Slashdot Mirror
Anatomy of an Attempted Malware Scam
Dynamoo writes "Malicious advertisements are getting more and more common as the Bad Guys try to use reputable ad networks to spread malware. Julia Casale-Amorim of Casale Media details the lengths that some fake companies will go to to convince ad networks to take the bait."
They've been on my HOSTS block for years, ever since one of those annoying GIF popups damn near gave me a seizure bouncing in its frame. Have they improved since?
they are not held accountable for anything, not for copyright, not for privacy issues as well. continue worshiping them and see what happens.
"They've been on my HOSTS block for years, ever since one of those annoying GIF popups damn near gave me a seizure bouncing in its frame. Have they improved since? - by ScottCooperDotNet (929575) on Thursday August 05, @01:52AM (#33147212)
Good man, & same here: Mod ScottCooperDotNet up, because he knows what he's doing in using HOSTS files!
I say that because custom HOSTS files (especially for defense) are great stuff.
I.E./E.G.-> HOSTS files cover any and ALL "WebBound apps", unlike browser addons which are centered on specific webbrowser programs only. This means external email progs. for example, like Outlook/Outlook Express, are covered as well vs. HTML based email attacks etc./et al...
1 piece of advice though Scott - use 0.0.0.0 as your blocking address because it's smaller than 127.0.0.1, so it reads up from disk faster and thus inits itself quicker into memory, and yet it works the SAME as 127.0.0.1 for the same valuable blocking function vs. known bad sites/servers/hostnames-domainnames - on Windows VISTA/Server 2008/7, 0.0.0.0 is the most efficient blocking address you can utilize in fact for that purpose...
(Also on this account? IF you use Windows 2000, XP, or Server 2003?? You can do that even 1 better, by using 0 (vs. 0.0.0.0 & especially 127.0.0.1 & for the same reasons - better speed & efficiency of loads/reloads of your HOSTS file)).
APK
God says... Whereas Into killed understand Old initiated credibility Madness increase feet approve helper convict closing harmed twice perisheth triumpheth Apostolic
When God goes to war, He drops big bangs.
I read the article, and in doing reference checks in the digital age, esp when there is a large chance of fraud, that checking domain reg's etc only came in last. It's not hard to program in automatic checking, and by the sounds of it, would stop how easy this type of scam would be implemented. Also they could do reverse phone number checks etc as well. I'm quite sure if they had that information automatically populated during an application, any attempts to defraud the companies would be found out with alot less time.
"We've also highlighted some pink flags"
Is that close to a fuchsia, because I like totally need a flag like that to match my new outfit.
I'm comforted to know that Casale Media will pass on obnoxious mortgage refinance advertising from only verified and legitimate predatory lenders!
These checks aren't in place out of any concern for the security of ad viewers. Casale Media here is only concerned that the phantom business will disappear without paying once the botnet is established. Ad networks have demonstrated they don't give a damn so long as they get their cut.
My AdBlock Plus stays on.
"Better to use 0.0.0.0 - since it's a real invalid IP, connecting to it fails instantly, while a program trying to connect to 127.0.0.1 will take a while before giving up." - by Anonymous Coward on Thursday August 05, @02:01AM (#33147262)
Good point on the 127.0.0.1 "loopback adapter" address having to go thru "loopback operations" (which are indeed, slower), fellow AC (per my subject-line above), and there's more too: See here, I cover it (speed & efficiency gains on loads/reloads + parsing of HOSTS files using 0.0.0.0 (or even 0 on SOME OS')) -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33147274
There's MANY benefits & gains in the usage of a custom HOSTS file period vs. say, browser addons (specific to certain browsers only usually, if not always) for the purposes of protection and speedup of your websurfing online.
(That's since blocking banners yields more speed alone, & you can even "hardcode in" your fav. sites to go to them even FASTER than normal by avoiding DNS lookups (DNS servers are compromisable (see Dan Kaminsky on this) & can also go down too)!
APK
And site owners and advertisers wonder why users go to such extremes with Adblock plus and NoScript to block ad's.
If the sites (or ad distributors) can't guarantee the safety of their own sites, then users have to do whatever is necessary to protect their own systems. If that means no advertising income for those sites - tough luck.
But if a WHOIS lookup on a new customer's domain isn't in your SOP from the get-go, you're strictly amateur hour.
reputable ad networks? What are those? Is he speaking of google ad-sense? or Hulu ads? Personally, I don't consider ad networks that use banner ads as anything that are reputable (this includes any of the shady ad-networks that Google purchased as well). Non-obtrusive text ads, I can deal with. Even Hulu ads, I can deal with since it's film on film. It's just that I hate banner ads, or animated ads, when I'm in reading-mode.
SOP from the get-go, you're strictly amateur hour. pgup http://www.klimaservisii.com/
"Using "0.0.0.0" instead of "127.0.0.1" is not more efficient because of size. There's only 2 bytes difference between the two; if your computer has a noticeable speedup just because it's reading 2 bytes less per HOSTS entry, you have way too many entries and probably more important problems." - by agrif (960591) on Thursday August 05, @04:13AM (#33147664) Homepage
Are you trying to tell us that reading MORE bytes is not slower than reading less bytes, line per line in a HOSTS files while it's parsed for loading? I have to say that I "beg to differ" on that account, & I'll let others judge on that account also, on line by line reads for parsing & loading HOSTS files.
See, I know this, because I've actually timed loads into list boxes on this account in a program I wrote to remove duplicated entries in HOSTS files and to alphabetize the entries afterwards also. While profiling this using timers, there was a difference between loading HOSTS files & their record entries when using 0.0.0.0 (faster) vs. 127.0.0.1 (slower) and even larger differences on Windows 2000/XP/Server 2003 where you can STILL USE 0 (vs. 0.0.0.0 or 127.0.0.1) as a blocking "ip address" in a HOSTS files (whereas you cannot in VISTA/Server 2008/Windows 7).
"Using "0.0.0.0" is good advice; I just wanted to make sure your reasons for using it are valid." - by agrif (960591) on Thursday August 05, @04:13AM (#33147664) Homepage
My reasoning here, in BOTH of my posts? Are QUITE valid, and even TESTED via programming using timers for profiling my procs in fact, see above!
Also/By the way: In my other post here that predates yours here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33147354
?
There I covered, IN DETAIL, why using the 127.0.0.1 loopback adapter address is slower on the other account too: Because it incurs the loopback operation.
APK
P.S.=> All in all, thanks for the compliments & what-not but... Please read CLOSER &/or FURTHER next time... apk
But, I'm not really surprised the lengths these "fake companies" will go. Money is a precious thing in this world and if you can't 'seem' to make it legally, you may just turn to crime. Even people who would have never considered doing something like this may be driven to new heights in desperation.
However, some of these people may or may not be the desperate, dirt poor, starving, "means-to-an-end" people I portrayed but, take a minute and think of the things you would probably do if there was truly, no other way you could think to survive in this messed up little world.
*Process is Irrelevant, Progress is Paramount*
Ultimately, how does the end users computer get infected by this `malware'?
"I got stung by a drive-by exploit on a work machine .. something that installed 'XP Antivirus 2010"
Run your browser from a read-only device, that way you won't ever get stung.
Pendrive
http://wiki.answers.com/Q/What_is_a_computer's_loopback_IP_address
(Look there, you'll see it's been answered as 127.0.0.1, as was stated in my init. posts here also (that 127.0.0.1 is the loopback adapter address)
This also backs it as well:
"127.0.0.1 is the loopback adapter address present in every TCP/IP-enabled computer which causes the computer to refer to itself without knowledge of its own name or address"
(Pertinent Quote above is from here -> http://www.linuxsecurity.com/content/view/112264/ in fact).
Heck, I suppose you can check the RFC's themselves even to further verify this, but I think that attempting to further "nitpick" my points on this will be fruitless on your parts guys (I've been into this area since the mid 1980's really on *NIX systems, & put up a lot about it for PC users since, oh, 1996-1997 or so, online on forums etc.)
APK
See my subject above: And, so did others in my sources as well...
