Blocklist Facebook domains

https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all

by z0a • 8 years ago

1349 348 8 years ago

github.com

reustle• 8 years ago

It's a shame /etc/hosts doesn't support wildcards

0.0.0.0 *.facebook.com

rbritton• 8 years ago

You could sort of work around that by just blocking their IP ranges:

https://stackoverflow.com/a/11164738

topranks2• 8 years ago

The ranges could change over time.

If you run your own DNS resolver you can use the wildcard trick.

Something like this in an RPZ zone should do it:

    facebook.com    IN CNAME .
    *.facebook.com  IN CNAME .
    facebook.net    IN CNAME .
    *.facebook.net  IN CNAME .
    fbcdn.com       IN CNAME .
    *.fbcdn.com     IN CNAME .
    fbcdn.net       IN CNAME .
    *.fbcdn.net     IN CNAME .
    fb.com          IN CNAME .
    *.fb.com        IN CNAME .
    fb.me           IN CNAME .
    *.fb.me         IN CNAME .
    tfbnw.com       IN CNAME .
    *.tfbnw.com     IN CNAME .

joeblau10• 8 years ago

That would only slightly help considering they own so many TLD’s.

topranks2• 8 years ago

Looking at that lists it'd be 16 wildcard entries vs. 895 hostnames. A significant improvement.

vortico• 8 years ago

What software actually parses /etc/hosts, at least on Linux?

kazinator• 8 years ago

What software actually parses /etc/hosts, at least on Linux?

glibc resolver

A good entry point for reading more about it:

$ man nsswitch.conf

If your /etc/nsswitch.conf file's "hosts" line contains the keyword "files", then it potentially uses /etc/hosts. If "files" is first (typical default config), it looks there first, before the other places listed.

This is done under the hood when programs use resolver functions like gethostbyname or getaddrinfo.

walrus012• 8 years ago

you can do this with a DNS zonefile at your local resolver, though.

strkek• 8 years ago

You might want to take a look at dnsmasq. It's a nice choice for when you want a DNS server but BIND is overkill.

jiaweihli3• 8 years ago

I highly recommend using uMatrix[1][2] if you're very privacy-conscious. It's the full-blown everything-at-your-fingertips console.

By default, it blocks third-party scripts/cookies/XHRs/frames (with an additional explicit blacklist). You then manually whitelist on a matrix which types of requests from which domains you want to allow. Your preferences are saved.

It is a bit annoying the first time you visit any new domain, because you need to go through a bootstrapping whitelist process to make it work. After a while I find I do it almost automatically though.

I use it in conjunction with uBlock Origin and Disconnect, and it still catches the vast majority of things. As a nice side-effect, I find I keep pretty up-to-date with new SAAS companies coming out!

---

[1] https://chrome.google.com/webstore/detail/umatrix/ogfcmafjal...

[2] https://addons.mozilla.org/en-US/firefox/addon/umatrix/

michel__• 8 years ago

How can you recommend these extensions without mentioning NoScript?

e40• 8 years ago

Every time this is brought up, in this context, people say the other things do what NoScript does.

And, btw, I use Privacy Badger instead of Disconnect.

BayesStreet• 8 years ago

uMatrix supercedes NoScript by a wide margin.

turc16562• 8 years ago

I second this. uMatrix is my go-to add-on to prevent the vast majority of connections I do not want. However, I pretty much always use my browser in privacy mode no matter what (for several reasons), so the bootstrapping process never ends for me, but that's a price I am more than willing to pay.

foldor• 8 years ago

Just out of curiosity, ehst benefits do you get from privacy mode over several profiles?

nf__852• 8 years ago

I have uBlock Origin and Privacy Badger. Would uMatrix replace those?

beckler• 8 years ago

If you want uMatrix like features in uBlock Origin, go to settings and just click "I am an advanced user".

The dynamic filtering matrix should be available after that.

Granted the defaults are not as strict as uMatrix, it's a good middle ground.

not_kurt_godel2• 8 years ago

Same here. I have zero desire to do any sort of manual configuration any time I visit a new website. Blocking third-party cookies will eliminate like 90% of tracking and uBlock origin and Privacy Badger handle a significant percentage of the rest.

kakarot• 8 years ago

I'm continuing to have issues with frames not displaying unless I completely disable the addon. It's extremely frustrating. I'm in advanced mode and all options are as they should be.

eatbitseveryday2• 8 years ago

I'd prefer a solution that does not just work for a specific browser, but instead blocks all traffic regardless of browser, application, virtual machine, ...

That's just putting rules into /etc/hosts ?

edit - answered my own question :) Yes it will.

ianai• 8 years ago

Is there a way to export the list for a /etc/hosts.allow?

jiaweihli3• 8 years ago

I use Little Snitch[1] (and its sibling Micro Snitch[2]) for filtering connections at the system level. I don't interact with it too often though, because I rarely install new apps.

Not to say /etc/hosts doesn't work, these days I just find I prefer things with better UX.

---

[1] https://www.obdev.at/products/littlesnitch/index.html

[2] https://www.obdev.at/products/microsnitch/index.html

hueving5• 8 years ago

Does /etc/hosts support wildcarding subdomains?

jsmthrowaway3• 8 years ago

Even better would be doing it on a device. It's a reason to have an intelligent router on your network where you run a custom dnsmasq or whatever, then you cover your phones and all the hootenanny that comes with a digital life. Like your fridge.

Bedon292• 8 years ago

Consider something like Pi Hole (https://pi-hole.net/) as the DNS on your network. Where it will affect all devices on the network.

Sir_Cmpwn3• 8 years ago

/etc/hosts won't work for your VM, probably

nijaru• 8 years ago

You can turn on disconnect’s blocklists in ublock origin rather than run both. ublock origin comes with quite a few lists, but most of them are turned off by default.

joeblau10• 8 years ago

Any browser plugin is inferior to using a hosts file. Hosts file's blackhole any network request before even attempting to make a connection. These browser plugins only help if you're using the specific browser — they aren't going to help that electron/desktop app that's phoning home. They wont help block inline media links (Messages on a Mac pre-rendering links) that show up in your chat programs which attempt to resolve to Facebook. They also wont block any software dependency library that you install without properly checking if it's got some social media tracking engine built in.

