Slashdot Mirror


Windows 8 Changes Host File Blocking

An anonymous reader writes "Windows 8 has been confirmed to not only ignore, but also modify the hosts file. As soon as a website that should be blocked is accessed, the corresponding entry in the hosts file is removed, even if the hosts file is read-only. The hosts file is a popular, cross-platform way of blocking access to certain domains, such as ad-serving websites."

404 of 1,030 comments (clear)

  1. Another reason... by Spritzer · · Score: 5, Insightful

    So, after reading the article this can be summarized as "Microsoft gives you one more reason to disable Windows Defender and use a third party AV app."

    1. Re:Another reason... by binarylarry · · Score: 5, Insightful

      Microsoft gives you one more reason to switch to Mac OSX or Ubuntu.

      --
      Mod me down, my New Earth Global Warmingist friends!
    2. Re:Another reason... by Anonymous Coward · · Score: 4, Insightful

      I completely agree. This is the nail in the Windows coffin for me.

    3. Re:Another reason... by Anonymous Coward · · Score: 1, Insightful

      Microsoft gives you one more reason to switch to Mac OSX or Ubuntu.

      You think Apple or Canonical would never do this? What are you smoking? Maybe switch to Debian would sound a little more reasonable. Buy up routers that actually let you block things while you still can is more like it though. I wonder how long before you aren't ALLOWED to block certain addresses on pain of going to jail as a dirty pirate.

    4. Re:Another reason... by ackthpt · · Score: 5, Insightful

      I completely agree. This is the nail in the Windows coffin for me.

      If you are an enterprise IT manager this is your dream come true. You're not seeing this from the angle Microsoft is, they count on enterprise income more than they do home users.

      --

      A feeling of having made the same mistake before: Deja Foobar
    5. Re:Another reason... by Bill,+Shooter+of+Bul · · Score: 5, Interesting

      Why is that a dream come true for an enterprise IT manager? You *want* employees to be on facebook? Or are you saying that crazy behavior on the windows platform ensures your job security?

      --
      Well.. maybe. Or Maybe not. But Definitely not sort of.
    6. Re:Another reason... by Anonymous Coward · · Score: 5, Informative

      Enterprise customers will block it at using DNS or using Group Policy, not the hosts file.

    7. Re:Another reason... by MicroSlut · · Score: 5, Informative

      What Enterprise IT Manager is using the Hosts file to block web sites? Enterprises use firewalls. I've been blocking doubleclick at the firewall/proxy level for as long as I can remember.

    8. Re:Another reason... by pipatron · · Score: 1, Troll

      And this move makes sure you will never consider using a Windows-based platform as a small office-firewall, if you ever thought about something crazy like that before...

      --
      c++; /* this makes c bigger but returns the old value */
    9. Re:Another reason... by Forty+Two+Tenfold · · Score: 1, Offtopic

      I'm sorry, but there is no reason to change to a Mac

      For a subset of meanings of the word, there's snobbery.

      --
      Upward mobility is a slippery slope - the higher you climb the more you show your ass.
    10. Re:Another reason... by sqldr · · Score: 1

      if you're an enterprise IT sysadmin, this is a nightmare. How can I check a site is up on a server with a certain domain name before I point DNS to it?

      --
      I wrote my first program at the age of six, and I still can't work out how this website works.
    11. Re:Another reason... by Nerdfest · · Score: 4, Insightful

      If they're interested in 'enterprise' (I really hate that word these days), they may want to have a look at what's been happening. Good or bad security-wise, people have been pushing for using their own devices, devices they *like* to use. I think the only thing really stopping it from taking off for tablets and phones is the failure of Rim, Apple, etc, to open their protocols so a business does not need to pick a single type of device. If they ever figure that out, Microsoft is hosed.

    12. Re:Another reason... by Samantha+Wright · · Score: 4, Informative

      It turns out Windows Defender just prevents certain domains from being added. Disable Windows Defender or use a host name less common than "ad.doubleclick.net" or "facebook.com", and the hosts file works just fine. I'm guessing the idea is to safeguard against phishing and ad-replacement attacks.

      --
      Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
    13. Re:Another reason... by burne · · Score: 3, Interesting

      Could you be so kind to post the other reasons?

      I have been using UNIX/linux/BSD and odd stuff like BeOS, System 7/8/9, OS X, Solaris/CDE, IRIX etc for 15 years.

      Never found a solid reason to use windows, and now you tell me there's more than one reason _not_ to run windows?

      That is one alternative reality I must grab..

    14. Re:Another reason... by snemarch · · Score: 3, Insightful

      Umm, would you use the hosts file if setting up a Windows box for firewall purposes? I think not.

      I actually think not allowing critical things like *.microsoft.com (especially windows update and MSE) being redirected is a good thing - but there should be a Big Fat Popup warning that this is being done, and extending the hosts-removal for things like facebook and doubleclick? That's dubious, to put it mildly.

      --
      Coffee-driven development.
    15. Re:Another reason... by vux984 · · Score: 4, Informative

      How can I check a site is up on a server with a certain domain name before I point DNS to it?

      I guess you could add it to the hosts file the way you always did.

      All they did was block redirecting certain high profile domains that were commonly attacked by phishing and url redirection attacks by malware writing to the hostsfile. You'll still be able to add your my-cat-fluffys-enterprise-weblog.com and it will still work.

      Unless you happen to work on small handful of high profile websites that are commonly attacked by phishing/url redirection attacks, nothing has changed.

      If you do happen to work for facebook, and you do happen to use your hosts file to point facebook.com at internal development servers and you happen to use Microsoft's Windows Defender on your development pc, then things got ever so slightly more complicated. You'll probably cope, though.

      if you're an enterprise IT sysadmin, this is a nightmare.

      Yes, a nightmare on the same scale as the Dairy Queen across town being out of my favorite flavor. The horror.

    16. Re:Another reason... by grcumb · · Score: 1

      if you're an enterprise IT sysadmin, this is a nightmare. How can I check a site is up on a server with a certain domain name before I point DNS to it?

      sudo vim /etc/hosts

      --
      Crumb's Corollary: Never bring a knife to a bun fight.
    17. Re:Another reason... by Anonymous Coward · · Score: 3, Insightful

      Yes but my point is, I will now have to use a firewall to keep Adobe CS_ from phoning home.

    18. Re:Another reason... by Mashiki · · Score: 1

      So, after reading the article this can be summarized as "Microsoft gives you one more reason to disable Windows Defender and use a third party AV app."

      Really? No...REALLY? Because I don't know of another AV product that doesn't do exactly the same thing, if doesn't include some type of malware protection inside of it as well. And nearly all of them do, to me this just seems like the usual "let's all jump on the bash MS train" for something that other AV vendors were doing 5 years ago.

      --
      Om, nomnomnom...
    19. Re:Another reason... by LordLimecat · · Score: 5, Insightful

      An IT manager using Hosts is an IT manager that needs to be replaced.

      First, if you are doing your web filtering on the workstation, you are doing it badly, badly wrong. Second, HOSTS is not somethin that is easily maintained or modified. Third, there are about a zillion better ways to accomplish blocking than using a HOSTS file.

      Its basically a kludge from bygone days before DNS, and for 99% of use cases where you might think "I can use a HOSTS file for that", there are far better methods-- or else the thing you are trying to do is retarded.