"you know why wireshark can intercept loopback traffic on windows? because by design windows doesn't provide a compatible loopback system, insisting on doing it in memory for performance reason. hey, for being an expert, you suck. however, you can install it to become standard if that suits your need: http://www.windowsreference.com/windows-7/how-to-install-a-loopback-adapter-in-windows-7/
but don't let facts get into the way of your 'expertise'" - by Anonymous Coward on Thursday August 05, @06:04AM (#33148048)
First of all, yes, I know that. Secondly: Care to show us where I said it wasn't done in memory OR by hardware? I never said it, but I still challenge you to show where I said either thing. So, that all "said & aside":
Care to show us I stated ANY different or about anything else on that account here, or that I stated anything about a hardware based loopback adapter?
Fact is, you brought that up, not I... & not that it matters here at all. I only stated what others I used as my facts & sources stated, & that's that 127.0.0.1 = the loopback adapter address.
All you have now is your foot in your mouth in attempting to cover the fact that either you cannot read, or that you skim badly alongside your name tossing ad hominem attacks (out of your frustration in your own screwup which anyone is free to see in your posts vs. mine, as it's all written here in plain black & white by us both!)
APK
P.S.=> Above all else? Well, based on the evidences I used, all fact based?? I think you should learn to read before you attempt to put words into others' mouths & to troll or nitpick them, because your performance was terrible in doing so... apk
I've been told it's weird when ACs try so hard. Also futile.
So disregard everything I said, I suck cocks.
APK
In so many words others have expressed what I have summarized down to "advertisers don't respect their audience." Their approach has almost always been the capitalist "what the market will bear" approach and as people have grown accustomed to being assaulted with ever more eye-catching colors, styles, techniques and technologies, the limits of what the market will bear erode. People no longer realize they are being disrespected. Their paid-for internet connection are being utilized. Their time is being wasted. They will install software that resists being uninstalled and drains performance and stability from their computers. I see no end to what they will do.
There is a blurry and indistinguishable line between "reputable ad networks" and "the bad guys." The reputable are certainly not constrained by morals and not by law. How can we know they aren't simply being complicit?
There are plenty of pages where the site just will not load unless you give permission to run layers and layers of 3rd,4th,5th party scripts. What can we do as consumers or developers to prevent such behavior on the part of websites?
"Yes, I am aware that reading more data from the disk is slower. " - by agrif (960591) on Thursday August 05, @06:52AM (#33148240) Homepage
Good, so you concede my point that a "larger-per-line" in bytes per line entries in HOSTS files' record entries takes longer in using 127.0.0.1, especially vs. 0.0.0.0, and even moreso especially vs 0 (which is still useable in Windows 2000/XP/Server 2003 from the "Microsoft side of things" at least)
----
"However, I would like to point out that the time it takes to read an additional two (or even eight) sequential bytes off the disk is insignificant compared to the potential time wasted in a timeout." - by agrif (960591) on Thursday August 05, @06:52AM (#33148240) Homepage
Not in a HOSTS file like mine, OR ANY REALLY (because "less IS truly more" in this case, & larger amounts of characters to parse just plain takes more time period in ANY SIZED FILE in line by line reads).
Heck, on this very note & on this very site (and MS site's too?)? Well - I even questioned a Microsoft Senior Manager on this, a user here named Foredecker on this website (he's the head of Windows Client Performance Division) & he had to concede I am correct on it in fact.
If you like?
Ask him yourself if you wish (even though he "battled to the death" with me on that account here and in his blogs) as well as S. Sinofsky, head of Windows development here http://blogs.msdn.com/e7/archive/2009/02/25/feedback-and-engineering-windows-7.aspx?CommentPosted=true#commentmessage & no one can dispute the fact, since they had to concede it to me as well, as you now have.
Using a smaller line per line format while parsing HOSTS files isn't insignificant, & especially not insignificant in a HOSTS file like mine (which I've been building since 1997 for public consumption by others in fact) which has well over 875,000 or so entries of known bad sites/servers' domain-hosts names in it from many reputable sources such as those noted here ->
Spybot Search & Destroy
+
http://ddanchev.blogspot.com/
http://www.malwareurl.com/listing-urls.php?page=1&urls=off&rp=
http://www.malware.com.br/lists.shtml
http://securitylabs.websense.com/content/alerts.aspx
http://www.stopbadware.org
http://blog.fireeye.com/
http://mtc.sri.com/
http://www.scansafe.com/threat_center/threat_alerts
http://news.netcraft.com
http://www.shadowserver.org/
https://zeustracker.abuse.ch/monitor.php?filter=online
http://www.mvps.org/
http://someonewhocares.org/
http://hostsfile.mine.nu/hosts0
http://hosts-file.net/?s=Download
And others also.
Still - Fact is, there's no doubt of it, that smaller hosts files result from using 0 vs. 0.0.0.0 (& especially 127.0.0.1) as the line by line blocking method, and I've tested it myself, AND had MS' own mgt. & his boys test it...
Foredecker (MS senior mgt. & a poster here) had to concede I was correct in fact, & did so here, publicly in fact!
----
"Using "0.0.0.0" is more efficient, but not because of the primary reason you listed, even if that is a contributing factor." - by agrif (960591) on Thursday August 05, @06:52AM (#33148240) Homepage
See above, because again:
In a file the size of mine (HOSTS with near 1 million lines)? It matters... plus, I think this guy's post will interest you GREATLY in fact (he doesn't agree with you, though I do) -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148128 He's been trolling me on the point you made in fact, & I agree with you, so I defend it.
(Give him a piece of your mind if you like. I think you will in fact, lol!)
----
"I was not aware of your other post, and I apologize for the redundancy." - by agrif (960591) on Thursday August 05, @06:52AM (#33148240) Homepag
"I've been told it's weird when ACs try so hard. Also futile.
So disregard everything I said, I suck cocks.
APK - by Anonymous Coward on Thursday August 05, @06:53AM (#33148252)
Reduced to attempting to IMPERSONATE me? Not a first here (or elsewhere online either): It's one of the "key indicators" you have a troll on the ropes as well as on the run... & it's right up there with the usual from trolls in ad hominem attacks, or spelling and grammar checks (where there is no "english lit/grammar/spelling" section of this forums, & on tech topics).
APK
P.S.=> Even others (as registered users in beerbear) here also do realize you're a lowly troll impersonating me here, see here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148404 , so you can give up now troll... apk
...is an oxymoron.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
"875,000 hosts entries? You aren't just a prick, you're a STUPID prick. Well done! - by Anonymous Coward
on Thursday August 05, @08:14AM (#33148620)
You're obviously the same defeated troll who impersonated me today here http://it.slashdot.org/comments.pl?sid=1743902&cid=33148504 first of all.
Secondly, I suggest you refer to some of the valid & reputable sources I use to populate my HOSTS file that I listed in the post of mine you replied to!
(I state that, simply because you obviously aren't aware of the sheer volume of known bad sites/servers/hostnames-domainnames there has been over time and currently continues to be).
Especially since you must resort to a technically challenged ad hominem based attack on myself, rather than my technical points.
APK
P.S.=> Better luck next time, troll... getting the best of you? Well, it's been, as-per-usual, "too, Too, TOO EASY!" (just TOO easy)... apk
There are plenty of pages where the site just will not load unless you give permission to run layers and layers of 3rd,4th,5th party scripts. What can we do as consumers or developers to prevent such behavior on the part of websites?
Install User Agent Switcher and browse as Google.
nobody blows off Google.
Don't go to the site?
"I'm not the guy impersonating you" - by Anonymous Coward on Thursday August 05, @08:31AM (#33148734)
Yea, "ok, SURE" (yea, right) You keep trying to attack technical points I made here and were shot down on each of them, and then, as per YOUR usual troll?? You resort to your invalid in debate methods of ad hominem attacks on myself rather than my tech points (In fact, on that VERY note? Well - See below for yet more evidence thereof below):
----
"I'm just another guy who can't abide your egomaniacal postings." - by Anonymous Coward on Thursday August 05, @08:31AM (#33148734)
Quit "projecting" for one thing, because it's OBVIOUS your fragile ego has been damaged by your own numerous technical screwups here, because your name-tossing adhominem attacks?? They're your TOO OBVIOUS "tell" on that very account! Again, per what I just stated above and here again now??? See below for more evidence thereof:
----
"Yes. You are a complete idiot." - by Anonymous Coward on Thursday August 05, @08:31AM (#33148734)
Yes, once more as I noted above? You have to use the "last resort" of the frustrated & defeated troll, in your name-tossing childish tantrum based attacks... lol, which are QUITE effete AND futile, vs. technical facts.