I don't even waste time or cpu cycles with browser based blocking applications. Steven Black's[1] maintained hosts files are the best for blocking adware, malware, fakenews, gambling , porn and social media outlets.

[1] https://github.com/StevenBlack/hosts/

fwip• 8 years ago

apk, is that you?

hiccuphippo• 8 years ago

What if the ad networks start using IPs directly instead of domains?

cheeze2• 8 years ago

Many users can't modify HOSTS on work computers, etc but can install an extension.

Hosts file is a real pain to disable/enable, at least quite a bit worse than clicking one button in your browser.

I do something very similar to hosts file (at router level rather than os), but there are a few drawbacks over an extension.

isostatic2• 8 years ago

Running your own DNS server, and intercepting DNs traffic on your routerC is better for two reasons

1) processes and machines that bypass hosts are also caught 2) a large hoss file takes time to parse, line by line, slowing every DNA lookup. A DNs server should cache the entire better.

Dnsmasq takes entries in a hosts file format.

fbelzile• 8 years ago

Windows 8-10 users that use Windows Defender will notice that some hosts file entries will be ignored (like popular domains like facebook.com). You will also need to add an exception to the hosts file in Windows Defender.

stephengillie• 8 years ago

uBlock has much the same effect. Requests err in the console with "ERR_BLOCKED_BY_CLIENT" instead of a 404, so technically it is possible to detect this with a first-party JavaScript file.

katastic• 8 years ago

This is downright silly.

HOSTS files are static. They were never designed for blocking ads or tracking. And for all we know, every connection does a linear search through the HOSTS file so the larger it gets, the more wasted time, because it was never designed to have millions of entries.

geofft2• 8 years ago

they aren't going to help that electron/desktop app that's phoning home.

What's your threat model? Mine is third-party tracking cookies, and desktop apps don't share my browser's cookie jar. So while technically I can be tracked by IP from a desktop app, Facebook can't tell if it's me or someone else at the same coffee shop.

In particular, one nice thing about Chrome extensions is that they don't apply to incognito windows. I regularly use HTTPS Everywhere in block-all-HTTP-requests mode + an incognito window on wifi connections I don't trust, because the incognito window will permit plaintext requests, but it doesn't read my cookies or write to my cache, so it's sandboxed from my actual web browsing. I can safely read some random website that doesn't support HTTPS with my only concern being my own eyes reading a compromised page; none of my logged-in sessions are at risk.

any software dependency library that you install without properly checking if it's got some social media tracking engine built in.

... is this a thing? (I totally believe that it's becoming a thing, I just haven't seen it yet and am morbidly curious.)

beagle3• 8 years ago

That doesn't stop anyone using IP addresses directly, and I find that a small minority does (but that minority does including, e.g. Microsoft for some Win10 updates).

Depending on your threat model, you might need to go the proxy/firewall route.

Hosts file is a weird middle ground - that has to be installed and maintained on every device, many of which (e.g. iphone/ipad) won't let you do that. It's better to set up a local DNS, which will serve every local machine; and as I mentioned, doing this at a firewall level is better yet.

javajosh• 8 years ago

The trade-off is that hosts file blocks more processes, but the browser plugin updates more frequently.

Amezarak• 8 years ago

Just browsing through the "fake news" section that hosts file is ridiculous. There's a tremendous number of completely legitimate news sources that are blocked and many that, while lurid, are not in any sense "fake news." The list includes both liberal and conservative legitimate news sites.

FabHK2• 8 years ago

A convenient GUI app for managing the hosts file on macOS machines is Gas Mask, btw. You can have a local hosts file to block your pet peeves, then subscribe to a remote hosts file (such as the one linked above), and activate the combined hosts file.

https://github.com/2ndalpha/gasmask/releases

Metaception• 8 years ago

Any browser plugin is inferior to using a hosts file.

This is objectively false. A hosts file blocklist cannot:

- Global blacklist and whitelist select URLs

- Block all sub-domains of a given URL

- Block third-party iframes and scripts (with whitelist)

A hosts file's feature set is not a superset of a browser based solution and the two complement each other.

flsh42• 8 years ago

And together with the tool gasmask on Mac OS the list is a perfect tool to really block FB.

detuur• 8 years ago

Using uMatrix together with uBlock Origin is a little bit redundant, as uBlock also offers a matrix functionality (enable advanced options). As a matter of fact, iirc uBlock is developed upon uMatrix's codebase by the same author.

alcover4• 8 years ago

I tried uMatrix several times and quit. It's crazy heavy. It takes forever to whitelist parts of a page until functional. Scripts then XHR then more cascaded scripts then frames..

gpvos• 8 years ago

I do the same thing with uBlock Origin with the "advanced user" setting enabled.

flukus3• 8 years ago

I swear by uBlock/uMatrix, but it's amazing how much of the web it breaks and how little of the content of some sites are hosted by the site itself. The web has become very reliant on CDN's.

My public broadcaster (http://www.abc.net.au/news/) for instance is completely reliant on third parties for it's "live story" functionality. It loses half it's functionality at work where twitter is blocked and uBlock kills the other half. It also kills the live stream when it can't load one of the half a dozen trackers on the page.

I'd love the no-script functionality to be merged in too so that I could turn off javascript by default.

clouddrover• 8 years ago

You can also turn on Tracking Protection in Firefox:

https://support.mozilla.org/en-US/kb/tracking-protection

It runs after any add-ons. It's a useful second step that can catch things add-ons miss.

Kiro• 8 years ago

As a nice side-effect, I find I keep pretty up-to-date with new SAAS companies coming out!

What do you mean?