    20. Re:Another reason... by LordLimecat · · Score: 2

      And this move makes sure you will never consider using a Windows-based platform as a small office-firewall,

      And it also guarentees you will never use it as a stapler. Thing is, noone was doing either of those things before, nor will they now.

    21. Re:Another reason... by colinrichardday · · Score: 1

      I don't know about Apple, but why would Canonical do this? Or do it in a way that the user can't undo?

    22. Re:Another reason... by cayenne8 · · Score: 5, Insightful

      Its basically a kludge from bygone days before DNS, and for 99% of use cases where you might think "I can use a HOSTS file for that", there are far better methods-- or else the thing you are trying to do is retarded.

      Even allowing for your premise....

      Why on earth would MS destroy a simple, well known behavior that users might indeed have reason to want to use? Why 'fix' something that isn't broken? Why break something that wasn't hurting anything else on the OS?

      No harm in leaving a well known tool and behavior be.....but plenty of reason not to fuck with it, no?

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    23. Re:Another reason... by LordLimecat · · Score: 2

      I agree, I just dont think theres anything remotely noteworthy here. If it werent for awful 90s era programs that cant handle DNS, Id say kill the entire thing off and end the stupid "Hosts is a good idea" myth altogether.

    24. Re:Another reason... by Martin+Blank · · Score: 5, Interesting

      Considering that the number of systems hit by malware making use of HOST file modifications is far larger than the list of systems using it to block access to sites, the balance of evidence is in favor of what Microsoft is doing. I know some people who have extensive files, but that group is very small. LordLimecat was right: it's a feature from a bygone era that is used more often for harm than for good. Even adding a switch to the functionality (which might well be there in the form of a registry entry) doesn't help because that switch will get flipped by malware.

      Sometimes features once useful outlive that usefulness.

      --
      You can never go home again... but I guess you can shop there.
    25. Re:Another reason... by Anonymous Coward · · Score: 5, Insightful

      This is silly reasoning. "Since I don't have a good reason to use it, nobody else should either."

      I use it to test services that are replacing old services with the same name. It works well as a temporary/quick way of testing. Yes, I could do it in DNS but it would take much longer to vet the change to our DNS servers than my local hosts file. Thankfully, I don't have to worry about this since I don't use Windows.

    26. Re:Another reason... by ceoyoyo · · Score: 4, Interesting

      MS sells ads. The biggest use of the HOSTS file is blocking ads. Google wishes they could do this.

    27. Re:Another reason... by shinzawai · · Score: 1

      It's called Linux, not Ubuntu, you dork/shill!

    28. Re:Another reason... by DJRumpy · · Score: 2

      I'm not sure how smaller companies do it, but I don't know of any decent sized enterprises that rely on a hosts file to restrict access to certain sites.

      That said, this is some really stupid shit from the MS gene pool. Hosts should always take priority and simple visiting a site should never modify hosts as a result.

      That said, I wonder if the old trick of setting 'System' to read only works?

    29. Re:Another reason... by Anonymous Coward · · Score: 1

      if you're an enterprise IT sysadmin, this is a nightmare. How can I check a site is up on a server with a certain domain name before I point DNS to it?

      Agreed, I edit my host file almost daily, we run multiple apps on a single webserver/ip with virtual hosts, and if I'm setting up a new app (no DNS yet) or testing a particular load-balanced server of an existing app, being able to set a specific DNS in my host file is *essential*, I could not do my job effectively without it. I've dealt with multiple other teams in the company that have their host files locked out by policy, they can't even test their *own* applications before going live on new hardware (ie, moving an existing app) because they can't edit their own host file.

    30. Re:Another reason... by Stormwatch · · Score: 1

      So many good distros out there, and you mention Ubuntu?!

    31. Re:Another reason... by blagooly · · Score: 1
      Advertising/advertisers. Good for business, good for the web.

      There will be a way, there always has been. A fine, fun tradition. 98Lite. What Browser?

      OT: Metro is effectively a "skin" or layer on 7? The "registry" is still there?

      Safe prediction? Simple corrections will fix these "issues".

    32. Re:Another reason... by garett_spencley · · Score: 4, Informative

      I agree that for blocking or for network-wide control using HOSTS is a horrible idea.

      I also realize that the issue apparently here is blocking only.

      But with that said, what about independent developers running their own web application on their machine ? If you're a web developer and you do your coding locally, it makes sense to use your host file to send a domain like dev.example.com to 127.0.0.1.

      Again, I know it looks like Windows 8 won't interfere with that. But it's still an example of a legitimate reason someone might rely on the hosts file, and why it could be a major PITA to have it messed with by the OS. Or is there a better way that I'm missing ? ( (and running your own DNS server, even locally, and especially on a Windows machine, seems way overkill and no where near "better" IMO).

      The problem with HOSTS files were they needed to be synchronized, distributed and maintained. Yes, it's a hold over to pre-DNS. But for a single machine who needs to set up certain private domains locally it seems the best option.

    33. Re:Another reason... by Boaz17 · · Score: 3, Interesting

      Crap!

      The hole to plug (17 years over do) Is the fact that malware is able to modify the hosts file or flip a registry switch. Not some M$ convoluted notion of spaghetti security. I bet that by itself has holes in it.

      Guys be careful an M$ troll making a days pay ...

      Free Life
      Heart

    34. Re:Another reason... by Chris+Mattern · · Score: 2

      If you are an enterprise IT manager this is your dream come true.

      Dream? No, nightmare. A machine the can't be configured as desitred and rewrites itself at will has no place in any corporate shop. You don't want the user rewriting the hosts file? That's not unreasonable and you can implement that right now, via policy so it's uniformly implemented. A client unavoidably rewriting itself against management wishes and that behavior can't be changed? Completely unacceptable. With this "feature", Windows 8 will not be installed in any corporate shop; at least not in any with any sort of a clue.

    35. Re:Another reason... by TapeCutter · · Score: 2

      You just forfieted your geek card, Linux is a kernel.

      No he's ok.
      You OTOH, have just earned the pedant endorsement on yours with that post, congratulation. ;)

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    36. Re:Another reason... by rrohbeck · · Score: 3, Informative

      Its basically a kludge from bygone days before DNS, and for 99% of use cases where you might think "I can use a HOSTS file for that", there are far better methods-- or else the thing you are trying to do is retarded.

      Ah, so I should rather set up a DNS server for my 5 machines, rather than have one hosts file that never changes and that I append once after installation?

    37. Re:Another reason... by Anonymous Coward · · Score: 3, Interesting

      Yup, that's what I use it for too. Changing DNS changes it for everybody, which is what I don't want.

    38. Re:Another reason... by AK+Marc · · Score: 1, Insightful

      If the malware uses the hosts file, then neutering the hosts file helps neuter malware. Or were you just complaining because you wanted to complain, and you didn't bother to think about what you said?

    39. Re:Another reason... by AK+Marc · · Score: 4, Interesting

      I've seen it done by managing the hosts file with a login script. The issue was that two companies merged with separate intranets that had intranet names that overlapped public names. The DNS merge was months away, so hosts allowed employees in both companies to get to both intranets until DNS was set up appropriately. I can't argue it was best. I can only argue that because of business reasons, it was just about the only possible solution (natting could have worked, but it was uglier).

    40. Re:Another reason... by Anonymous Coward · · Score: 1

      Do you realize how stupid that sounds?