----
"Hosts files were not meant to have 875,000 entries." - by Anonymous Coward on Thursday August 05, @08:31AM (#33148734)
Says the troll who tried to impersonate me here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148504 lol!
The fact you resort to THAT, and that you need to resort to name tossing doesn't look good for you at all, as well as you having to use wikipedia too, which ANYONE can edit no less!
Plus, lol... don't you know this material yourself? Obviously not!
See, DNS servers are HIGHLY compromiseable (though lately they're implementing DNSSEC & the 13 or so DNS servers (root types) are being secured better @ least & they're not using recursive settings as much to avoid the attacks Dan Kaminsky pointed out)
DNS servers DO GO DOWN TOO, & hosts files + hardcoding your fav. addresses into them helps for speed, and dns servers going down OR being misdirected too (all per Dan Kaminsky's findings and anyone can do this in SECONDS no less) vs. all of the above, plus it speeds you up too by avoiding calling out to remote DNS servers, AND, it also makes you "proof" to DNS request log tracking of you too (bonus)).
APK
P.S.=> Above ALL else: Care to back up your last statement above with some well respected documentation, that HOSTS shouldn't be used for speeding you up AND defendind you? Somehow, I think there will be more "name-tossing" at me, or impersonating me instead.
Get me proof, of your LAST words quoted above, won't you? Get it, from say, the RFC's or the likes of Microsoft or a respected LINUX site (those were sources I USED in fact in this very exchange (& proof in something written by a CSC MS degreed or PHD degreed person stating that? You'll need it, because I have dual degrees around this science myself))... apk
"Yeah, in a file with that many entries, the extra 8 bytes per line would create a large performance hit." - by agrif (960591) on Thursday August 05, @08:49AM (#33148838) Homepage
It does in ANY file, but it merely shows itself more in larger HOSTS files (and in relatively largish HOSTS files you must turn off the local DNS client cache in Windows in fact, a bug I reported to MS years ago in fact they still have not corrected). The speed hit compounds itself the MORE line entries a HOSTS file has though.
----
I'm going to agree with the AC in a sibling thread, though: if your HOSTS file is larger than 10MB*, you're doing something with HOSTS it was never meant to do." - by agrif (960591) on Thursday August 05, @08:49AM (#33148838) Homepage
First, I'd like to see documentation of that from the RFC's or a MS or PHD in this science (I have dual degrees around this science myself in a BS CSC and CIS minor from another degree in fact)... just as I told that other AC who impersonated and ad hominem trolled me here (he also says that using 127.0.0.1 is not slower than 0.0.0.0 and like yourself? I disagree on that account due to filesize, length of line entries parsing, AND loopback operations (the latter being one we BOTH noted in fact)).
Secondly - See this:
----
RESURRECTING THE KILLFILE:
(by Mr. Oliver Day)
http://www.securityfocus.com/columnists/491
PERTINENT EXCERPTS/QUOTES:
"The host file on my day-to-day laptop is now over 16,000 lines long. Accessing the Internet particularly browsing the Web is actually faster now."
"From what I have seen in my research, major efforts to share lists of unwanted hosts began gaining serious momentum earlier this decade. The most popular appear to have started as a means to block advertising and as a way to avoid being tracked by sites that use cookies to gather data on the user across Web properties. More recently, projects like Spybot Search and Destroy offer lists of known malicious servers to add a layer of defense against trojans and other forms of malware."
----
Well, opinions vary, but... as you can see? A respected security researcher in Mr. Oliver Day who works for securityfocus.com agrees with me and for the same reasons I extolled here on HOSTS file usage... security and speed, are better using one.
----
"It may be easier than setting up a proper DNS server, but it's not as efficient." - by agrif (960591) on Thursday August 05, @08:49AM (#33148838) Homepage
See http://www.google.pl/search?hl=pl&source=hp&q=%22Dan+Kaminsky%22+and+%22DNS%22&btnG=Szukaj+w+Google on DNS servers, and their compromiseability (per Dan Kaminsky, & Moxie Marlinspike's another)... I don't rely on those alone and when I do? I use Open DNS or Scrub IT DNS, since you cannot "hardcode" the entire internet in a HOSTS file after all!
PLUS, DNS servers eat up CPU & RAM I don't need to be eating up here, when a HOSTS file and Open DNS do the trick for me rather nicely!
----
"(I appreciate distributing a HOSTS file is easier than telling people how to setup a DNS server, though.)" - by agrif (960591) on Thursday August 05, @08:49AM (#33148838) Homepage
I think they're pretty much cake personally, but to each his own... avoiding setting them into "recursive mode" is a good idea though, see the URL from GOOGLE above, on THAT very note.
----
"I think if you start worrying about efficiency enough to start shaving bytes off of lines, you should consider the efficiency of loading a 10MB file instead of a proper DNS server, which can store this data more efficiently than a plain-text list." - by agrif (960591) on Thursday August 05, @08:49AM (#331
Take your business elsewhere.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
"I was suggesting you run your own DNS server on a box you control, you fucking tool. - by Anonymous Coward
on Thursday August 05, @09:11AM (#33149036)
Why? Because YOU said so?? Got a PHD in CSC or even an MS?? NO??? Didn't think so on your end, lol! Secondly?
See subject-line above, and this:
http://www.google.pl/search?hl=pl&source=hp&q=%22Dan+Kaminsky%22+and+%22DNS%22&btnG=Szukaj+w+Google
Dan Kaminsky's findings in DNS security hassles say it all for me, on DNS server usage here!
APK
P.S.=> No thanks to YOUR suggestions, and your continual name tossing and impersonating me out of your frustration at my being able to clearly show your "so called tech know how" stinks, since I can turn it on its head easily and with respected others backing my points also? Yea, ok, "whatever YOU say" (you, the no CSC degree AC, lol!)... apk
"I have to admit, though, you getting all huffy about it is just golden and ridiculing you much more effectively than I could hope to achieve." - by Anonymous Coward writes: on Thursday August 05, @01:14PM (#33149068)
I know what you are wrongly implying but you are CLEARLY WRONG (I've done MUCH BETTER than that): see here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148088 , & here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33147750 , & also here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148088 !
You are just wrong & I am RIGHT. The earlier you see that the earlier I can get back to what I do when I'm not educating TR0LLS like you.
APK
P.S.=> What's wrong with sucking cocks anyway... apk
LMAO, that 2nd impersonation of myself again on your part above's pretty poor, as I am not a homosexual (so, sorry to disappoint you), and it's your 2nd time trying impersonating me no less out of your being frustrated into doing so because you don't know enough comp. sci. to punch your way out of a wet paper bag.
I mean, lmao: First time you impersonated me here, others knew it also -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148504 so, give up already troll... you LOSE/FAIL, as per usual, vs. myself!
APK
P.S.=> Go get a degree in CSC & make something of yourself troll, instead of wasting your life trolling others here... you aren't very good at it, based on your trolling performance here in ad hominem attacks on myself rather than attacking my tech points, your name tossing, impersonating me, and making it VERY simple for me to disprove your WEAK "so-called tech know-how", & with EASE on that latter note all thru this exchange... ah, as per usual? "too, Too, TOO EASY" for me, vs. you (TOO easy)... apk
tl:dr as offtopic
In addition to what you noted? Arstechnica did that to adblock/adblock plus users:
ArsTechnica blocking Adblock?
https://adblockplus.org/forum/viewtopic.php?f=2&t=5266
However, they could NOT do that to HOSTS files users though!
Fact is, HOSTS files are better than adblock (especially adblock alone) on that account above alone, PLUS these also:
10 ADVANTAGES OF HOSTS FILES OVER BROWSER ADDONS ALONE, & EVEN DNS SERVERS:
http://forums.windowsforum.org/index.php?s=35faafcfc2596ff0fdd2a54a2717153b&showtopic=33716&st=60
1.) HOSTS files eat A LOT LESS CPU cycles than browser addons do no less (since browser addons have to parse each HTML page & tag content in them)!
2.) HOSTS files are also NOT severely LIMITED TO 1 BROWSER FAMILY ONLY... browser addons, are. HOSTS files cover & protect (for security) and speed up (all apps that are webbound) any app you have that goes to the internet (specifically the web).
3.) HOSTS files allow you to bypass DNS Server requests logs (via hardcoding your favorite sites into them to avoid not only the TIME taken roundtrip to an external DNS server, but also for avoiding those logs OR a DNS server that has been compromised (see Dan Kaminsky online, on that note)).