KozmoNau7• 8 years ago

I recommend uBlock Origin in medium mode (check "I'm an advanced user" in the settings, and read this guide: https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

I default deny all 3rd party scripts and frames, in addition to the blocklists, and I only sparingly noop relevant domains, the bare minimum to make pages work, on a page-by-page basis.

On top of that, I have Privacy Badger, Cookie Autodelete Decentraleyes and I've turned on first-party isolation.

It's mostly unobtrusive once my most important websites have been properly noop'ed, and it's relatively simple to add temporary exceptions if needed.

everybodyknows• 8 years ago

A hidden beauty of uMatrix is that with a little training, it doubles as a reminder against low-value search results -- content scrapers, marketers you've already decided never to buy from again. Just red-out the first-party web site. Search engines that can't keep up with the SEO-optimizers e.g. Duckduckgo become more usable.

malloreon• 8 years ago

does this include instagram, messenger, and whatsapp domains too? I'm not sure if these services use their own domains.

'fb' itself will eventually be, if it's not already, just a data holding company for these and other acquisitions.

flixic• 8 years ago

Yes it does. But you could have found this out way faster by just searching on the page.

throwaway847422• 8 years ago

Does anyone have this for Google ads domains and/or YouTube?

amarka• 8 years ago

I don't have a list that I can easily share, but you can curate your own off of https://github.com/StevenBlack/hosts

throwaway847422• 8 years ago

Didn’t know about this. Thanks for the link!

rvshchwl• 8 years ago

This is a good thing to enable, but I think that smartphones contribute exponentially more data to Facebook services than laptops and browsers do. Smartphones give easy access to location, background running services, microphone. Even if you block these permissions to the app, Facebook gets the data from their data providers that use Facebook ads.

rs86• 8 years ago

"Exponentially" means nothing here. Perhaps you are looking for "orders of magnitude"

squiggleblaz• 8 years ago

Well, he could be referring to the relative changes over time of what is contributed by a desktop computer and what is contributed by a smart phone. Antiprivacy features on phones seem to get better at a much faster rate than antiprivacy features on a computer.

nostromo• 8 years ago

[amount of data collected from phones]=[amount of data collected from desktops]^[some exponent]

__jal3• 8 years ago

For iPhones, enterprise management will allow you to set things like /etc/hosts. I do this with my phone.

I don't know what Androids do.

epiapp2• 8 years ago

Can you explain this a little more? Can this be done on a personal phone? I was under the impression that the hosts file was essentially untouchable on an iPhone.

dschep• 8 years ago

On android you can use dns66[0] to use these sort of blocklists.

[0] https://f-droid.org/packages/org.jak_linux.dns66/

nitemice• 8 years ago

Looks like a good alternative if you can't get root. It uses VPN to blackhole requests. If you have root, I'd use AdAway[0] which changes the hosts file directly.

[0] https://f-droid.org/packages/org.adaway/

lwhsiao• 8 years ago

Pi-Hole [1] is another nice way to filter domains at the DNS level network wide, if you want a wider reaching solution that supports wildcards. Great way to use an extra Pi if you have one sitting around.

---

[1] https://pi-hole.net/

LeoPanthera• 8 years ago

If your router is running pfSense, pfblockerng is the equivalent of pi-hole. You can put the same blocklists into it, even. Though the Steven Black combined list is usually enough on its own.

madez2• 8 years ago

Sadly, Pi-Hole is not integrated into Debian. I feel uneasy running software not from the Debian repository. I hope Pi-Hole will be packaged soon.

moviuro2• 8 years ago

More bare-bones than PiHole (no white/black list), simpler too: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me

arbitrage• 8 years ago

Debian has had its share of fuck-ups in its package management system. There's very little difference between blindly trusting debian, vs blindly trusting pihole. Don't pretend you check out the contents of all the packages you use.

RickS• 8 years ago

This list presumably updates/moves around often.

Is there a service that, say, subscribes to a live list of this domain set (like adblock consumes easylist) and updates my hostfile automatically?

If not, that is a piece of software that I would find useful and worth paying for (with the ability to audit the software's ability to phone home about the rest of my hosts file)

eatbitseveryday2• 8 years ago

It would be useful to know how to generate this list in the first place, then just adopt that to create the list on our own, instead of coming back to this github repo to sync every so often.

I do not see this in the repository, presumably to get people to come back to his github repo for updates, but that's my cynicism.

dao-• 8 years ago

Your host file, hmm. Maybe something based on disconnect.me. If you're mostly worried about the browser (which seems sensible for most users), you can just enable tracking protection in Firefox: https://support.mozilla.org/en-US/kb/tracking-protection

source99• 8 years ago

Its actually quite annoying to block all of facebook. There are a lot of innocuous sites that have at least some small reliability on facebook and blocking all of facebook makes using these sites a tad bit difficult / poor UX.

checkyoursudo• 8 years ago

Any examples? I have blocked Facebook for many years, and I can't think of a single time where it has mattered.

I run without JavaScript by default, so maybe I just don't notice those kinds of things after years of conditioning.

__alias• 8 years ago

you run without js by default? God your internet must be boring :)

geoelectric• 8 years ago

I imagine running without JS would be way more impactful on site function, so yeah, it wouldn't change your experience much.

frawley• 8 years ago

I don't see https://messenger.com or https://m.me (which also leads to messenger)

pksadiq• 8 years ago

The last commit to the file is on 4 Oct 2016. So you could expect that.

dang• 8 years ago

Ok, we've added 2016 above.