      Install yet another bloated app that adds more potential security holes into your system, configure it, hope you didn't make a mistake somewhere that comes back to bite you long after you forgot you set up a DNS server on your desktop machine, when this was all previously configurable in 60 seconds using a text editor and a basic text file?

    41. Re:Another reason... by AK+Marc · · Score: 4, Funny

      Is "laptop3.fakedomain.local" reachable from a root DNS server? No? Then this won't affect you. But if you block adsense.com or whatever, even on a hosts file, you will be affected. The best fix is for someone to start up an ad-blocking DNS server that will block the ones people want blocked, and if you want to use it, you point your computers to it. The problem is, it'll be ad supported from the DNS errors, causing the heads of all the users to explode.

    42. Re:Another reason... by Anonymous Coward · · Score: 4, Insightful

      If that was the legitimate reason, then the proper course of action would have been to remove the hosts file feature totally (not this half-assed bullshit).

    43. Re:Another reason... by AK+Marc · · Score: 2

      How can I check a site is up on a server with a certain domain name before I point DNS to it?

      It's not a nightmare if you are competent. nslookup to 4.2.2.2 and get the current IP for the host in question (bypasses your hosts and DNS settings). Then ping the IP (doesn't use hosts or DNS).

      If you don't have that stored in your head, you aren't a competent admin. Though I can't count the number of times I used nslookup, only to have the person looking over my shoulder mention he's never seen it before. So the number of competent admins is likely very small.

    44. Re:Another reason... by zoloto · · Score: 2

      Frankly, I wish there were an iptables windows clone.

    45. Re:Another reason... by zoloto · · Score: 1

      Then they shouldn't be installing dodgy software from whatever pirated software sources they're using.

    46. Re:Another reason... by jaxtherat · · Score: 1

      Yes.

      --
      http://www.zombieapocalypse.tv/
    47. Re:Another reason... by Bill+Dog · · Score: 1

      It still means that Windows Defender has possibly detected malware and isn't telling you about it.

      That's the problem I have with Defender. I've been running Vista for a few years now, and early on when I first edited my hosts file it blocked it, either by setting it back silently and putting something in Defender's history or by prompting me, I can't remember which.

      But the solution was to turn off hosts file protection in the Defender prefs. So I get to modify it all I want, but I don't get warned if something else does. Seems way too course-grained of a solution.

      I wonder would it really be that big a deal to have a prompting option (and off by default, suitable for most users (who wouldn't modify their hosts file)) to allow intentional changes, and then a snapshot-based differencing system, for just that file.

      Or maybe just leave anything alone that is pointed to localhost?

      --
      Attention zealots and haters: 00100 00100
    48. Re:Another reason... by raju1kabir · · Score: 1

      Pinging the IP doesn't tell you that the web server is running, let alone configured to serve the proper content when queried with a specific Host: header.

      If you think that ping is a good way to conclusively determine that a web site is ready for public deployment then, ahem, you aren't a competent admin.

      --
      "Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
    49. Re:Another reason... by wolrahnaes · · Score: 3, Interesting

      You didn't understand the question. The question was about servers hosting multiple domains, assumedly in the context of HTTP since most other protocols don't give a fuck about the domain name. To test this properly, you'll need to either edit the HTTP request by hand or convince your machine that so and so server is actually the host you're requesting. The HOSTS file provides a convenient way to do this for those without direct control over their DNS server.

      That said, unless your site is in the list of protected domains this is entirely irrelevant, and if it is you are probably running your own internal DNS which allows for as much testing as you'd like.

      The sites affected are regularly accessed domains for which malware has historically been known to attack via the HOSTS file. The few users who legitimately need to add these domains to said files can be assumed to be able to figure out how to disable said restriction (though I agree with the idea that MS should have put a note in the file stating that such a thing was occurring) or run their own DNS making this a non-issue.

      tl;dr: You interpreted the question wrong, but the question was pointless to begin with.

      --
      I used to get high on life, but I developed a tolerance. Now I need something stronger.
    50. Re:Another reason... by Kalriath · · Score: 1

      No, no he does not. If that were the case then Macs would ship with an OS called BSD/Mach, and Windows computers would ship with an operating system called NTOS/Windows. Ubuntu is the OS, just as Windows and Mac OS X are operating systems. GNU/Linux is just Stallman's attempt to take the lion's share of credit for work that he contributed nothing more than a small toolchain and a license text to.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    51. Re:Another reason... by VTI9600 · · Score: 3, Interesting

      You'll still be able to add your my-cat-fluffys-enterprise-weblog.com and it will still work.

      That's unfortunate because, as others have noted, the hosts file "feature" is indeed a relic of a bygone era that should be laid permanently to rest rather than being broken for certain use cases. There seem to be two camps here; the ones that say "leave our beloved feature intact!" and those who say "kill it for the sake of the enterprise!" They are both right -- What MS should do is not break the hosts file or make it behave inconsistently, but replace it with something better.

      A Windows service that allows DNS names to be overridden by user request is what is called for here. It could be added as a supported feature ...something that is controlled by group policy and managed through Windows RM to satisfy the enterprise IT folks ...something with a nice UI and possibly new features like pattern matching for the ad-blocking/web-developing user base.

      Practically speaking that probably won't happen, as it's always easier to shoot a piece of software in the head than actually improve or replace it...

    52. Re:Another reason... by Dunbal · · Score: 2

      Windows 8 = Windows Hate.

      --
      Seven puppies were harmed during the making of this post.
    53. Re:Another reason... by Dunbal · · Score: 5, Insightful

      The smart IT manager realizes that even if employees spend 20 mins or so a day, they are far more productive than the ones fully restricted, locked down and persecuted. Studies have been done. Smart managers read them. Bad managers crack the whip according to arbitrary "productivity" goals that really mean nothing. Then they wonder why employees are always leaving the company and positions are so hard to fill.

      --
      Seven puppies were harmed during the making of this post.
    54. Re:Another reason... by AK+Marc · · Score: 1
      You are right. I didn't read it right. I was assuming some basic competency or relevancy of the question. If you want to test a server, but not in a live environment, why do you not have a test DNS server? And if you are trying to get to a "fake" server tested, then the hosts crippling as described in this article will have absolutely no effect on you.

      You interpreted the question wrong, but the question was pointless to begin with.

      I presumed relevance but not competence. I should have presumed neither, and I would likely have gotten the question right.

    55. Re:Another reason... by AK+Marc · · Score: 1

      Pinging tells you the server is running, even if not the web process. And if you like, telnet to port 80 and see what happens.

      But the question was about hosts files when testing servers in a test environment. Which goes back to "why don't you have a DNS server in your test environment?" DNS comes "free" with Windows server and Linux. Or are you too incompetent to administrate either of those?

    56. Re:Another reason... by Anonymous Coward · · Score: 2, Insightful

      If there were, malware would modify it in bad ways and all changes would end up being blocked by windows defender.

    57. Re:Another reason... by Anonymous Coward · · Score: 1

      Fixing things that are not broken is the policy of Microsoft. Control Panel, IIS, Start Menu, now the Metro theme all unnecessary and unwanted upgrades. Now all working less well for the sake of being new.

    58. Re:Another reason... by DarwinSurvivor · · Score: 3, Funny

      Find me an employee that spends "20 minutes a day" on Facebook, and I'll show you an employee that is better at hiding the other 3 hours they spent on Facebook than you are at detecting it.

    59. Re:Another reason... by humanrev · · Score: 1

      Microsoft gives you one more reason to switch to Mac OSX or Ubuntu.