4.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).
5.) HOSTS files also allow you to not worry about a DNS server being compromised, or downed (if either occurs, you STILL get to sites you hardcode in a HOSTS file anyhow in EITHER case).
6.) HOSTS files are EASILY user controlled, updated and obtained (for reliable ones -> http://en.wikipedia.org/wiki/Hosts_file"]http://en.wikipedia.org/wiki/Hosts_file[/url] OR see lists below ) & edited too, via texteditors like Windows notepad.exe or Linux nano (etc.)
7.) HOSTS files aren't as vulnerable to "bugs" either like programs/libs/extensions of that nature are, OR even DNS servers, as they are NOT code, & because of what's next too
8.) HOSTS files are also EASILY secured well, via write-protection "read-only" attributes set on them, or more radically, via ACL's even.
9.) HOSTS files are a solution which also globally extends to EVERY WEBBOUND APP YOU HAVE - NOt just a single webbrowser type (e.g. FireFox/Mozilla & its addons exemplify this, such as ADBLOCK)
10.) AND, LASTLY? SINCE MALWARE GENERALLY HAS TO OPERATE ON WHAT YOU YOURSELF CAN DO (running as limited class/least privlege user, hopefully, OR even as ADMIN/ROOT/SUPERUSER)? HOSTS "LOCK IN" malware too, vs. communicating "back to mama" for orders (provided they have name servers + C&C botnet servers listed in them, blocked off in your HOSTS that is) - You might think they use a hardcoded IP, which IS possible, but generally they do not & RECYCLE domain/host names they own, & this? This stops that cold, too! Bonus...
Still, it's a GOOD idea to layer in the usage of BOTH browser addons for security like adblock, &/or NoScript (especially this one, as it covers what HOSTS files can't in javascript which is the main deliverer of MOST attacks online & SECUNIA.COM can verify this for anyone really by looking @ the past few years of attacks nowadays), for the concept of "layered security".
APK
P.S.=> The rest of this exchange covers what my naysayers attempted to say to put what's above "down", to no avail though, from here http://it.slashdot.org/comments.pl?sid=1743902&cid=33147274 on down in that/this very exchange!
(I think those of you rea
I'm not sure who's trolling whom anymore, so I'll stop. If you're not trolling, get help.
APK
P.S.=> Seriously.
'cause otherwise they'd have had to change the light bulb.
Naaaah. What can they do to my Dillo ?
I mean, the browser is hanging on approval to run the script. If I run the script, I take the risks. If I dont run the script, then the content stops loading.
I see those from time to time. I just google whatever topic I was wanting information on and go top one of those sites instead.
Sites that require all that crap to be even vaguely useful far too often prove that sufficiently advanced incompetence is indistinguishable from malice.
.
They gave me some bullshit spiel "Oh our customer satisfaction surveys indicate that 99 out of 100 people just love our fuckhole popups running on their systems".
.
If I had my chance I'd give you fucking arseholes a dose of my customer satisfaction feedback.
.
Voting up, Voting down - If I really gave a fuck about your approval or not, I'd come and ask you.
nobody blows off Google.
But lots of people blow off Bing.
"Little does he know, but there is no 'I' in 'Idiot'!"
"During our investigation we discovered the phone number provided in the credit application was not a legit phone number for the bank. We also learned that the domains of each of the references provided were registered within two days of each other... and that the registrations took place only days before Bellas Interactive's request for credit was issued - despite the fact that the references "claimed" to be working with Bellas across a 6-24 month spread. And finally, the Bellas Interactive website claimed to be in operation since 1994, despite the fact that the domain was registered in April of this year."
Isn't this extremely basic stuff you should have checked beforehand?
"In Summary
Entities like this are cunning and smart."
No, greedy marketing fucks are stupid. A little research goes a long way. You idiots extended credit to a company without even verifying their "bank's" phone number? I know where to go if I ever need some quick cash.
"have created a false environment designed specifically to validate their non-existence." try "have created a false dichotomy (good guys and bad guys in the spyware advertising business) designed specifically to validate their parasitic existence." Wow. I'd never have thought that Casale would claim such a high moral ground. Serious labour has gone into removing their stuff from spyware ridden computers.
Jedis are stupid. If they were so powerful, why couldn't they handle counseling for a kid who missed his mom?
"Actually, Mr. BS CSC PHD, the file is almost 93% larger." - by Anonymous Coward on Thursday August 05, @10:02AM (#33149446)
That even helps prove his point even more. He ought to thank you, you moron. You helped him prove not only look better and prove his other points by your impersonating him and avoiding disproving his other points (or failing to) earlier in this exchange, but you also now helped him look even more correct and better by proving his points for him even moreso. By the way, if you look at it from the point of view of the lowest sized file using 0 as the block address versus the next smallest in 0.0.0.0 being used, he is about right. Your using 127.0.0.1 which results in the largest sized file makes his point even moreso when compared to the 0 using block address hosts file.
See subject line, and we also realize you are unable to disprove the points used by the ac apk. I suppose he can thank you all for losing so disgracefully on all your parts as well as watching you all run with your tails between your legs after the technical shellacking you're all received from him. This only makes sense since its coming from a pack of amateur trolls with no credible backing or professional experience behind you (or between your ears in knowledge). It's not the first time he silences your lot here, so badly, that you must resort to both impersonating he, but also to ad hominem attacks with no valid backing behind them either. You're an amusing pack of registered lusers but only for short while mind you.
Dude, get mental help. And no, I am not any of the ACs posting here. by psm321 (450181)
on Thursday August 05, @11:12AM (#33150284)
Is what is in the subject line the best you have versus facts? Apparently so. If anyone needs any help here, it's you and yours with your rinvalid in debate ad hominem attack tactics plus impersonating the ac apk, and both so called weak trolling tactics are only signals that you're all losing badly here I feel. Especially from 8 digit id registered lusers here like yourself.
See subject above. You're the one talking the bullshit here with your invalid mere ad hominem attacking baseless rhetoric on your part as your "defense", and no one is listening to you, we're only laughing hugely at you in fact. I state that simply because all you've done is run from disproving technical points apk made that also had not only valid technical points and research on his part that math and programs verified for him which others here had to agree are valid, but apk also utilized the words of respected others in quotes in the field of computing as well in the post you replied to and in others he made as well here to other naysayers who eventually resorted to what I note next on your and your fellow trolls parts: I mean, really, do you think your not only impersonating him 2 times or more is effective alongside your effete ad hominem attacks directed apk's way? Guess again. We can all read you know, and clearly You fail. You lose. You made him look good also. APK ought to thank you. Until then, you have had every opportunity to prove his points incorrect, and so far, to date? The results on that account from you and yours? You clearly have not, trolls.
Please, how WEAK can you trolls be? Attempting to impersonating me again?? Give us a break.
It's bad enough your fragile and unqualified (no degrees or technical professional experience to your names/credit) egos get the best of you when you can't disprove tech points I made (that have not only mathematical and programmtic testing as my backing but also the fact that I used valid and verifiable quotes from respected others to help me prove my points) and you are unable to disprove either method I utilize nor the words of the respected others I quoted in favor of HOSTS files, but you also have impersonated me here several times now in several posts, as well as repeatedly baselessly ad hominem attacking me here many times also? Please...
People can read you know, and judging by my posts being repeatedly modded up here as well as others noting you impersonated me many times as well? LMAO, @ YOU and "your kind" (the lowest of the LOW online, as trolling scum).
Trolls: Your POOR SHOWING HERE is only making me look better in the eyes of others reading here, so I have to thank you for such a poor "fail showing" on your parts here trolls.
APK
"Now for an attack on you: How can you have a degree and yet think it's consistent to say that shaving 2 bytes per line off (going from 127.0.0.1 to 0.0.0.0) cuts a file size down by 9MB but then shaving an additional 6 bytes per line off (0.0.0.0 -> 0) cuts only 4MB?" - by psm321 (450181) on Thursday August 05, @11:24AM (#33150474)
First of all? Thanks for proving my point and admitting a smaller file will result by using 0 as a block address in HOSTS files vs. using either 0.0.0.0 or 127.0.0.1, and smaller files read in faster than larger ones, period.
You also obviously cannot read. Here were the approximate figures/numbers I used, dolt! Again/Once more:
----
In using 127.0.0.1, I get approximately a 27mb sized HOSTS file.