Unsurprisingly, there is recent stuff on https://github.com/jmdugan/blocklists/pulls. If anyone notices it getting updated, could you tell us? hn@ycombinator.com is best.

bhauer• 8 years ago

Looks like this is already covered by the "Social" add-on to StevenBlack's hosts:

https://github.com/StevenBlack/hosts/blob/master/extensions/...

joeblau10• 8 years ago

Steven Black's list is better. More complete and also has hosts for other social outlets, ad networks and trackers to block.

https://github.com/StevenBlack/hosts/

thelittleone• 8 years ago

Is there a way to redirect to a local HTML file for any blacklisted host file addresses? Something like "You tried to access a site that's blocked in hosts file"? I tend to add blacklists like this then few months later wonder why some site doesn't work.

paxy2• 8 years ago

I wish it were that easy. Good start, but Facebook will still:

1. Get your data from other websites/apps that you allow

2. Get your data through your friends that use Facebook

dwighttk• 8 years ago

shouldn't this keep javascript from facebook domains from loading?

paxy2• 8 years ago

Yes, but a lot of data transfer happens on the backend without the client being involved.

anonu• 8 years ago

I might do this. Just curious if this will break the internet for me... Will certain non Facebook pages fail to load?

drchiu• 8 years ago

Any way to do this at the router level?

spaceandshit• 8 years ago

Pi-hole on a raspberry pi

mito885• 8 years ago

Beavis?

craftyguy• 8 years ago

If you use dnsmasq you can just save this file, set 'addn-hosts=/path/to/list' in the dnsmasq config, and restart the service.

CiPHPerCoder3• 8 years ago

Why would you block WhatsApp?

binarysaurus• 8 years ago

Owned by FB.

CiPHPerCoder3• 8 years ago

It may be owned by Facebook, but it's one of the viable secure messaging apps for people what don't use Signal. The other is Wire.

odammit2• 8 years ago

Man, that person put in some effort. That’s a lot of good lists.

Scrolling through them it’s really interesting to see the other sites companies own.

I always forget WhatsApp is Facebook.

jakeogh• 8 years ago

My setup: https://github.com/jakeogh/dnsgate

nielsbjerg2• 8 years ago

The whole conversation, without having read into everything here in absolute detail, seem to be very tool oriented. Am I the only one here overwhelmed by the sheer amount of domains involved?

Moru2• 8 years ago

It's mostly subdomains since windows can't use wildcards (*.domain.com). Setting up such a large hosts-file might slow down your computer a bit though.

There are some tools that lets you run wildcards in the hosts-file but can't remember the names at the moment.

nielsbjerg2• 8 years ago

Again, a tool concern. Not trying to downplay the possible solutions, but rather bring attention to the magnetude

snowpanda2• 8 years ago

It's a ridiculous amount, looks like someone just created a pull request with 500+ more facebook domains.

epiapp2• 8 years ago

For anyone who's interested, I also maintain a tracking protection list for Internet Explorer. It's based originally on the Ghostery and Disconnect lists, but I now update it independently. It's designed to be concise and speedy, yet also comprehensive. Note, however, that due to the limitations of tracking protection lists in IE, it can't block everything. You may need to supplement it with a small hosts file. Check it out here: https://github.com/amtopel/tpl

walrus012• 8 years ago

Similar solution to blocking things at your local recursive DNS resolver, assuming you have a captive pool of devices, let's say in 10.240.0.0/24) in a LAN, all of which are given DHCP addresses and DHCP-assigned DNS resolvers, and you're in control of a bind9 server that's on the same LAN.

Not going to prevent people with admin rights on their workstations from using another DNS resolver (or VPN, or whatever), but a fairly low effort solution.

https://community.jisc.ac.uk/library/janet-services-document...

angadsg• 8 years ago

Created a pi-hole friendly blocklist https://gist.githubusercontent.com/angad/3db2da1cb50a4432c9e...

stiangrindvoll• 8 years ago

This is quite a powerful message!

yorby5• 8 years ago

block all of Google's IP addresses: https://support.google.com/a/answer/60764?hl=en (note: your internet (the web) will stop working properly if you do block all of those IPs, which is a big problem)

cbdumas• 8 years ago

Can you be more specific about your internet not working with those addresses blocked? What exactly doesn't work?

yorby5• 8 years ago

it depends on what sites you are using, but I beg you to try it and I can almost guarantee you that it will break your browsing experience... (even if you aren't using google search or gmail)

rphlx10• 8 years ago

A lot of sites pull in popular js libraries from google; the idea being that they'll already be in a user's cache and even if they're not, google has a better (cheaper, faster and/or lower latency) CDN than the site author.

4684499• 8 years ago

Additionally:

https://github.com/jmdugan/blocklists/blob/master/corporatio...

https://pastebin.com/V9nzBXnx

I only blocked some of these domains. Blocking all Google domains basically makes the Internet unusable.

saagarjha2• 8 years ago

your internet (the web) will stop working properly if you do block all of those IPs

Hmm, how does China handle this then?

yorby5• 8 years ago

good question... I'd be curious to know if they block all of Google's IP addresses.

partycoder• 8 years ago

A blacklist approach to this is for sure a cat and mouse game. A better approach is to incrementally whitelist the domains you trust.

cgmg• 8 years ago

Not sure why you were downvoted, but this is correct. Facebook (or anyone else) can easily create more domains.

rphlx10• 8 years ago

In general blacklists are a better choice overall for non-technical users. Do you really want an angry text message or phone call every time $FAMILY_MEMBER has some site that's rendering poorly because they haven't properly whitelisted one of the 12 legit domains it hits? And do you really trust them to not whitelist some ad & tracking domains?

megous• 8 years ago

Presumably, $FAMILY_MEMBER would have to get past the phone number whitelist too. So it might not be that bad.

alcover4• 8 years ago

I wonder how Facebook devs feel when they read such posts. Do they feel rejected ? shameful ? Does their salary really outweigh this collective disapproval of their peers ?

madeofpalk2• 8 years ago

I worked for a less-than stellar online publication in Australia. Think low-budget Daily Mail. I didnt care, I still got paid and got to switch off and do my own thing when I wanted to. I'm not my job.

alcover4• 8 years ago

That is what I suspect but still.. Respect in the eye of peers is a human need. If I met a developper and learned he works for FB, it would be visible on my face that I feel somewhat put-off.

dawnerd• 8 years ago

I worked for eHow. We felt the same as the people complaining about it. But it paid the bills. Did get to learn how to scale REALLY fast.

dclowd99013• 8 years ago

“I’m not my job”

You are when your job requires you to sidestep your morals.

colordrops2• 8 years ago

I met some of them. They either don't think about it, or they actively revel in not being one of the proles that aren't in on it. The ones that stress about it eventually leave.

