US/kb/tracking-protection](https://support.mozilla.org/en-US/kb/tracking-
protection)

------
stirner
I wrote a small tool that translates AdBlock Plus filter lists into hosts file
format [1]. It can only translate simple domain-name rules but might be of
interest to people in this thread.

[1]
[https://github.com/wwalexander/hostsblock](https://github.com/wwalexander/hostsblock)

~~~
zackmorris
Thank you, I didn't know about the `cat -` trick to read from stdin (works the
same as `echo hi | cat /dev/stdin`). Even after all this time, I still learn
something new every day.

~~~
stirner

        echo hi | cat -
    

is also equivalent to

    
    
        echo hi | cat
    

You only need the - if you are concatenating other files with stdin [1].
Incidentally, any use of

    
    
        echo x | y
    

can be replaced (at least in Bash) with

    
    
        y <<< "x"
    

This is called a "here string" [2].

[1]
[https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBS...](https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBSD+9.1-RELEASE)

[2]
[http://tldp.org/LDP/abs/html/x17837.html](http://tldp.org/LDP/abs/html/x17837.html)

------
Pete_D
A lot of commenters mention dnsmasq. I wrote some scripts a while ago to help
minimize a dnsmasq config that had been generated from a hosts file. People in
this thread might find them useful.

[https://petedeas.co.uk/dnsmasq/](https://petedeas.co.uk/dnsmasq/)

------
Mizza
I made one of these for Google:
[https://github.com/Miserlou/nogoogle](https://github.com/Miserlou/nogoogle)

also: [https://github.com/Miserlou/Poop](https://github.com/Miserlou/Poop)

~~~
throwahey
Your list does basically nothing for Google tracking domains. Here is mine:
(note that this blocks recaptcha which a lot of websites are now using for
login annoyingly). I add entries for IPv4 and IPv6 (0.0.0.0 and ::1
respectively).

    
    
        0.0.0.0 google.com
        0.0.0.0 www.google.com
        0.0.0.0 fonts.googleapis.com
        0.0.0.0 google-analytics.com
        0.0.0.0 apis.google.com
        0.0.0.0 tpc.googlesyndication.com
        0.0.0.0 ssl.google-analytics.com
        0.0.0.0 www.google-analytics.com
        0.0.0.0 www-google-analytics.l.google.com
        0.0.0.0 stats.g.doubleclick.net
        0.0.0.0 clients.l.google.com
        0.0.0.0 pagead.l.doubleclick.net
        0.0.0.0 pagead2.googlesyndication.com
        0.0.0.0 googleads.g.doubleclick.net
        0.0.0.0 www-googletagmanager.l.google.com
        0.0.0.0 googleadapis.l.google.com
        0.0.0.0 gstatic.com
        0.0.0.0 ssl.gstatic.com
        0.0.0.0 www.gstatic.com
        0.0.0.0 www.googletagservices.com
        0.0.0.0 www.googletagmanager.com
        0.0.0.0 securepubads.g.doubleclick.net
        0.0.0.0 tpc.googlesyndication.com
    
    

To login to a google service such as gmail or enable captcha, comment out the
three (*.)gstatic domains.

~~~
mito88
nice!

------
xyrouter
I can block domains on my laptop, no problem. But I have not been able to
figure out any convenient way to block websites on my Android phone. My
Android phone comes with a Chrome browser. Any ideas about how to block
websites reliably on an unrooted/jail-not-broken Android phone?

~~~
bronco21016
Block at DNS level on a device (router or DNS server) and proxy all Android
traffic to said device.

I use a pfsense router running OpenVPN and pfblockerNG. PfblockerNG sinkholes
all DNS requests to domains from a list such as this one. Then by using
OpenVPN I simultaneously encrypt my connection when roaming remotely and I can
specify to use my home DNS server to sinkhole ad/tracking domains.

~~~
xyrouter
Thanks for the suggestion. I think this will work fine in a home network that
I can control. But this is not going to work when I am traveling and using my
carrier's 4G network. Am I right? Is there any nifty solution to address the
later?

I am a little disappointed that I can't do something as simple as install
plugins for my phone browser that can block sites.

~~~
moviuro
> But this is not going to work when I am traveling and using my carrier's 4G
> network.

That's what VPNs are for. See openvpn, for example (or tinc, strongswan, etc)

------
yumraj
Minor segue, is there any easy way to Geo-block URLs, both by ccTLDs and by
geolocation of IPs from certain countries.

I have pi-hole running but it doesn't support that currently, best it does is
wildcard but even for that it needs domain and won't do just on the ccTLD.

~~~
dredmorbius
ASNs, kinda, maybe.

------
snowpanda
Nice to see HackerNews create pull requests to make the list more up to date.
I hope they get committed.

[https://github.com/jmdugan/blocklists/pulls](https://github.com/jmdugan/blocklists/pulls)

------
ryanlol
This is a terrible approach. Facebook can rotate many of these names whenever
they feel like.