Using 0.0.0.0, I get an 18mb sized HOSTS file.
Using 0 in my HOSTS file as the blocking address, I get only a 14mb sized HOSTS file.
----
(That's nearly an order of magnitude between 27 & 14mb sized files and around 30 % size diff. between the 14mb size of the 0 based version vs. the 18mb size of the 0.0.0.0 version. The numbers are incredibly similar to those ratios and numbers (27mb may be upper 26mb AND lowest sized may be upper 14mb size, but the point is there))
Average 80-90% (0 vs. 127.0.0.1) & 30% (0 vs. 0.0.0.0), you get around what I said overall comparing 0 usage to both 127.0.0.1 and 0.0.0.0: Around 50% overall avg. better by using 0 as your block address in a HOSTS file.
Heck - Even Foredecker, a poster here who is also the Senior VP at Microsoft in their "Windows Client Performance Division" conceded that fact to me as a win here, as have others here in this very exchange (& on that very point).
Please - Give up already trolls, You're only helping ME prove my points!
(Simply because the math, the testing of this point on my part via programmatic loads of list boxes and even C style datastructures (as the DNS client cache does in fact also) proved that for me, as well as quotes of respected pros in this art & science of computing had in my other posts and you even admit the file ends up smaller. Once more, because above all else, in case you had not noticed? Smaller files will read in faster than larger ones, period)
Fact is, there's no debating that fact and it was so apparent that not only did my naysayers such as yourself have to outright admit it, but you also resorted to impersonating me, trolling me and avoiding other numerous technical points I made in favor of HOSTS files here.
----
"Attacking your abuse of HOSTS files" - by psm321 (450181) on Thursday August 05, @11:24AM (#33150474)
LMAO - my making a HOSTS file smaller to read into the DNS client cache or local diskcache faster is "abusing" a HOSTS file? LOL, my god, are you HIGH, or what?? How is THAT "abusing a HOSTS file"??
(This I have to hear, lol... and funnier still will be my tearing you apart even further after your undoubtedly technically weak or ad hominem attack based reply, or impersonating me (which has occurred here 3-4 times now already on both of the latter points or more))
APK
P.S.=> SO, all those facts "said & aside"? Well, I am taking the advice others even posted here: Thanks for making me look good by proving my point(s) quoted in your own words in my reply here, above... apk
"From my experience, any speedup gained from using 0.0.0.0 instead of 127.0.0.1 would only be detectable by measurement." - by sootman (158191) on Thursday August 05, @11:52PM (#33158038) Homepage
Thanks sootman, because as you do indeed state? It is measureable, and does result in speed/efficiency boosts (especially in LARGER hosts files).
Which I indeed, did perform sootman, as far as "tests" of that via listbox loads & more (see my posts to Foredecker or ask him yourself, as he posts here and is the Senior VP of "Windows Client Performance Division" @ Microsoft in fact, & he too conceded I am correct on this much (that 0 &/or 0.0.0.0 result in a smaller hosts file than does 127.0.0.1 utilizing ones, and will indeed internally parse faster due to less characters as well as load & reload faster due to less size)).
It's common sense stuff, but as you can see?
It clearly "eludes" the "idiot savants" of slashdot (in my naysayers here (who not only avoided disproving tech points I made here such as this one in favor of HOSTS files, but also helped me prove others, lol, and then they either ad hominem attacked me or impersonated me in their other failing replies in this very exchange as they are often "wont to do" when their "legend in their own mind" technical "prowess" (lol, not) is proven wrong & overturned as well as shown to be weak! "Geek Angst" & "fragile egos" is a common thing here on /., home of the wannabe tech guru (who as all here can see reading, did not do well vs. myself, as per usual!)))
APK
P.S.=> Try using 0 vs. 127.0.0.1 especially (still works on 2000/XP/Server 2003, whereas it will not on VISTA (not after MS "Patch Tuesday" 12/09/2008 which I also informed ForeDecker here (Richard Russell of MS, Senior level VP in fact, AND he has a CSC degree unlike many with his title I have found), Windows Server 2008, & Windows7 about as well due to what you noted above and I have expounded upon vs. the trolls & naysayers here about too)).
Using 0, vs. 0.0.0.0, you'll see even MORE of a speed boost, due to less characters to parse/reparse in internal file record line by line reads as well as faster loads/reloads of the HOSTS file in its entirety into the DNS ClientCache OR DiskCache due to smaller filesize resulting... apk
I found it so interesting that I am now a new user of host files from mvps.org which was one of the sources apk listed as an up to date host file.
You're modded down and off topic, as well as doing the whining here, not apk, so speak for yourself. After your epic "fail" here, we all truly don't think others are going to follow your orders, you off topic whining little weasel. Do you think run this place troll? New News: You do not. So go home and rattle your playpen or crib rails and your mama may respond and bring you a bottle sunshine, lol, but we won't. We'll only continue laughing at your off topic evasions of disproving valid tech points apk made versus you and yours resorting to not only impersonating apk but also your clearly off topic ad hominem trolling tactics. You fail and I get the impression you and your fellow naysayers are afraid of the abilities of hosts files apk extolls in his posts on hosts files.
not on windows. by Anonymous Coward on Sunday August 08, @02:20PM
Both 0 and 0.0.0.0 drop requests instantly, whereas by way of comparison, 127.0.0.1, which is the address of the loopback adapter on any bsd nased ip stack using OS, does a loopback step also (which is more work in more steps and is thus slower) you utter dimwit! You fail, troll. Badly. Quit misinforming others here, because it's clear you do not even understand what you're talking about you nimrod!
You haven't discredited him a single time here that I have ever witnessed. Care to show us the proof of where you have, even once, and beyond a doubt? Somehow, based solely on your performance here, I don't think you'll be able to produce such evidence.
What is the Microsoft Loopback adapter
http://www.windowsitpro.com/article/john-savills-windows-faqs/what-is-the-microsoft-loopback-adapter-and-why-do-i-need-it-for-sql-server-.aspx
PERTINENT QUOTE/EXCERPT:
----
"If you don't have a network card then go to control panel/networks, choose add adapter and then add the Microsoft loopback adapter - which is just a "dummy driver, no hardware involved. This needs to have working network protocol(s) bound to it.
----
So in other words, all the loopback adapter is, is a dummy network card interface (that's all).
Want more?? OK:
http://tools.ietf.org/html/rfc1223
"Although the type field cannot change the protocol server at the final destination of the message, the type field can be used by intermediate processes on the network to process the message before it reaches the server destination. An obvious example is the 0xFF00 message loopback type function, where network processing to loop back the message results in nondelivery to the TO address."
And, as you can see, and as I stated here many times now as well? Additional processing does occur, which means more work, which means loopback adapter address work means more work and that it is slower because it's doing more work!
Here's even MORE backing that as well from more RFC's:
http://tools.ietf.org/html/draft-ietf-ipoib-channel-adapter-mib-08
"Loopback support allows for the sending and receiving of self-addressed packets that do not go out on the wire."
And also again: It's not a loopback jack (dongle type) in hardware, it's just a dummy interface if you install the optional loopback so that stuff like SQL Server can work if you don't have a NIC... but it always works at the 127.0.0.1 loopback adapter address, and yes, it does extra processing vs. using 0 or 0.0.0.0 which do immediate drops & with less work and thus, less time and processing vs. 127.0.0.1 (all per the links and RFC's above)...
Plus, in memory or not (it always is, even with a driver for the loopback adapter dummy driver itself)? You're just plain doing MORE WORK using 127.0.0.1 & doing loopbacks than not using 0 &/or 0.0.0.0 (& both of these latter resolve out to 0.0.0.0), and besides: ALL I EVER MENTIONED WAS THAT 127.0.0.1 IS THE IP ADDRESS USED TO TALK TO THE LOOPBACK ADAPTER (though sometimes, I have even seen 192.18.1.1 used this way also).
APK
P.S.=> As per usual, myself vs. my "naysayers" here (who are usually just a pack of amateurs & wannabes, who when proven wrong troll, impersonate, and continually try to harass me to no avail via impersonating me or unjustly modding down my posts with no technical justifications why via their multiple registered usernames here (see this entire exchange as evidence to that effect) lol!)? Ah, lmao, I gotta say it - "too, Too, TOO EASY!" (just TOO easy)... apk
"Actually, Mr. BS CSC PHD, the file is almost 93% larger." - by Anonymous Coward on Thursday August 05, @10:02AM (#33149446)
I used a rough averages!