AndrewKemendo• 8 years ago

Does their salary really outweigh this collective disapproval of their peers?

Isn't that the going ethos currently?

Something akin to: Pay me as much as possible, don't ask me to be part of your culture, don't ask me to work more than 40 hours a week, don't ask me to take stock, don't have a mission statement, make sure I'm working on something that is engaging mentally.

jsmthrowaway3• 8 years ago

Depends on what you mean by “going ethos.” Healthy perspective on an employment relationship from your perspective, yes. Anathema to a large number of Silicon Valley startups where you will likely get branded as neither a culture fit nor a team player, as well, yes.

It’s wise in the Valley to hold such an opinion but not make it very prominently known. There are a number of people who want your job and will say something more palatable to your employer, and eat your free meal while shipping a feature at 10pm because they buy into the posters on the wall. Many allegations of ageism (but not all) can probably trace back to something like this, in my uninformed gut opinion, because you will almost certainly get replaced by a new grad when the hammer falls. I don’t even see it as personal, but a demonstration of incentives: they can get a loud 40 from you or a quiet 80 from a newly minted BSc. QED.

Just decline invites and push back on over 40. Expressing that attitude at a typical company within this audience basically paints “please lay me off” on your back. When you’re getting into post-senior titling, or you’re really specialized in a tough req to fill, is when that approach becomes more feasible.

rphlx10• 8 years ago

I don't use FB and definitely do not like their business model, but it's also true that their users are there voluntarily and most of them are at least vaguely aware that they're being aggressively data harvested by an amoral, profit-maximizing corporation. So I don't see a legit reason to blame or hate on the devs there. Especially when you consider that most of them work on the "good" rather than the "evil" part of their stack.

qwerty4561272• 8 years ago

their users are there voluntarily

Not really. Many people just feel they have to use Facebook to connect with the society efficiently. Some people even consider those who don't use Facebook weird.

Yhippa• 8 years ago

Doesn't FB keep track of (possibly profile) people who don't directly use FB? They can possibly profile you from using data brokers and information actual FB users give to them.

askmike• 8 years ago

Would you say the same about gambling software? What about software related to selling heroin?

All of these products are designed to be as addictive as possible (to varying degrees). The whole point of of an addiction is that your are there voluntarily. (Not saying facebook is as bad as the things above, just that they are all designed to addict.)

vanilla_nut• 8 years ago

Except for the folks who didn't make an account whose friends have contributed to "shadow profiles" for them...

I mean, let's just admit that you don't have to be a Facebook user and you don't have to sign a Facebook TOS for them to accumulate data about you, so it's not quite as cut-and-dry as you make it out to be.

As far as the "good" and "evil" parts of the stack... fair point. I think most devs are somewhat abstracted away from the collectively malicious vision, since most of the constituent parts are relatively benign on their own -- "let's identify faces in photos!", "let's automatically identify faces in photos", etc. It's product folks, or maybe even higher up than that, who connect the powerful pieces produced by devs to actually make Facebook the monster it is today. I'd guess that even the devs who have impact on that vision don't really have the power to dramatically sway that vision, they've got a bit of technical input at best.

Still, have you ever worked on a product you don't believe in? If you're just cashing in a check, I guess it could work, but if you're as idealistic as me you want to work on something that's doing good in the world. Especially when so many tech companies proclaim their intent to "make the world a better place" or "do cool things that matter."

dclowd99013• 8 years ago

They’re probably brushing up their linkedin pages

secondarychris• 8 years ago

I actually just got a job there out of school, starting in a few months. Reading these comments is certainly interesting although it's not news to me that Hacker News hates Facebook.

I've long been skeptical of the effects of social media though, and I'm taking this job mostly just because doing otherwise seems like a really poor career choice. Plus it seems like Facebook is here to stay, and I can dream of helping to fix the problem instead of just enabling it.

aylmao2• 8 years ago

Good attitude (:

EDIT: Is HN's Facebook hate getting so heated I'm getting down-voted for sending some good vibes to a newgrad about to start her/his first job?

I bet you all took you first job at Doctors Without Borders helping children in Angola. FFS the Waltons are the scourge of this world but I don't blame the kids going off to work at Walmart. I bet a lot of you pay taxes in the US too-- those taxes financed the war in Afghanistan but you didn't move to Morocco, did you?

Give me a break. Let this kid come in with a good attitude, eyes open, loud and proud. Who knows maybe he'll turn some heads. The guy signed and it is a good career move, what's wrong with cheering the guy up. Disappointed at you HN.

not_kurt_godel2• 8 years ago

You are enabling it. You know that and it will gnaw at your soul and make you deeply unhappy as long as you work there.

Symbiote• 8 years ago

I can dream of helping to fix the problem

That's about all though, isn't it? There's a negligible chance you'll actually fix the problem, unless you manage to leak evidence to the media or similar.

I write software for biologists, am I feel I'm much, much happier doing that than I would be working at Facebook.

worldexplorer• 8 years ago

Getting a job offer at Facebook is a great achievement. Some people I know just moved to US to pursue masters and then apply at Facebook. If you have offers from another tech giants like Google than you can do your own analysis (SWOT maybe) to choose the right options. Some years down the line you can always switch to any company in the world.

rplnt• 8 years ago

I worked for an AV vendor for years. The online hate it gets is huge and constant (mostly wrong, but some points are valid). And even though I don't like the monetization strategies for example, I believe the product itself was OK, and most importantly helpful to many.