      Interesting choice of word there - you said Ubuntu rather than the more generic Linux. Personally I'd suggest Linux Mint but that's based off of Ubuntu so it's all semantics, but perhaps it's just an acceptance that Ubuntu-based distros are the only ones that have any chance of being an alternative to most users in terms of Linux adoption (as small as that change may be).

      --
      Most people on Slashdot are fucking idiots.
    60. Re:Another reason... by X0563511 · · Score: 4, Informative

      Have you seen the firewall that comes with the Windows 7 generation? It's no iptables, but it can do the job now.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    61. Re:Another reason... by X0563511 · · Score: 2

      So, how is one supposed to test moving a host around without fucking about with the DNS server now, too?

      Used to be I could just stick overrides in HOSTS for the reported nameservers or whatnot and browse/use the host normally, to confirm it works before throwing the switch at the registrar.

      What, are we supposed to ask IT to temporarily modify zones that aren't even in their zone of authority now? Or are we just supposed to throw the switch and see what happens?

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    62. Re:Another reason... by SeaFox · · Score: 5, Insightful

      I think what he wants is a firewall system that explicitly cannot be controlled by the operating system without his approval. So if he blocks something he can be assured it will stay blocked regardless of what kind of backroom deals Microsoft makes.

      The most annoying thing about these latest versions of Windows is that there appears to be this new class of user with control that supersedes than the owner of the hardware.

    63. Re:Another reason... by raju1kabir · · Score: 1

      It's a very common situation that the people who want to test the site are in the marketing department, which could be a different facility or even a different company from the web developers.

      Since the dawn of time, it's been typical for the marketing people to edit the hosts file to make a final review before authorizing something to go live.

      I don't know what their technical resources are, and they are separate from mine. Insulting their IT staff in absentia isn't going to solve their problem.

      --
      "Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
    64. Re:Another reason... by Dunbal · · Score: 2

      Irrelevant if the work gets done and employee satisfaction is high. Staring idly at a monitor is not productivity.

      --
      Seven puppies were harmed during the making of this post.
    65. Re:Another reason... by mjwx · · Score: 2

      Enterprise customers will block it at using DNS or using Group Policy, not the hosts file.

      Actually we'll block it at the firewall as you can override group policy or DNS easily enough (the hosts file was the perfect way to get around a lot of DNS blocks).

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    66. Re:Another reason... by Lime+Green+Bowler · · Score: 5, Insightful

      We use hosts files with shop floor manufacturing software that requires it. It does not function without host entries. You are not the judge of how a hosts file is to be used, and any mindset like yours should not be in IT. You have short sight and low experience in the real world it seems. Any any ass who threatens to "replace" somebody for using a feature that is far from outmoded, or thinks someones methods are "retarded" without benefit of understanding or even offering an alternative is a STFU-and-leave opportunity.

    67. Re:Another reason... by mjwx · · Score: 1

      Umm, would you use the hosts file if setting up a Windows box for firewall purposes? I think not.

      Setting up a windows box as a firewall? Who in their right mind world do that when you could buy a SME class router/firewall like a Fortigate or Sonicwall for less than what it would cost to build your own dual NIC box (let alone the cost of a Windows Server license and ISA server license) which will do a hell of a lot more than being a firewall. I even think Cisco is now offering an ASA or Pix in the $6-800 range.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    68. Re:Another reason... by Dynedain · · Score: 5, Insightful

      no, but dev.realdomain.com might be... and yet I have to overwrite it to simulate on my local machine for development testing. Or perhaps I need to ensure when I load realdomain.com I go directly to a specific IP address instead of the default one that hits the load balancer.

      There's a whole slew of reasons for having a hostsfile (especially for developers) that DNS doesn't solve.

      --
      I'm out of my mind right now, but feel free to leave a message.....
    69. Re:Another reason... by RocketRabbit · · Score: 1

      A kernel is a kernel. An operating system is the whole SYSTEM, the thing you need in order to OPERATE. These days, this includes such utilities as the browser, the shell utility, even the text editor and the sound players.

    70. Re:Another reason... by Joe+U · · Score: 4, Interesting

      Why 'fix' something that isn't broken?

      Because it is broken.

      Malware can easily change the hosts file and screw you up, it's really a hole in name resolution security.

    71. Re:Another reason... by hobarrera · · Score: 4, Informative

      iptables? Really? Have you even tried OpenBSD's pf? That's a powerfull yet easy-to-use firewall!

    72. Re:Another reason... by devman · · Score: 4, Insightful

      Malware can easily change the hosts file ...

      Seems like they fixed the wrong problem.

    73. Re:Another reason... by fwarren · · Score: 1

      Enterprises don't run Windows Defender for free. They buy an AV solition. At that point, no problem with their hosts file. If they by Windows Defender, they can still block access at the firewall.

      What is more troubling to me is if I use the host file to modify the behavior of any real world site I can never be sure that Windows Defender won't overide me on this after some update.

      Yes, theis is a nightmare. Does Windows Defender ignore my DNS settings for these sites as well? How do I know it won't in the future? They already consider monkeying around with the HOSTs file a legitimate thing to do. Why not skip the middleman of DNS and handle that for us as well with sites they care about?

      --
      vi + /etc over regedit any day of the week.
    74. Re:Another reason... by Vreejack · · Score: 1

      Security Task Manager checks for things like suspicious processes, keyboard snooping and modifications to the hosts file. It gives me a popup warning a few seconds after I modify it myself. I doubt it can handle zero-day rootkits, but it helps you keep an eye on normal stuff and helps to ID misbehaving tasks when you are running way too many of them.

      http://www.neuber.com/taskmanager/process/

      Runs on my Vista desktop and I've been running it since XP. The author once patched something for me overnight, a year after my fifteen dollar purchase, so I guess I have brand loyalty for that.

      --
      "Will future ages believe that such stupid bigotry ever existed!" -- Ivanhoe
    75. Re:Another reason... by Anonymous Coward · · Score: 5, Funny

      I use it to stop Mom from reading my blog.

      As far as she is aware my "awful site" as been offline since May.

    76. Re:Another reason... by Anonymous Coward · · Score: 1

      The most annoying thing about these latest versions of Windows is that there appears to be this new class of user with control that supersedes than the owner of the hardware.

      It's already been like this for a long time with iOS.

    77. Re:Another reason... by TheRealGrogan · · Score: 3, Insightful

      These people defending MIcrosoft's behaviour are just tools... I wouldn't pay much attention to them. Microsoft can't "kill the hosts file off" because the behaviour is part of the IP specification (defined in the RFC's)

      We expect implementations of the TCP/IP protocol in clients to behave in established ways and Microsoft has no right to change that.

      I make use of the hosts file for various purposes, including getting my forum users set up with hosts file entries to the new server, beforehand, whenever our DNS entries are changing so they can still reach the forum while changes are propagating. THIS is a prime example of why the hosts file still exists and the behaviour should not be fucked with by those assclowns at Microsoft.

      Hosts was never meant to be used for blocking sites, but it works well enough as a consequence and the behaviour should be left alone. Whatever the user puts in there, should work as intended. I don't fucking CARE that it's used for malware. Fight malware in other ways.

    78. Re:Another reason... by DeathFromSomewhere · · Score: 1

      So are you suggesting that nothing should be able to modify the hosts file? Seems kind of useless.

