Hacker News Reader

Comment by buckbova | Hacker News Reader

Drop this in your hosts file and set up a refresh script to replace it periodically.

I sincerely hope you don't do this. You're trusting that the people who run that site won't turn malicious in the future; and since your link uses http, you are also trusting that the same applies to their ISP, your ISP, or anyone in between!

Yeah, someone might hijack localhost's address. They might even be so nefarious as to submit RFCs to make that address range publicly routable.

Not the person you are responding to, but it's obvious he's referring to the suggestion that you automatically update the hosts file from the URL.

> set up a refresh script to replace it periodically.

Especially considering the https version of the page isn't valid.

`x.x.x.x foobar.com`

Where x.x.x.x:80 is a redirect to some malicious site.

Here's hoping foobar.com set up HSTS

you could run it through your own sanitizer before deploying even something as simple as

egrep -v "^127.0.0.1|^#|^$" hosts.zero

should help ease your mind that the worst an attacker could do is make some site you want to go to apparently unavailable, but that would be under your control to fix too.

Worked literally for a decade. But I suppose anything can happen.

The connection time outs will make your browsing experience feel slow as page take ages to load before they fail to do so.

If you use the 0.0.0.0 version, pages load much quicker: http://someonewhocares.org/hosts/zero/hosts

Reply on news.ycombinator.com