As a Facebook user I obviously don't like what they do with the data, but at the same time I think they provide an OK service that is beneficial to many. I wouldn't mind working as a developer there on what I imagine is overwhelming majority of positions.

avree• 8 years ago

I think most of their peers are mature enough to realize that the poor (historic) management decisions of a company (which are now catching up to said company) are not reflective of the personality or character of the hundreds of thousands of employees performing various roles at said company.

mockindignant• 8 years ago

There is more coverage of this topic here: https://news.ycombinator.com/item?id=11791052

snowpanda2• 8 years ago

Nice to see HackerNews create pull requests to make the list more up to date. I hope they get committed.

https://github.com/jmdugan/blocklists/pulls

cyberferret• 8 years ago

Interesting to see several domain names/servers with 'mqtt' referenced. Wondering if Facebook interacts with IoT devices routinely, or perhaps they use MQTT for Messenger message transfers etc.?

Digital-Citizen• 8 years ago

Yet again, software freedom fighters got there years ago.

Free Software Foundation got there earlier. From publishing https://www.fsf.org/facebook published on on Dec 20, 2010. FSF & GNU Project founder Richard Stallman has been rightly objecting to Facebook for years in his talks and on his personal website at https://stallman.org/facebook.html.

Long-time former FSF lawyer Eben Moglen rightly called Facebook "a monstrous surveillance engine" and pointed out the ugliness of Facebook's endless surveillance (at length in http://snowdenandthefuture.info/PartIII.html but in other places in the same lecture series as well). See http://snowdenandthefuture.info/ for the entire series of talks.

heretoo12• 8 years ago

Yes, but where do they offer solutions to transition (emphasis on transition) from what people currently use to a more open ecosystem?

At least in the software licensing arena, having personally visited a lecture from Stallman, I was left with the impression that he wasn't offering a solution, just a vision of a Utopia without any guidance on how to transition to it -- more specifically, how would we make money from open source software, when currently proprietary software is the default for making money.

hueving5• 8 years ago

more specifically, how would we make money from open source software,

See redhat.

cyphar3• 8 years ago

how would we make money from open source software

There are many existing examples, so this is clearly a solved problem already. You charge for support, or for feature requests, and so on. That's how SUSE and RedHat make their money.

The flaw with looking at proprietary software's monitisation is that it usually just boils down to "pay for the binary". This obviously won't work with free software, you need to charge for development rather than access (though you can also use a seat-based model where you only provide support for machines that have valid licenses).

(I work for SUSE.)

cornholio• 8 years ago

do they offer solutions to transition (emphasis on transition) from what people currently use to a more open ecosystem?

A comment I made two weeks ago that is pertinent to this discussion:

Niche market software, used by a limited number of highly specialized professionals, is somewhat incompatible with the open source economic model. When a piece of software is used by very many users, and there is a strong overlap with coders or companies capable of coding, say an operating system or a a web server, open sources shines: there is adequate development investment by the power-users, in their regular course of using and adapting the software, that can be redistributed to regular users for free in an open, functional package. At the other end of the spectrum, when the target audience is comprised of a small number of professionals that don't code, for example advanced graphic or music editors or an engineering toolbox, open source struggles to keep up with proprietary because the economic model is less adequate: each professional would gladly pay, say, $200 each to cover the development costs for a fantastic product they could use forever, but there is a prisoner dilema that your personal $200 donation does not make others pay and does not directly improve your experience. Because the userbase is small and non-software oriented, the occasional contributions from outside are rare, so the project is largely driven by the core authors who lack the resources to compete with proprietary software that can charge $200 per seat. And once the proprietary software becomes entrenched, there is a strong tendency for monopolistic behavior (Adobe) because of the large moat and no opportunity to fork, so people will be asked to pay $1000 per seat every year by the market leader simply because it can.

A solution I'm brainstorming could be a hybrid commercial & open source license with a limited, 5 year period where the software, provided with full source, is commercial and not free to copy (for these markets DRM is not necessary, license terms are enough to dissuade most professionals from making or using a rogue compile with license key verification disabled).

After the 5 year period, the software reverts to an open source hybrid, and anyone can fork it as open source, or publish a commercial derivative with the same time-limited protection. The company developing the software gets a chance to cover it's initial investment and must continue to invest in it to warant the price for the latest non-free release, or somebody else might release another free or cheap derivative starting from a 5-year old release. So the market leader could periodically change and people would only pay to use the most advanced and inovative branch, ensuring that development investment is paid for and then redistributed to everybody else.

kerkeslager2• 8 years ago

Given the bang up job we've done so far, I'm not sure people making money off of software has been a net positive for humanity. Maybe it's the idea that money is the only way we can get software that is the problem.

I remember when the internet was mostly people's personal websites that they didn't make money off of, and frankly, the internet was better then. The best websites that exist now started in that era.

cup-of-tea3• 8 years ago

I was left with the impression that he wasn't offering a solution, just a vision of a Utopia without any guidance on how to transition to it

Stallman quit his job to write an entire free software operating system and essentially dedicated his entire life to it. What more do you want?! I don't even want to imagine a world without Richard Stallman.

fghtr• 8 years ago

how would we make money from open source software

https://en.wikipedia.org/wiki/Business_models_for_open-sourc...

alpb• 8 years ago

This list must've updated a lot since 2016.

HenryBemis2• 8 years ago

I want to share my favorite HOSTS file provider [1] which includes FB addresses.

[1] http://someonewhocares.org/hosts/

mito885• 8 years ago

goatse!

computator2• 8 years ago

I'd like to mention a problem with blocklists like this that you put into /etc/hosts. I've noticed that many sites trivially evade the blocklist by adding a redirect. I.e., if example.com is blocked, but it redirects to example.ru or example123.com or example.team, then it still works. The spammers and advertisers don't have to change all the existing links to example.com -- they simply need to add a new redirect every few weeks.

rem7• 8 years ago

that's not how /etc/hosts works. the domain listed in /etc/hosts (example.com) will point to 0.0.0.0 (or 127.0.0.1)... you'll never even make it to the server so you won't get the redirect.

computator2• 8 years ago

Oops, you're right. I discovered that it was my browser that was "helpfully" adding www in front of lots of domains I had blocked in /etc/hosts. For instance, if I blocked example.com, my browser would automatically try www.example.com (which might then redirect to something else entirely).