      If you have some sort of way to tell malware from legit software, I'm sure the rest of the computing industry is waiting for your insight.

      --
      -1 overrated isn't the same thing as "I disagree".
    79. Re:Another reason... by rrohbeck · · Score: 4, Insightful

      I would only be affected if I used Windows 8, which I don't plan to.

    80. Re:Another reason... by mrbcs · · Score: 1

      MS sells ads. The biggest use of the HOSTS file is blocking ads. Google wishes they could do this.

      BINGO!!! We have a winner! Game Over.

      --
      I'm not anti-social, I'm anti-idiot.
    81. Re:Another reason... by hairyfeet · · Score: 1

      Sorry pal but most of us have Windows programs that are mission critical so that's right out. Not that it matters though, MSFT can keep their "Oh Hai! I Iz Teh Social Phone now!" OS and the rest of us will have Win 7. Its stable, runs great, and supported until 2020 so if MSFT doesn't catch a clue by then all the big name programs will have moved to OSX or Ubuntu therefor fixing any problems those with must have programs face. Its a win/win as i see it.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    82. Re:Another reason... by mrbcs · · Score: 1

      I use a hosts file on my home machine to block the ads, and OpenDns for the kids machines.

      --
      I'm not anti-social, I'm anti-idiot.
    83. Re:Another reason... by hairyfeet · · Score: 4, Informative

      Surely you've got an old PC laying around yes? there are several free DNS servers that run on Linux and Windows, just use one of those and block anything you want blocked there. As a bonus a recursive DNS will speed up your web browsing as you aren't needing to call DNS for anyplace you've already been since you have your own DNS on the LAN, easy peasy.

      Hell if you are worried about power you can buy one of those little plug computers or my personal favorite the little cheap E350 AMD kits. Those things are cheap, make great mini-servers or office boxes, only draw about 18w under load and less than 6w on average, great little units. Newegg usually has them the cheapest if you want one.

      As for TFA if anybody didn't doubt that MSFT is expecting businesses and users with a brain to stay with Win 7 hopefully this will be your wakeup call. Hell frankly i wouldn't be surprised if MSFT takes an LTS approach to businesses because as we know businesses simply don't jump on the upgrade wagon like consumers so they can have 7 for business, 8 and 9 for consumers, 10 for business, etc. That would give business users around 7 years an OS which would be just about perfect now that PCs are lasting so much longer and the consumers can be the beta testers just like Fedora is used by RH.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    84. Re:Another reason... by MikeBabcock · · Score: 1

      So you've never seen what iptables can really do I take it...

      --
      - Michael T. Babcock (Yes, I blog)
    85. Re:Another reason... by hairyfeet · · Score: 4, Interesting

      Ask and ye shall receive Comodo Personal Firewall. Free, easy to use, has sane defaults while at the same time letting you control any in or outbound with any kind of rule you can think up. Personally I'd just take Comodo Internet Security Free as it gives you the AV and Firewall in one, has sandboxing, again a ton of control over the AV, oh and their license makes it free for home AND business use.

      With Windows if you want anything more than the basic you really gotta go third party, that's just the way its always been. I happen to like it that way as it gives me plenty of choices besides whatever MSFT packs in. That said the Win 7 firewall isn't bad, you click on advanced and you can cook up your own rules, not nearly as fine grained as Comodo but for a basic firewall it isn't bad.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    86. Re:Another reason... by hairyfeet · · Score: 1

      Uhhh you DO realize there is also a remote registry service that can royally bone you too...right? The problem isn't the file itself, its the remote access part.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    87. Re:Another reason... by davester666 · · Score: 1

      Hello.... Ever heard of "Embrace, extend, extinguish!"

      So Microsoft skipped 'extend' this time...

      --
      Sleep your way to a whiter smile...date a dentist!
    88. Re:Another reason... by Bob9113 · · Score: 1

      Its basically a kludge from bygone days before DNS

      It is wise to avoid disparaging what you do not use. You may simply be ignorant. Here's a few lines from my hosts file:

      127.0.2.1 slave1
      127.0.2.2 slave2
      127.0.2.3 slave3
      127.0.2.4 slave4
      127.0.2.5 slave5
      127.0.3.1 master

      I also have a couple dozen SSH tunnel host overrides and various custom paths. The hosts file is used to define per-machine address resolution.

    89. Re:Another reason... by Sfing_ter · · Score: 2

      No, he didn't, Microsoft says it OVER AND OVER again. Like in 1999, when they were shilling exchange to sysadmins and consultants so "you can bill more hours"

      --
      A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
    90. Re:Another reason... by Joe+U · · Score: 1

      Remote access to the registry requires elevation. The HOSTS file needs to be R/W by default due to older software that expects it to be R/W. I'll bet I can put an ACL on it that blocks the antivirus app from touching it, I'll most likely break some legacy applications by doing it though.

    91. Re:Another reason... by lister+king+of+smeg · · Score: 4, Interesting

      in the case of the host file you could simply require administrator permission. If the malware has admin access you have already lost. And if the malware is affecting the host file currently then the problem is still not in the host file or its implementation it is that the malware is on the system to begin with and the hole it exploited to do so in the first place is what need fixed.

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
    92. Re:Another reason... by lister+king+of+smeg · · Score: 1

      another possible reason is so that they could sell more licenses for windows dns server software if you currently have a small shop with a simple work group you don't need a server and server license to run dns i can simply alter the host. now you would need one.

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
    93. Re:Another reason... by Forty+Two+Tenfold · · Score: 1

      You idiot, you can block anything at the router firewall and you only have to configure it once for multiple systems.

      Read the GP's account name, idiot.

      --
      Upward mobility is a slippery slope - the higher you climb the more you show your ass.
    94. Re:Another reason... by GeniusDex · · Score: 5, Insightful

      It is inherentily impossible to build something into an OS which cannot be controller by that OS itself. If you want these really secure firewalls, they should be on a separate appliance and all your traffic should be routed through them.

    95. Re:Another reason... by xenobyte · · Score: 1

      So, after reading the article this can be summarized as "Microsoft gives you one more reason to disable Windows Defender and use a third party AV app."

      Both AVG and Avast default 'protects' the hosts file by preventing you (or some malware) from editing it.

      However, it can be turned off specifically without disabling the entire AV package.

      --
      "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
    96. Re:Another reason... by Anonymous Coward · · Score: 1

      pf syntax is nice - I used to use agt to simulate it, but since trying ferm I've never looked back.

    97. Re:Another reason... by AmiMoJo · · Score: 4, Insightful

      You seem to be a bit confused about how Windows works.

      If it is your PC and you are the administrator then yes, you have full control over it. You can set any firewall rules you want and they won't be overwritten by "backroom deals" or anything like that. Hosts was always an unsupported system file hack, and there is a pretty powerful firewall in Windows 7.

      On the other hand if it isn't your computer then the (network) administrator can overrule you with Group Policy Settings. This is exactly the same as on a Linux box if you don't have a root access. Your administrator can decide if you have access to the firewall, or even right down to what types of firewall rule you can make. There really is a huge amount of fine grained control available. Enterprise admins love it.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    98. Re:Another reason... by asdf7890 · · Score: 1

      The Windows 7 firewall can definitely do the job described by the poster a few comments up, which is what the poster you replied to was referring to.

      There are things (a great many, depending on how far down the "it is rare people would need to" scale) iptables can do that the built-in Windows firewall can't do, but the matter currently being discussed certainly isn't one of them.