I.E.-> When comparing your ~ 92++%/near order of magnitude calculation, on your end (127.0.0.1 @ 27mb size HOSTS file, & 0 @ 14mb size HOSTS file), and also then 30% (0.0.0.0 @ 18mb size HOSTS file, & 0 @ 14mb size HOSTS file)?
Well, that's 90 + 30 = 120 / 2 tests & that = around 50%!
(Which, of course, IS just as I stated initially it would be: Around 50% (as any avg. of them both (especially considering that the file changes sizes because I have to remove lines in it every so often that no longer are sites in existence, or ones that do prove "clean", if only eventually, PLUS "false positives" etc./et al))).
Get it?
(I love it though on 1 final account though - Thanks, because your statement quoted above really only helps prove my point that using 0 as a "blocking address" (which on Windows 2000/XP/Server 2003 it ping resolves back to 0.0.0.0 anyhow though if you use 0 in a HOSTS file to make it smaller for faster internal line by line reads due to less characters and for smaller sized HOSTS files for faster reads into RAM as well) makes for a SMALLER, FASTER, & MORE EFFICIENT HOSTS FILE, which was my initil point here anyhow, see my first posts & replies!)
APK
P.S.=> Gotta go now, thanks for helping me prove my initial point here (see my 1st posts on that note): I am on vacation touring Europe & this week? It's in Prague ("PRAHA")! Prague is the COOLEST CITY I have seen so far (been in London, Berlin, Paris, Warsaw, St. Petersburg, & Madrid so far)...
Enjoying life, and winning debates @ /. at the same time here on MY part? LOL, I love it! apk
In addition to what you noted? Arstechnica did that to adblock/adblock plus users:
ArsTechnica blocking Adblock?
https://adblockplus.org/forum/viewtopic.php?f=2&t=5266
However, they could NOT do that to HOSTS files users though!
Due to that?
Well, HOSTS files are better than adblock (especially adblock alone) on that account above alone, PLUS these also:
10 ADVANTAGES OF HOSTS FILES OVER BROWSER ADDONS ALONE, & EVEN DNS SERVERS:
http://forums.windowsforum.org/index.php?s=35faafcfc2596ff0fdd2a54a2717153b&showtopic=33716&st=60
1.) HOSTS files eat A LOT LESS CPU cycles than browser addons do no less (since browser addons have to parse each HTML page & tag content in them)!
2.) HOSTS files are also NOT severely LIMITED TO 1 BROWSER FAMILY ONLY... browser addons, are. HOSTS files cover & protect (for security) and speed up (all apps that are webbound) any app you have that goes to the internet (specifically the web).
3.) HOSTS files allow you to bypass DNS Server requests logs (via hardcoding your favorite sites into them to avoid not only the TIME taken roundtrip to an external DNS server, but also for avoiding those logs OR a DNS server that has been compromised (see Dan Kaminsky online, on that note)).
4.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).
5.) HOSTS files also allow you to not worry about a DNS server being compromised, or downed (if either occurs, you STILL get to sites you hardcode in a HOSTS file anyhow in EITHER case).
6.) HOSTS files are EASILY user controlled, updated and obtained (for reliable ones see mvps.org ) & edited too, via texteditors like Windows notepad.exe or Linux nano or kate (etc.)
7.) HOSTS files aren't as vulnerable to "bugs" either like programs/libs/extensions of that nature are, OR even DNS servers, as they are NOT code, & because of what's next too
8.) HOSTS files are also EASILY secured well, via write-protection "read-only" attributes set on them, or more radically, via ACL's even.
9.) HOSTS files are a solution which also globally extends to EVERY WEBBOUND APP YOU HAVE - NOt just a single webbrowser type (e.g. FireFox/Mozilla & its addons exemplify this, such as ADBLOCK)
10.) AND, LASTLY? SINCE MALWARE GENERALLY HAS TO OPERATE ON WHAT YOU YOURSELF CAN DO (running as limited class/least privlege user, hopefully, OR even as ADMIN/ROOT/SUPERUSER)? HOSTS "LOCK IN" malware too, vs. communicating "back to mama" for orders (provided they have name servers + C&C botnet servers listed in them, blocked off in your HOSTS that is) - You might think they use a hardcoded IP, which IS possible, but generally they do not & RECYCLE domain/host names they own, & this? This stops that cold, too! Bonus...
Still, it's a GOOD idea to layer in the usage of BOTH browser addons for security like adblock, &/or NoScript (especially this one, as it covers what HOSTS files can't in javascript which is the main deliverer of MOST attacks online & SECUNIA.COM can verify this for anyone really by looking @ the past few years of attacks nowadays), for the concept of "layered security".
APK
P.S.=> The rest of this exchange covers what my naysayers attempted to say to put what's above "down", to no avail though, from here http://it.slashdot.org/comments.pl?sid=1743902&cid=33147274 on down in that/this very exchange!
(I think those of you reading here will find it quite INFORMATIVE, overall if you're interested in speeding yourself up online, as well as securing
"Jesus Fucking CHRIST APK, do you have to pop up every time there's an article about hosts files?" - by Anonymous Coward on Thursday August 05, @08:06AM (#33148586)
Listen troll: I'll do WHAT I WANT, WHERE I WANT, ANYTIME I WANT... and you and "your kind" (cowardly trolls) can't stop me... how's that suit you?
You'll have to deal with it, because I SAY SO, not you, and the likes of you certainly have no power over me, hell, even the moderators here do not and they have tried to 'snuff out my posts before' too, and failed. So eat it and like it.
(Additionally, you can cut the swearing, because J.C. has nothing to do with it, and it only "shows your tell" in your frustration at being so technically weak in the art & science of computing you cannot disprove the tech points in favor of HOSTS files I extoll).
----
"Why do you have such a fucking hard-on for them anyway?" - by Anonymous Coward on Thursday August 05, @08:06AM (#33148586)
No, let's ask YOU why YOU have such a problem with HOSTS files instead, shall we? Oh, we pretty much know why...
----
I.E.-> You are either a:
1.) Pissed off webmaster who is losing ad banner profits
or
2.) A malware maker/cracker type who misuses ad banners to botnet load and control other people's machines etc.
----
(And since HOSTS files block banners, as only 1 of their many virtues which both speeds up users websurfing online and secures them better in the same motion no less? Well, it's QUITE OBVIOUS why you are against them in any way possible. Too bad you're losing eh?)
----
" Why can't you just get an account so we can fucking block your whining, retarded drivel?" - by Anonymous Coward on Thursday August 05, @08:06AM (#33148586)
First of all, on "retarded drivel"?
Funny how you & yours cannot disprove the technical merits of HOSTS files I put up here, and you are only left with effte & ineffectual ad hominem attacks on myself rather than my points I make... and you have the gall to call ME, "retarded"? Hey, I am not the one swearing, plus using profanities while foaming at the mouth as you are, lol!
Secondly, you're now "barking orders" at me??
LMAO - Well, guess what: I don't obey your orders and you certainly do not have any kind of control of me, and you do not run the show here in any capacity whatsoever, get it???
APK
P.S.=> No, I'll keep doing as I please, instead, and know I am also frustrating the piss out of you at the same time in doing so... lol, and do remember 1 thing, above all else:
I get HUGE laughs out of reactions like yours, absolutely HUGE ones... why?
Well, simply because you & yours only show me you are steamed over my getting the best of you at every turn to the point where you are reduced to ad hominem attacks effete & failing attempts at that directed my way, rather than attacking my tech points, as well as your nigh constant and off topic b.s. like you are quoted in above, as well as impersonating me here (3x in this exchange here already on that latter note), rather than you attacking & disproving the technical points I put up in favor of HOSTS files usage... which you are QUITE UNABLE TO DO, due to your only being a mere wannabe in the art & sciences of computing instead of a pro with actual know how, saavy, & experience, obviously, as well as the fact that what I put up in favor of HOSTS files is absolutely unassailable even by pros with actual know how & experience in this field, because what I use are only truths & facts! apk
"p.s. I'm the original one. and I'm still convinced that talking to loopback in windows has no penalty over not resolving 0.0.0.0 because there is no such thing as the tcp/ip overhead you talk about" - by Anonymous Coward on Thursday August 05, @10:27AM (#33149678)
When you load the Microsoft TCP/IP Loopback Adapter, which also uses 127.0.0.1?