In my case, I'm using Firefox. I can stop this behavior by setting "browser.fixup.alternate.enabled" to "false" in about:config.

ryanlol• 8 years ago

This is a terrible approach. Facebook can rotate many of these names whenever they feel like.

Froyoh• 8 years ago

Why not do something like *facebook.com?

dredmorbius6• 8 years ago

Hosts syntax doesn't allow for that.

DNSMasq would, however, allow you to only specify each TLD.

xyrouter2• 8 years ago

I can block domains on my laptop, no problem. But I have not been able to figure out any convenient way to block websites on my Android phone. My Android phone comes with a Chrome browser. Any ideas about how to block websites reliably on an unrooted/jail-not-broken Android phone?

bronco21016• 8 years ago

Block at DNS level on a device (router or DNS server) and proxy all Android traffic to said device.

I use a pfsense router running OpenVPN and pfblockerNG. PfblockerNG sinkholes all DNS requests to domains from a list such as this one. Then by using OpenVPN I simultaneously encrypt my connection when roaming remotely and I can specify to use my home DNS server to sinkhole ad/tracking domains.

xyrouter2• 8 years ago

Thanks for the suggestion. I think this will work fine in a home network that I can control. But this is not going to work when I am traveling and using my carrier's 4G network. Am I right? Is there any nifty solution to address the later?

I am a little disappointed that I can't do something as simple as install plugins for my phone browser that can block sites.

halamadrid• 8 years ago

Wow the hate/dislike is very real.

knowThySelfx• 8 years ago

Why only Facebook? All companies which store data are suspect.

Mizza• 8 years ago

I made one of these for Google: https://github.com/Miserlou/nogoogle

also: https://github.com/Miserlou/Poop

throwahey• 8 years ago

Your list does basically nothing for Google tracking domains. Here is mine: (note that this blocks recaptcha which a lot of websites are now using for login annoyingly). I add entries for IPv4 and IPv6 (0.0.0.0 and ::1 respectively).

    0.0.0.0 google.com
    0.0.0.0 www.google.com
    0.0.0.0 fonts.googleapis.com
    0.0.0.0 google-analytics.com
    0.0.0.0 apis.google.com
    0.0.0.0 tpc.googlesyndication.com
    0.0.0.0 ssl.google-analytics.com
    0.0.0.0 www.google-analytics.com
    0.0.0.0 www-google-analytics.l.google.com
    0.0.0.0 stats.g.doubleclick.net
    0.0.0.0 clients.l.google.com
    0.0.0.0 pagead.l.doubleclick.net
    0.0.0.0 pagead2.googlesyndication.com
    0.0.0.0 googleads.g.doubleclick.net
    0.0.0.0 www-googletagmanager.l.google.com
    0.0.0.0 googleadapis.l.google.com
    0.0.0.0 gstatic.com
    0.0.0.0 ssl.gstatic.com
    0.0.0.0 www.gstatic.com
    0.0.0.0 www.googletagservices.com
    0.0.0.0 www.googletagmanager.com
    0.0.0.0 securepubads.g.doubleclick.net
    0.0.0.0 tpc.googlesyndication.com

To login to a google service such as gmail or enable captcha, comment out the three (*.)gstatic domains.

mito885• 8 years ago

nice!

thetruthseeker1• 8 years ago

Can somebody elaborate why this link from 2016 is gaining steam here? Is it because Cambridge Analytica misused FB data? May be I am missing something, do we know if facebook was wittingly complicit?

yeahdef• 8 years ago

If Facebook is negligent or complicit, I'd certainly change how I interact with the platform. I haven't kept up with the details and would love to be pointed to some summation / analysis of the facts.

RealityVoid• 8 years ago

I'm not a big fan of Facebook but I do find it useful. That being said, this feels to me like a coordinated attack campaign. Take an issue, blow it up, attach various other nebulous bad things and push it to a public that was already primed against that very service. Seems to be working great.

I do not know who or why is pushing this campaign but it definitely feels organized and calculated.

Dirlewanger• 8 years ago

The sudden mainstream outrage toward Facebook is most likely because the Cambridge event is the perfect confluence of "Facebook", "Trump", and "bad".

yumraj• 8 years ago

Minor segue, is there any easy way to Geo-block URLs, both by ccTLDs and by geolocation of IPs from certain countries.

I have pi-hole running but it doesn't support that currently, best it does is wildcard but even for that it needs domain and won't do just on the ccTLD.

dredmorbius6• 8 years ago

ASNs, kinda, maybe.

tartrate2• 8 years ago

Is it really any use trying to enumerate all variants under *.facebook.com and similar?

The counts:

    307 facebook.com
    295 fbcdn.net
    250 tfbnw.net
     12 whatsapp.com
      9 instagram.com
      3 fb.com
      3 edgesuite.net
      2 metrix.net
      2 fbsbx.com
      2 fbcdn.com
      2 facebook.net
      2 edgekey.net
      2 cdninstagram.com
      2 akamaihd.net
      1 fb.me
      1 appspot.com

Jaruzel• 8 years ago

Where/How did you get that list?

tartrate2• 8 years ago

grep -Po '\w+\.\w+$' | sort | uniq -c | sort -rhk1

Bit sloppy because it doesn't pick up the domain names with dashes. But my point was that if you want to blacklist *.facebook.com you shouldn't try to enumerate every single variant of it, that's not durable.

wodenokoto• 8 years ago

My thoughts were also, why so many subdomains? I wonder if it is to make the list seem more impressive and Facebook more all-encompassing.

"If you want to block facebook you need to block almost a thousand websites!"

skocznymroczny• 8 years ago

"Then we will browse in the shade."