    99. Re:Another reason... by hawkinspeter · · Score: 1

      I get your point, but it is possible for an OS to use append-only media that can be used for tamper-proof logs.

      --
      You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
    100. Re:Another reason... by 1u3hr · · Score: 2

      Why on earth would MS destroy a simple, well known behavior that users might indeed have reason to want to use? Why 'fix' something that isn't broken? Why break something that wasn't hurting anything else on the OS?

      The motivation was probably not to stop you blocking ads, but to stop malware creating DNS entries so they could send you to their site instead of the the intended one.

      The annoying thing is that rewriting the hosts file just happens silently, instead of asking the user if this was what he wanted to do. If there were malicious DNS entries, I think I'd like to know, it's a symptom of something very bad going on.

    101. Re:Another reason... by asdf7890 · · Score: 4, Insightful

      then the proper course of action would have been to remove the hosts file feature totally

      IIRC you still need posix compliance (or the ability to claim it such that your claims can not be rubbished too easily) for your OS to be used in many US agencies, and the hosts file is one of the many minor points mentioned in that specification. Presumably that spec says something about having the feature, but does not say anything about effectively disabling it in this way.

    102. Re:Another reason... by Alioth · · Score: 1

      As an enterprise IT manager, users should not have access to the hosts file anyway so enterprise IT managers shouldn't care.

      Enterprisey setups should not be granting direct connections to website, they should all be going via a proxy which does the DNS lookup for the PC.

    103. Re:Another reason... by TheRaven64 · · Score: 5, Insightful

      A very small amount of Microsoft's revenue comes from selling ads. Almost all of one of their major competitors' revenue comes from selling ads. It's therefore in their best interests to make ad blocking easy...

      --
      I am TheRaven on Soylent News
    104. Re:Another reason... by icebraining · · Score: 1

      I'm not defending Microsoft's decision. I'm saying that there are simple alternatives. And there's no real security threat unless you're opening your firewall to let the DNS server get queries from the outside, and there's no reason to do that.

    105. Re:Another reason... by TheBogBrushZone · · Score: 2

      I suspect the most popular use for hosts is actually to stop pirate software *cough*Photoshop*cough* from dialling home.

      --
      And behold, a command prompt and he who sat upon it, his name was shutdown and -h 3:11 followed with him
    106. Re:Another reason... by Anonymous Coward · · Score: 5, Informative

      Hell if you are worried about power you can buy one of those little plug computers or my personal favorite the little cheap E350 AMD kits. Those things are cheap, make great mini-servers or office boxes, only draw about 18w under load and less than 6w on average, great little units

      Seconded, however you'd best steer clear of the Asus and Asrock boards if you plan on doing anything with the PCI slots on those boards. They all use the ASMedia 1083 pci bridge, which happens to be broken beyond belief. See here and here. TL;DR: the controller has a hardware bug where it fails to deassert its interrupt status, causing IRQ storms which effectively makes connected devices useless.

    107. Re:Another reason... by rastos1 · · Score: 1

      Malware can easily change the hosts file and screw you up

      Exactly. And that now makes classification of Windows 8 obvious ;-)

    108. Re:Another reason... by beelsebob · · Score: 1

      Because he's got his tin foil hat on... Why would you choose not to use something current based on what a tin-foil-hat wearer says they might change in the future?

    109. Re:Another reason... by Lonewolf666 · · Score: 1

      I still think it should be sufficient if the HOSTS file is only accessible with admin privileges. Because once you make the mistake of letting malware run with that level of access, your system is compromised anyway.
      Protecting a small corner of it at the expense of breaking well established functionality creates more problems than it solves.

      IMHO the balance of damage is not in favor of what Microsoft is doing

      --
      C - the footgun of programming languages
    110. Re:Another reason... by TyFoN · · Score: 1

      Maybe you should buy the software :)

    111. Re:Another reason... by azalin · · Score: 2

      Your reasoning does not comply with MS bashing guidelines. Please refrain from using your brain so often.

    112. Re:Another reason... by stridebird · · Score: 1

      Or maybe just leave anything alone that is pointed to localhost?

      That seems sensible, but pointing to 127.0.0.1 could still be malicious if you've got a rogue web server running too.

    113. Re:Another reason... by azalin · · Score: 1

      There used to be this really old joke about windows being a virus. On the other hand good viruses used to be well written and go unnoticed.

    114. Re:Another reason... by asdf7890 · · Score: 1

      OT: Metro is effectively a "skin" or layer on 7?

      Windows 8 is to Windows 7 what XP was to 2000:
      * From the users PoV most of the changes are superficial (the new "skin" generally, the ribbon everywhere, explorer enhancements like the fancy long operation progress boxes)
      * There is a lot more going on under the hood to make some of those changes possible, or to make other improvements like general efficiency and hardware support
      * Most users won't know about, care about, or need to care about the above internal changes, so unless they want to UI update there is no reason to upgrade in the near future.

      Many stuck with Windows 2000 until soon before it dropped out of security patch support because for many it worked so didn't need fixing, particularly because people didn't want to volunteer for a new UI when they were used to the old one (even though a lot of the newness could be turned off). I strongly suspect the transition from 7 (or Vista, or XP for those still using it) to 8 will be similarly drawn out, if not worse because the UI change is more significant.

      The "registry" is still there?

      Yes, and will be for many years to come. Far too much depends on that core feature for it to be removed in any way any time soon. Some code might be using alternate config storage methods/stores/APIs but if the registry went away much would stop working and translating everything it does to a new method (so said method can replace it transparently) would probably be somewhat impractical.

    115. Re:Another reason... by oreaq · · Score: 5, Informative

      Hosts was always an unsupported system file hack

      Where do you get this idea from? Hosts files are a common part of the IP stack of various operating systems. Microsoft has been using hosts files at least since Windows 95. They are fully supported and documented.

    116. Re:Another reason... by TCM · · Score: 4, Informative

      I make use of the hosts file for various purposes, including getting my forum users set up with hosts file entries to the new server, beforehand, whenever our DNS entries are changing so they can still reach the forum while changes are propagating. THIS is a prime example of why the hosts file still exists and the behaviour should not be fucked with by those assclowns at Microsoft.

      No, it's a prime example of a bad IT person. If you had any clue about what you're doing, you'd lower the TTL prior to making the change, then make the change, then change the TTL back to normal.

      Expecting random clients to modify their config to compensate for your incompetence is just dumb.

      --
      Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
    117. Re:Another reason... by oreaq · · Score: 1

      The "extend" is called lmhosts.

    118. Re:Another reason... by Lehk228 · · Score: 1

      Malware also modifies the hosts file and redirects trusted websites to malicious servers

      --
      Snowden and Manning are heroes.
    119. Re:Another reason... by DrXym · · Score: 1

      It wouldn't be hard to buy a router with a firewall too which could do this. Or hackers could knock one together using some old hardware they have knocking around. There is custom firmwares for a lot of Netgear kit.

    120. Re:Another reason... by DrXym · · Score: 1

      Why on earth would MS destroy a simple, well known behavior that users might indeed have reason to want to use? Why 'fix' something that isn't broken? Why break something that wasn't hurting anything else on the OS?

      I expect primarily to stop malware using hosts as an easy way to reroute calls or block AV requests or whatever. They probably think it's better to deprecate this file completely and rely on a proper firewall infrastructure. Of course it might also stop users from blocking ads, but I think that is more of a concern for Windows RT since Windows 8 will presumably benefit from any number of 3rd party firewalls where blocking could be achieved.