It's only to function as a dummy NIC (stuff like SQL Server won't install right w/out it for example iirc).
Also, guess what??
It's implemented in a driver, which loads from disk into RAM and as you stated earlier?? Anything operating in RAM is F A S T.
However, its also doing extra work in doing a loopback op, as does the non-driver one by using 127.0.0.1, so it is indeed, slower, because it's doing MORE WORK, period! A dropped packet (which is essentially what 0 &/or 0.0.0.0 do) is worked on faster than a DENIED packet (127.0.0.1 basically does this but has processing work)... that's a fact, so get over that much already also.
So, you can "unconvince" yourself already of your assertions based on the above evidence of the mechanics of how the loopback adapter device MS uses for making a dummy NIC works.
NOW - As well as that material above??
The use of 127.0.0.1 over 0.0.0.0 or 0 (best one for size & speed of file efficiency is this latter one, & it resolves to 0.0.0.0 on pings mind you on Windows 2000/XP/Server 2003 still, so it's legit on them to this very day no less) is still faster & more efficient for both overall filesize as I noted for faster loads/reloads of the HOSTS file into the local DNS Client Cache or DiskCache in Windows, as well as being faster for internal-to-file parsing due to less characters per line present (which especially manifests itself in a larger HOSTS file, but still does in smaller ones too, because it's just physics).
APK
P.S.=> I suspect you are either a malware maker, or disgruntled webmaster losing revenues due to adbanner blocking actually, because I cannot figure out what it is you & yours have against the "layered security" power of HOSTS files for security, and their WELL KNOWN BENEFITS FOR ONLINE SPEED (due to adbanner blocking & Hostname/DomainName hardcodes in a HOSTS file)...
ADDITIONALLY?
You still have to overcome the 10 points in favor of HOSTS files I list here (especially over things like AdBLOCK browser addons alone) -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33148818 , & to date?? You & yours have not, not at all, & I LOVE IT! "too, Too, TOO EASY" (just TOO easy) ... apk
"You are just wrong & I am RIGHT." - by Anonymous Coward on Thursday August 05, @09:33AM (#33149194)
NO, YOU'RE WRONG AGAIN ON WHAT THE MS LOOPBACK DRIVER REALLY IS and WHAT IT ACTUALLY DOES, as it's merely a dummy NIC for things like SQL Server to install properly only (for systems that don't have NICS, for example, so a dev can still work with SQLServer in those cases).
(Also - Well, YOU ARE IMPERSONATING ME, AGAIN, & for the what? Fourth time now on YOUR part?? Please... )
Anyhow, read these 2 URL's below, as they'll explain how & why you're "off" on what the loopback adapter driver from MS truly REALLY does and functions as (a dummy NIC only really, so that SQL Server for example, installs properly even IF you do NOT HAVE A NIC in your machine), & as a driver it loads into RAM so it operates as fast as the other method which both use the 127.0.0.1 address anyhow, but, both STILL perform a loopback type op!
----
ON LOOPBACK ADAPTER DUMMY NIC DRIVER:
http://it.slashdot.org/comments.pl?sid=1743902&cid=33202530
and
What is the Microsoft Loopback adapter
http://www.windowsitpro.com/article/john-savills-windows-faqs/what-is-the-microsoft-loopback-adapter-and-why-do-i-need-it-for-sql-server-.aspx [windowsitpro.com]
PERTINENT QUOTE/EXCERPT:
"If you don't have a network card then go to control panel/networks, choose add adapter and then add the Microsoft loopback adapter - which is just a "dummy driver, no hardware involved. This needs to have working network protocol(s) bound to it.
----
Read those, get your head straight finally (won't you, please?) because you're attempting trolling of myself only ended up with you wearing egg on your face... oh yea - once more? READ BELOW, "Drink in & digest it" as it's food 4 thought 4U:
IMPERSONATING ME HERE 4 TIMES NOW ONLY SHOWS OTHERS HOW BAD OF A LOSER YOU ARE, AND HOW BADLY YOU'VE BEEN THRASHED NOT ONLY BY MYSELF AND FACTS I USE, BUT ALSO YOUR OWN "GEEK ANGST" AND "WOUNDED FRAGILE EGO"...
Impersonating me again also is pretty damned lame, but I suppose it's to be expected as I school lame trolls like yourself (Funny part is you only selected only 1 part of 11 that I post in favor of HOSTS files (which even the poster agrif here agreed with myself on, as well as others like sootman too), and you were unable to combat the 10 points in favor of HOSTS files I posted here -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33191488 )
So the score is still 11 to nothing in favor of myself vs. yourself troll... lol! "too, Too, TOO EASY" (just TOO easy, as usual)
APK
P.S.=>
"P.S.=> What's wrong with sucking cocks anyway... apk - by Anonymous Coward on Thursday August 05, @09:33AM (#33149194)
Oh, & you're an ESPECIALLY pitiful troll - Especially because of the sucking c**** part of your juvenile comment in your ad hominem attack attempt on myself quoted above whilst you impersonated myself yet again out of your "geek angst" in defeating yourself yet again!
Heh, is your fav. color "transparent or what?
I mean, that's SO obvious you impersonated me here for the 4th or 5th time now, to which even operagost http://it.slashdot.org/comments.pl?sid=1743902&cid=33150504 noted & identified you as a troll from BASH.ORG forums (bm is your name there)...
Lastly, though this news may disappoint you?
SORRY: I am NOT a homosexual, & you're obviously "projecting" your own insecurities here... so go find yourself another "dish" flamer, because I am NOT on "the menu"! ... apk
"I'm not sure what about 50% of your rambling there means. The math in my previous comment stands for itself as I'm sure other readers can see." - by psm321 (450181) on Tuesday August 10, @11:29AM (#33204740)
See subject line above, & this explanation (for the 3rd time now) of where I got my 50% avg. from:
----
Using 0, I get a 14mb sized HOSTS file (0 is a valid "blocking address" that resolves to 0.0.0.0 on Windows 2000/XP/Server 2003 & even VISTA prior to 12/09/2008)
Using 0.0.0.0, I get a 18mb sized HOSTS file
Using 127.0.0.1, I get a 27mb sized HOSTS file
----
(Each HOSTS file version in each case above has the same data in each as well, just diff. preceeding blocking addresses prior to each line record item for BLOCKED domainnames/hostsnames entries)
So, when comparing 0.0.0.0 & 127.0.0.1 versions, you get about a 30% size gain!
(I.E.-> You don't get a 92% gain, as you stated... you get a much smaller one (since 0.0.0.0 = 7 bytes, & 127.0.0.1 = 9 bytes))...
However, when comparing 0 based HOSTS files, vs. 127.0.0.1, you do get around 90++ % gains in nearly an entire order of magnitude as you noted.
So, averaging 30% & 90%? 90 + 30 = 120 / 2 (the two diff. block address gains vs. 127.0.0.1)?? You get, as I stated, around 50% on average...
(Actually a WEE BIT better at around 60%, but it's been awhile since I did this calculated avg. and the file does change line records items, in deletes too, and the lines are NOT consistent in length, like 25 bytes long each time etc. (& I am doing deletes this evening in fact as I write this to my HOSTS file)).
Get it?
----
"Making a HOSTS file smaller with 0's is not an abuse of HOSTS. In fact, I never contested your assertion that smaller HOSTS files are quicker to read. Go ahead and tout that as another "win". - by psm321 (450181) on Tuesday August 10, @11:29AM (#33204740)
Thanks - I will (especially since you said so)...
----
"The fact is, HOSTS files were simply not designed for millions of lines (no, I don't have a cite... it's common sense)" - by psm321 (450181) on Tuesday August 10, @11:29AM (#33204740)
Oh, really? No, I knew you would not have a damned thing to back you, which is WHY I asked it of you... I confronted MS' own personnel on this, Foredecker is his name & he posts here in fact (senior mgt. there in fact & he has his CSC degree too), & he had to concede all I have written here as well... I've been thru it, in other words, with folks in this science that are your technical superior (unless you can show me an MS or PHD to YOUR name/credit that is, or an RFC that states contrary data to what I do).