SjuulJanssen• 8 years ago

A bit further down in the replies reustle mentions: `It's a shame /etc/hosts doesn't support wildcards`

TremendousJudge• 8 years ago

I find that ridiculous. Is there a reason why it's that way?

digitalbase• 8 years ago

Someone should start a business for this:

Provide people that care about privacy with a public DNS server they can use that auto blocks those domains (and update's its lists). I would pay for it (few dollars a month)

Feature suggestion: allow people to add their own entries so I can purposely block reddit or hacker news to reduce distractions.

Pretty sure I would set this DNS server on both my phone and desktop.

dontchooseanick• 8 years ago

I advocate for iptables instead of DNS filtering.

Process of enumerating and rejecting facebook IPs :

* Query the RAD http://radb.net/query/ , search for AS32934

* Enumerate ip ranges by http://radb.net/query/?advanced_query=1

* Check inverse query by origin, use AS32934

* Grep the response route and route6 CIDR ranges

* Build a netfilter script with REJECT

Gives those scripts for iptables (updated once in a while) :

* https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8...

To enable :

* iptables -I OUTPUT -j no_facebook_out

* iptables -I INPUT -j no_facebook_in

* ip6tables -I OUTPUT -j no_facebook_out

* ip6tables -I INPUT -j no_facebook_in

By design, instagram and connect-with-facebook get muted too.

DavideNL3• 8 years ago

To get a list of all Facebook ip's:

  whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebook.list
  whois -h whois.radb.net '!6AS32934' | tr ' ' '\n' | grep '::' >> facebook.list

amelius• 8 years ago

I need something like this that I can install on friend and family's phones/iPads/computers whenever they ask me to fix something for them >:)

FabHK2• 8 years ago

Gas Mask is a neat macOS app to manage hosts. You can subscribe to a remote hosts file, too.

rawland• 8 years ago

Let's put this in global context:

    Adblocking is a non-trivial task, but there are trivial solutions.
    
    1.) Install hosts-gen from http://git.r-36.net/hosts-gen/
    
    % git clone http://git.r-36.net/hosts-gen
    % cd hosts-gen
    % sudo make install
    
        # Make sure all your custom configuration from your current /etc/hosts is
        # preserved in a file in /etc/hosts.d. The files have to begin with a
        # number, a minus and then the name.
    
    % sudo hosts-gen
    
    2.) Install the zerohosts script.
    
    # In the above directory.
    % sudo cp examples/gethostszero /bin
    % sudo chmod 775 /bin/gethostszero
    % sudo /bin/gethostszero
    % sudo hosts-gen

Add a cron job, and enjoy your faster and adfree-er internet. Further, you can add your custom (this FB) block to the local files in /etc/hosts.d, which then will be concatenated automatically.

[source]: https://surf.suckless.org/files/adblock-hosts/

jason_slack3• 8 years ago

Are there any implications to having 40,000+ lines in your /etc/hosts?

nomercy400• 8 years ago

It's basically a big lookup table, trading storage for speed.

The most noticable effect is that your web pages load faster, because a lot requests for unnecessary data (eg. Facebook in this example) complete immediately. Occasionally you will miss out on a webpage that depends on it.

Think uBlock Origin, but not for just your browser but your entire system.

jason_slack3• 8 years ago

Thanks I have used /etc/hosts for a long time. I however just realized exactly how big mine is getting.

dredmorbius6• 8 years ago

I've seen no noticeable impact to 100k+ lines.

jason_slack3• 8 years ago

This is good to know. Thank you for the reply.

heckanoobs• 8 years ago

Why would you block all the domains but still keep your account that you would no longer be able to access? The account is the problem not the domains. You would have to block the domains on every device you use. Just kill the problem at the source and delete your entire surveillance account with facebook.

lnx012• 8 years ago

Because facebook tracks you even if you don't have an account.

dandigangi• 8 years ago

One of the posts I wish I could upvote more than once. Thank you.

stirner2• 8 years ago

I wrote a small tool that translates AdBlock Plus filter lists into hosts file format [1]. It can only translate simple domain-name rules but might be of interest to people in this thread.

[1] https://github.com/wwalexander/hostsblock

zackmorris• 8 years ago

Thank you, I didn't know about the `cat -` trick to read from stdin (works the same as `echo hi | cat /dev/stdin`). Even after all this time, I still learn something new every day.

stirner2• 8 years ago

    echo hi | cat -

is also equivalent to

    echo hi | cat

You only need the - if you are concatenating other files with stdin [1]. Incidentally, any use of

    echo x | y

can be replaced (at least in Bash) with

    y <<< "x"

This is called a "here string" [2].

[1] https://www.freebsd.org/cgi/man.cgi?query=cat&manpath=FreeBS...

[2] http://tldp.org/LDP/abs/html/x17837.html

imhelpingu• 8 years ago

It's pathetic that it takes a literal propaganda campaign to make people see the problem with facebook after 10 years, but whatever I'll take it.

Pete_D• 8 years ago

A lot of commenters mention dnsmasq. I wrote some scripts a while ago to help minimize a dnsmasq config that had been generated from a hosts file. People in this thread might find them useful.

https://petedeas.co.uk/dnsmasq/

DavideNL3• 8 years ago

on macOS i use a bash script to get all Facebook ip addresses:

  whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > "/etc/pf.anchors/usr.home.sub/facebook.list"

and then use a pfctl anchor to block them all

  table <facebook> persist file "/etc/pf.anchors/usr.home.sub/facebook.list"
  block drop quick to <facebook>

mito885• 8 years ago

merci.

mito885• 8 years ago

what is the difference between 0.0.0.0 and 127.0.0.1 with respect to redire ction?

will redirecting to localhost eat more cpu cycles?

dredmorbius6• 8 years ago

0.0.0.0 is no host. 127.0.0.1 is localhost, and will still generate a query.

If you've a webserver there, its logs might get busy with the blocked traffic requests.

ChoGGi• 8 years ago

The list has fbcdn-profile-a.akamaihd.net, but it missed fbcdn-creative-a.akamaihd.net

If anyone wants it

Blocklist Facebook domains

Related Stories