    121. Re:Another reason... by flirno · · Score: 1

      This has nothing to do with enterprise IT. This has more to do with the app store that comes with windows 8.

    122. Re:Another reason... by dskzero · · Score: 1

      What kind of retarded IT manager blocks sites via the hosts file?

      --
      Oblivion Awaits
    123. Re:Another reason... by d3ac0n · · Score: 1

      Agreed. I really wasn't getting this issue at all.

      I haven't used the hosts file to block with for AGES. At work we block with firewall and web filtering. At home I use NoScript and Adblock and firewall blocking.

      Glad to see the hosts file get more attention. Too bad that Win8 is so horrible to work with I'll never get to use the improvement in hosts file management.

      --
      Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
    124. Re:Another reason... by WillerZ · · Score: 1

      You did your testing on a pre-production test domain, and you have a managed code base that allows for easy transition to other domain names?

      Why add in an unnecessary risk? If third-party code (unbeknownst to you) names its tables with the domain name you can test it all you like on a pre-production name but as soon as you flip to the real name it will stop working. And the first time you will know about it is after you flip the switch and your customers complain.

      Or are you seriously suggesting you create an entire new server environment to make modifications to your existing web sites?

      Pretty-much everyone I know does this; you make a new VM in EC2 or Peer1 or Rackspace or whatever, install and configure everything under its final name, test it, then switch the DNS entries.

      Once you are certain the DNS changes have propagated everywhere they're going to get (wait TTL * 2 after the change) you stop and delete the previous VMs.

      --
      I guess today is a passable day to die.
    125. Re:Another reason... by marcello_dl · · Score: 1

      You mean you are comfortable about an AV solution, and a popular one, meddling with a write protected hosts file and telling you nothing about it?

      One should AT LEAST have learned about this behavior from Windows or Defender changelogs.

      I see how windows gives you job security, though. You can't be held responsible for the inner working of a black box.

      --
      ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
    126. Re:Another reason... by kaatochacha · · Score: 1

      Actually, that's the primary reason I'm reading this, is to see what his response will be.

    127. Re:Another reason... by godefroi · · Score: 2

      I think he meant the technique of redirecting certain names to (f.e.) 127.0.0.1 using the hosts file as an ad-blocking tool was an unsupported hack. The original purpose of the hosts file certainly didn't include ad-blocking, but to say "unsupported" is a stretch.

      --
      Karma: Poor (Mostly affected by lame karma-joke sigs)
    128. Re:Another reason... by godefroi · · Score: 1

      Microsoft can't "kill the hosts file off" because the behaviour is part of the IP specification (defined in the RFC's)

      Uh, the IP specification doesn't say anything about the hosts file, because the IP specification doesn't specify how to map names to addresses. In fact, it specifically says:

      It is the task of higher level (i.e., host-to-host or application) protocols to make the mapping from names to addresses.

      --
      Karma: Poor (Mostly affected by lame karma-joke sigs)
    129. Re:Another reason... by omglolbah · · Score: 1

      The article has already been appended with a "Whoops, this is an anti-malware issue" so time to chill.

      That there is no message or indication that the file is protected in such a way is of course a failing but protecting system files has been part of most anti-malware kits for years... Even 3rd party tools do this.

      Amusingly the host file behavior has not changed in win8. Just the code protecting it so your rage is misdirected at best ;)

    130. Re:Another reason... by Bob9113 · · Score: 1

      That's a horrible example. You'd be much, much better off defining named entries in the SSH config.

      Tunnels, nitwit. I'm tunneling to an endpoint through an intermediary host.

    131. Re:Another reason... by quacking+duck · · Score: 1

      Irrelevant if the work gets done and employee satisfaction is high. Staring idly at a monitor is not productivity.

      Unfortunately, MBA-logic response to that is "Who cares about employee satisfaction, obviously we're not giving them enough work to do."

    132. Re:Another reason... by Shagg · · Score: 1

      If it is your PC and you are the administrator then yes, you have full control over it ... Hosts was always an unsupported system file hack

      So by "full control" you mean "unless MS decides not to support what you want".

      --
      Unix is user friendly, it's just selective about who its friends are.
    133. Re:Another reason... by LordLimecat · · Score: 1

      These people defending MIcrosoft's behaviour are just tools... I wouldn't pay much attention to them. Microsoft can't "kill the hosts file off" because the behaviour is part of the IP specification (defined in the RFC's)

      1) Im not defending it, im saying its uber low on "list of things I care about".
      2) Theyre not "killing it off", theyre preventing common hijacks to it. Its a pretty retarded way to do it IMO, but whatever.

      I make use of the hosts file for various purposes, including getting my forum users set up with hosts file entries to the new server, beforehand, whenever our DNS entries are changing so they can still reach the forum while changes are propagating

      This falls under "bad ideas / DNS does it better" from above, sorry. Prior to any DNS changes, set your TTL to 30 minutes or however low it goes, make the change, viola. 30 minutes, max, before propogation. Encouraging HOSTS file use is just going to cause massive breakage down the road when one of your users forgets to remove that entry.

      THIS is a prime example of why the hosts file still exists and the behaviour should not be fucked with by those assclowns at Microsoft.

      And the breakage that some of your users will experience next DNS change is why we have moved on to DNS, and why what MS does to the HOSTS file is of little concern to me or my clients. There is ONE client that I have that would remotely care about HOSTS behavior change, and Im going to go out on a limb and say hostname-only entries ("SERVER 10.5.5.5") are probably not on the radar of things they mess with, which are about the only major HOSTS file use left in businesses.

      Fight malware in other ways.

      Then disable the behavior in their antimalware software. This is such a non-issue, its remarkable that it made it through the firehose.

    134. Re:Another reason... by LordLimecat · · Score: 1

      The hole to plug (17 years over do) Is the fact that malware is able to modify the hosts file

      Not to be rude, but you simply dont understand how malware works. Once malware gets user privileges, it can do whatever the user can. It can even call an elevation prompt on itself, and if the user grants it, the malware now can do absolutely anything on the system not prevented by some third party product-- that is, unless your antivirus is blocking calls or protecting files, it can do anything at all.

      Since the HOSTS file is protected by NTFS to be admin editable only, malware with system rights can make changes to it.

    135. Re:Another reason... by LordLimecat · · Score: 1

      Not through doubleclick. You are basically saying that MS is unblocking ads for Google because....?

      Does not compute, sorry.

    136. Re:Another reason... by atlasdropperofworlds · · Score: 1

      Actually, you only need to disable windows defender to modify the hosts file. Once the modification is done, windows defender seems to happily ensure it does not change again on it's watch.

    137. Re:Another reason... by LordLimecat · · Score: 1

      in the case of the host file you could simply require administrator permission.

      They already do. Can we end this stupid discussion now?

    138. Re:Another reason... by LordLimecat · · Score: 1

      C:\>cacls C:\Windows\System32\drivers\etc\hosts
      C:\Windows\System32\drivers\etc\hosts NT AUTHORITY\SYSTEM:(ID)F
                                                                                  BUILTIN\Administrators:(ID)F
                                                                                  BUILTIN\Users:(ID)R

      Can you please point out the security hole here? Is it the "administrators:F"? Or perhaps that SYSTEM has rights to the file?