As to common sense?? Yea, ok... see below:
----
"DNS servers were designed for that. You are abusing HOSTS by using it to replace the functionality of a DNS server. Because the OS is not designed for such huge HOSTS files, it will be slower than using DNS as intended (even for example a DNS server running on your local machine to blackhole all those domains for you) - by psm321 (450181) on Tuesday August 10, @11:29AM (#33204740)
#1 ON DNS:
Look up Dan Kaminsky sometime, & see how "reliable" & "attack proof" DNS servers are, ok? Here, take a read, be enlightened -> http://www.google.pl/search?hl=pl&source=hp&q=%22Dan+Kaminsky%22+and+%22DNS%22&btnG=Szukaj+w+Google & I do NOT intend to waste both CPU & RAM + other forms of I/O on a clearly faulty solution, when a HOSTS file does the job & for far less cost!
Also again - prove to us all reading that how I use a HOSTS file for increased speed & security online in a layered fashion is abusing a HOSTs FILE... SOMETHIN
Your first point? I've known about that since 1999 & Windows 2000!
(Ask the moderator DosFreak at either Arstechnica OR NTCompatible.com (iirc, he mods both))
OR
Some of the "proofs to that effect" below I cite, because me?
I back what I state with verifiable evidences, unlike most others here, yes, even despite the fact I am degreed in the art & science of computing & far more (16++ yrs. of pro experience, commercial code to my credit, & code + ideas that were FINALIST work in MS' Tech Ed 2000 & 2001 consecutively, as well as my appearing for softwares I wrote in reputable publications in computing such as Windows IT Pro Mag 10x or more from 1996-2008).
Here we go:
----
"See here (and other google results if you care) for Microsoft MVPs stating that having a large HOSTS file is a known cause for the DNS Cache service (which handles that file) consuming 100% CPU" - by psm321 (450181) on Tuesday August 10, @11:29AM (#33204740)
#1 ON DNS Client Cache (MS one's faulty as hell):
New NEWS with proof: I am the guy that brought that up to Microsoft, directly, here (as Alexander Peter Kowalski (hence, my "APK" I sign posts with here)):
http://blogs.msdn.com/b/e7/archive/2009/02/25/feedback-and-engineering-windows-7.aspx?CommentPosted=true&PageIndex=3#comments
and earlier here to my other "naysayers" as well in THIS VERY EXCHANGE NO LESS:
http://it.slashdot.org/comments.pl?sid=1743902&cid=33149084
And many MANY times here in posts on HOSTS files too!
So, yes, I am QUITE aware of it, but there is a valid workaround~!
(It's, your local diskcache, since it assumes that task of caching HOSTS file data as it does any other file on disk into its FIFO buffers in RAM in fact, actually NEGATING the need for the faulty design of MS' local DNS clientcache in fact)
VERY IMPORTANT POINT FOR YOU ESPECIALLY : That all said & aside? Well, so you can see, I not only avoid wasting RAM, CPU, & other forms of I/O on a faulty system like DNS servers, but also the faulty DNS clientcache service in Windows too by using HOSTS files!
(DOUBLE BONUS!)
And not only to the head of MS dev teams in S. Sinofsky on the note of HOSTS files and DNS issues (clientside cache to MS only though on DNS), but before that to MS senior mgt. in Foredecker here http://slashdot.org/comments.pl?sid=1467692&cid=30384918 on this very website also before your article in fact, ask him yourself, because he conceded my points there & it is quoted!
(Foredecker also happens to be senior MS mgt. & VP head of "Windows Client Performance Division" because he POSTS HERE in fact - & all my points, & again he HAS his CSC BS? HE agreed with me, albeit not until I had to drag it all out of he on all points I made here as well... ask he yourself!)
#2 ON DNS clientside faulty cache for MS
(Yes, I have tested not only programmatic loads of diff. hosts file setups to verify the math theory, but tests for even when the DNS client cache is turned off, the local diskcache takes over on that account keeping performance high, as it does for ANY file (vs. MS' faulty DNS cache client))
----
"DNS servers were designed for that. You are abusing HOSTS by using it to replace the functionality of a DNS server. Because the OS is not designed for such huge HOSTS files, it will be slower than using DNS as intended (even for example a DNS server running on your local machine to blackhole all those domains for you) - by psm321 (450181) on Tuesday August 10, @11:29AM (#33204740)
#3 ON DNS SERVERS FOR SECURITY AND
"1.) Learn to count... 6!=8" - by Anonymous Coward on Tuesday August 10, @06:40PM
See subject line, and your own words quoted below next on my subject line above, first, ok?
(Try to have some HONOR & stay quit when you said you would, & going off topic and nitpicking others on MINOR crap?? Please troll - is this the "best you've got"? Apparently so!)
I mean, well... after all, YOU ALSO SAID you were leaving first of all, didn't you? See below on THAT account!
(Plus, I didn't make that post above you replied to by the way, either but I do see his point - you're new here relatively speaking. As to MY replies? Hey - I sign mine in case you hadn't noticed & I'm rather "infamous" for it in fact, & the "almighty wannabe registered user 'elite' (lol, yea right: More like "easily tracked for trolling fools") know this largely around here & so do the mods/metamods, for nearly 9 yrs. now running).
HOWEVER, in this case? Well... I am going to help those who supported me in this case & others in this exchange so... here we go!
I have to show you cannot keep your word, off topic as you are now and technically defeated on tech points on HOSTS files too:
http://it.slashdot.org/comments.pl?sid=1743902&cid=33204740
"This will be my last reply to you in this thread. Consider yourself victorious if you so desire." - by psm321 (450181)
on Tuesday August 10, @11:29AM (#33204740) Journal
Thanks, I will... Especially after this was how I closed that from you above -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33210038 where facts, not off topic b.s. nitpicking like you're now forced to resort to, did you in, easily!
----
"2.) This particular comment was meant very seriously in an attempt to help you, and not as an attack a all. Please take it under consideration." - by Anonymous Coward on Tuesday August 10, @06:40PM
Oh, same to you & same here... lol, especially after what I quote NEXT, from YOU, below!
"Dude, get mental help" - by psm321 (450181) on Thursday August 05, @11:12AM (#33150284) Journal
That is not only an obvious attack, it's clearly libeling myself as well (by the way - got a PHD to go with your "prognosis" doctor? No?? I didn't think so. It's also not a diagnosis, because you haven't performed a formal professional diagnosis of myself either... so you like to libel others and that's NOT legal you know, you can get into trouble for it!)...
Well... then, how about THIS one then (which you horribly did a technical "fail" on as well when I replied & tore it apart):
"Now for an attack on you" - by psm321 on Thursday August 05, @11:24AM (#33150474)
No, you don't go & TROLLISHLY ATTACK OTHERS HERE, NOW DO YOU? Naw (sarcasm)... well, your own words above clearly show otherwise now, don't they? Yes, they do! SEE ABOVE...
APK
P.S.=> Anyone reading here's FREE to read this url's data http://it.slashdot.org/comments.pl?sid=1743902&cid=33210038 especially from this very exchange, since it's NOT "off topic" as you've apparently had to resort to (going off topic's a troll's last resort usually in fact I've noted), & cover your rather weak + failed attempts at discrediting me and trolling myself AND OTHERS HERE TOO...
Facts always do your kind RIGHT in, everytime (RIGHT ALONG WITH QUOTES OF YOUR OWN WORDS ANYONE CAN READ THAT CONTRADICT YOUR TYPE'S OUTRIGHT TROLLISH b.s.)! apk
"Now you made me _actually_ break my word by replying" - by psm321 (450181) on Wednesday August 11, @02:14AM (#33212552)
B.S. - I didn't make YOU do anything, except apologize:
"I am sorry for any offense I have caused you." - by psm321 (450181) on Wednesday August 11, @02:14AM (#33212552)
You ought to be apologizing to those you trolled besides myself, and you caused yourself offense, in that you proved You definitely cannot stick to your guns & keep your word in saying you were done here, that's quite obvious.
Not only that, but you tried to nitpick others and not only myself as well and in doing so, you meandered FAR off topic. I know why though, & it's all RIGHT HERE in my reply to you -> http://it.slashdot.org/comments.pl?sid=1743902&cid=33210038
APK
P.S.=> Especially that URL from this very exchange, since it's NOT "off topic" as you've apparently had to resort to (going off topic's a troll's last resort usually in fact I've noted), & cover your rather weak + failed attempts at discrediting me and trolling myself AND OTHERS HERE TOO... apk