------
cyberferret
Interesting to see several domain names/servers with 'mqtt' referenced.
Wondering if Facebook interacts with IoT devices routinely, or perhaps they
use MQTT for Messenger message transfers etc.?

------
HenryBemis
I want to share my favorite HOSTS file provider [1] which includes FB
addresses.

[1]: [http://someonewhocares.org/hosts/](http://someonewhocares.org/hosts/)

~~~
mito88
goatse!

:)

------
DavideNL
on macOS i use a bash script to get all Facebook ip addresses:

    
    
      whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > "/etc/pf.anchors/usr.home.sub/facebook.list"
    

and then use a pfctl anchor to block them all

    
    
      table <facebook> persist file "/etc/pf.anchors/usr.home.sub/facebook.list"
      block drop quick to <facebook>

------
amelius
I need something like this that I can install on friend and family's
phones/iPads/computers whenever they ask me to fix something for them >:)

~~~
FabHK
Gas Mask is a neat macOS app to manage hosts. You can subscribe to a remote
hosts file, too.

------
jakeogh
My setup:
[https://github.com/jakeogh/dnsgate](https://github.com/jakeogh/dnsgate)

------
partycoder
A blacklist approach to this is for sure a cat and mouse game. A better
approach is to incrementally whitelist the domains you trust.

~~~
rphlx
In general blacklists are a better choice overall for non-technical users. Do
you really want an angry text message or phone call every time $FAMILY_MEMBER
has some site that's rendering poorly because they haven't properly
whitelisted one of the 12 legit domains it hits? And do you really trust them
to _not_ whitelist some ad & tracking domains?

~~~
megous
Presumably, $FAMILY_MEMBER would have to get past the phone number whitelist
too. So it might not be that bad.

------
anonu
I might do this. Just curious if this will break the internet for me... Will
certain non Facebook pages fail to load?

------
ChoGGi
The list has fbcdn-profile-a.akamaihd.net, but it missed fbcdn-
creative-a.akamaihd.net

If anyone wants it

------
jason_slack
Are there any implications to having 40,000+ lines in your /etc/hosts?

~~~
nomercy400
It's basically a big lookup table, trading storage for speed.

The most noticable effect is that your web pages load faster, because a lot
requests for unnecessary data (eg. Facebook in this example) complete
immediately. Occasionally you will miss out on a webpage that depends on it.

Think uBlock Origin, but not for just your browser but your entire system.

~~~
jason_slack
Thanks I have used /etc/hosts for a long time. I however just realized exactly
how big mine is getting.

------
dandigangi
One of the posts I wish I could upvote more than once. Thank you.

------
alpb
This list must've updated a lot since 2016.

------
mito88
what is the difference between 0.0.0.0 and 127.0.0.1 with respect to redire
ction?

will redirecting to localhost eat more cpu cycles?

~~~
dredmorbius
0.0.0.0 is no host. 127.0.0.1 is localhost, and will still generate a query.

If you've a webserver there, its logs might get busy with the blocked traffic
requests.

------
imhelpingu
It's pathetic that it takes a literal propaganda campaign to make people see
the problem with facebook after 10 years, but whatever I'll take it.

------
drchiu
Any way to do this at the router level?

~~~
spaceandshit
Pi-hole on a raspberry pi

~~~
mito88
Beavis?

:)

------
stiangrindvoll
This is quite a powerful message!

------
CiPHPerCoder
Why would you block WhatsApp?

~~~
binarysaurus
Owned by FB.

~~~
CiPHPerCoder
It may be owned by Facebook, but it's one of the viable secure messaging apps
for people what don't use Signal. The other is Wire.

~~~
908087
It's only viable if you're comfortable sharing your contact list and metadata
with Facebook.

~~~
CiPHPerCoder
E2E encryption that isn't MTProto? Done.

------
halamadrid
Wow the hate/dislike is very real.

------
mito88
merci.

------
Froyoh
Why not do something like *facebook.com?

~~~
dredmorbius
Hosts syntax doesn't allow for that.

DNSMasq would, however, allow you to only specify each TLD.

------
computator
I'd like to mention a problem with blocklists like this that you put into
/etc/hosts. I've noticed that many sites trivially evade the blocklist by
adding a redirect. I.e., if example.com is blocked, but it redirects to
example.ru or example123.com or example.team, then it still works. The
spammers and advertisers don't have to change all the existing links to
example.com -- they simply need to add a new redirect every few weeks.

~~~
rem7
that's not how /etc/hosts works. the domain listed in /etc/hosts (example.com)
will point to 0.0.0.0 (or 127.0.0.1)... you'll never even make it to the
server so you won't get the redirect.

~~~
computator
Oops, you're right. I discovered that it was my browser that was "helpfully"
adding www in front of lots of domains I had blocked in /etc/hosts. For
instance, if I blocked example.com, my browser would automatically try
www.example.com (which might then redirect to something else entirely).

In my case, I'm using Firefox. I can stop this behavior by setting
"browser.fixup.alternate.enabled" to "false" in about:config.