    139. Re:Another reason... by ceoyoyo · · Score: 1

      They can't just unblock their OWN ads. That would be too obvious. By unblocking Google's too they can claim it's for "security."

    140. Re:Another reason... by tomthegeek · · Score: 1

      > The most annoying thing about these latest versions of Windows is that there appears to be this new class of user with control that supersedes than the owner of the hardware.

      So important it bears repeating.

    141. Re:Another reason... by bkcallahan · · Score: 1

      Welcome to 2012 and finally having to put a firewall up.

    142. Re:Another reason... by Vokkyt · · Score: 1

      I agree with the first part, but this is about end users, not enterprise managers/users, and it's the silent manner in which it's perform that matters. This is a user instigated change that Windows decides to change without telling the user.

      If Defender noted that it was making a change to the hosts file, this would not have exploded to 500+ comments (well, okay maybe there would be enough ms bashing for that), but it would be a different tune altogether.

    143. Re:Another reason... by lister+king+of+smeg · · Score: 1

      um isn't the changes to the host file the topic of this whole thread? if you are sick of the discussion as you said you could just move on to another

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
    144. Re:Another reason... by PhxBlue · · Score: 1

      If he's not getting his work accomplished in a timely fashion, then fire him and hire someone who will.

      If he is getting his work accomplished in a timely fashion, either give him more tasks or STFU and find something more productive to do with your time.

      --
      !#@%*)anks for hanging up the phone, dear.
    145. Re:Another reason... by AaronLS · · Score: 2

      I agree completely. I don't know what these guys have been smoking that they think they should be configuring each desktop when they should be doing it in their infrastructure. Linux or Windows, if you have physical access to the machine, you can do as you please with enough perseverance. If you're not putting these rules into your firewall/network infrastructure, anyone can plug their laptop into a wall, spoof their desktop's MAC, and do as they please as well.

      The hosts file was never meant for implementing IT policies like this. There is a legitimate reason they have made this change. There are plenty of viruses that will modify the host file as a way to block internet access in order to disable anti virus updates or downloads of targeted removal software. For the 1% of us that really know our stuff, we fix this manually, but for the other 99% they sit there with an infected computer for maybe a week or more before they find someone to fix it, all the while their computer is doing the bidding of the malware, spreading or participating in a botnet.

      If anything I would expect them to at least popup a notification whenever the host file is modified, and provide an option to opt-out.

    146. Re:Another reason... by AaronLS · · Score: 3, Insightful

      There were no backroom deals here. Certain domains are commonly targetted by malware. If malware, or perhaps another user/IT with malicious intent, modifies your hostfile to redirect facebook.com to a phishing site, it will still appear to be at a legitimate domain of facebook.com but actually serving the phishing site. It won't have SSL but your average user won't notice. So you see, it is in the interests of preventing the hosts file from being a tool for malware or malicious users. It is not in the interest of some backroom deal MS made with facebook.

    147. Re:Another reason... by Martin+Blank · · Score: 1

      This is silly reasoning. "Since I don't have a good reason to use it, nobody else should either."

      That would be silly reasoning--if I had said it.

      LordLimecat and I are on the same page here. It's not a huge issue for the overwhelming majority of people that certain changes can't be made to the HOSTS file. It is a method to help ensure the average user that common sites (and especially MS update sites) cannot be hijacked via this method. I recognize the need for HOSTS files in certain circumstances. But the number of people with those needs diminishes daily.

      --
      You can never go home again... but I guess you can shop there.
    148. Re:Another reason... by drakaan · · Score: 1

      How about for those of us who have to deal with internal and external IP addresses on websites as we move in and out of client networks. I have lots of hosts entries that *I* put there (and comment out, and uncomment) so that I can get to a site by one of several IP addresses without having to throw up an internal DNS server wherever one might be missing (like on a client's DMZ). If I understand this correctly, then are they saying that *my* entries will get deleted if I access them? If so, then I'm *really* glad I saw this article before I had to try and figure out what the hell was happening to my hosts file. Fortunately, I don't *need* to use Windows Defender, but man, that's a sucky new behavior.

      --
      "Murphy was an optimist" - O'Toole's commentary on Murphy's Law
    149. Re:Another reason... by Cederic · · Score: 2

      While you're entirely correct about the legitimate purpose of this change, it does open the door to Microsoft assuring that doubleclick.net or equivalents aren't set in hosts to 127.0.0.1

      You don't have to work with Microsoft for very long to realise that actually, yes, this is something they would consider.

    150. Re:Another reason... by TheRealGrogan · · Score: 1

      I have a plenty of clues. Some ISPs ignore the TTL and cache DNS records for much longer. Sometimes days. Also, what makes you think I have control over the TTL setting? I don't run the DNS and when I do have that setting available (e.g. at a registrar) I lower it to 300 seconds for the move and that still doesn't help everyone.

      As for the other smart asses who say I'm such a "bad IT person", we remove the hosts file entries after things settle down. It's not random clients either, it's members of forum communities and it works well for us. I've been involved with 3 forums over the last decade and have orchestrated several server moves. In the beginning we had sad users who couldn't reach the forum for days after a move, then we started using hosts so nobody misses a beat.

      Making assumptions about the way things work in theory, without considering the way they work in the real world is what's "dumb".

    151. Re:Another reason... by MrResistor · · Score: 1

      Right... because enterprise IT managers are just chomping at the bit to roll out Windows 8...

      I can't think of a single reason why I'd want to bother with the host files on my user's PCs, but I will say this: when I set something it better fucking stay set! Any OS that ignores my explicitly stated wishes will earn my ire.

      --
      Under capitalism man exploits man. Under communism it's the other way around.
    152. Re:Another reason... by TheRealGrogan · · Score: 1

      Poor choice of wording, you're right. Let's say "The TCP/IP implementation" then. The hosts file is supposed to be honoured... even smart phone OSes do it.

    153. Re:Another reason... by jones_supa · · Score: 1

      Another solution could be to have it wrapped in some kind of UAC thing, telling you "The following program wants to modify your hosts file, allow/deny?" Then you could also add exceptions to legacy programs.

    154. Re:Another reason... by AmiMoJo · · Score: 1

      The KB article you linked to is for Windows 95.

      They were supported in Windows 95 when it was acceptable to shit all over the filesystem. Since XP the location (Windows\system32\drivers\etc\hosts) has been protected so that even an administrator can't write to the hosts file by default. As of Vista (2007, five years ago) accessing anything in system32 was considered to be a really, really, really bad idea and it was only a matter of time before they stopped supporting it. The whole point of Vista was to educate people as to what was bad practice so they would stop doing it and it could be removed.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    155. Re:Another reason... by TCM · · Score: 1

      Some ISPs ignore the TTL and cache DNS records for much longer. Sometimes days.

      So the answer to stupidity is more stupidity. Great IT skills.

      Also, what makes you think I have control over the TTL setting?

      Well, your post I replied to? Duh..

      I don't run the DNS

      So you are tasked with the move of servers and you don't even control the DNS and you can't even coordinate with the "DNS people"?

      and when I do have that setting available (e.g. at a registrar) I lower it to 300 seconds for the move and that still doesn't help everyone.

      You know you have to lower the TTL and then wait for at least as long as the old TTL was?

      It's not random clients either, it's members of forum communities and it works well for us.

      They're random clients as far as your control over them is concerned.

      Moral of the story: Bad IT at work. q.e.d.

      --
      Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
    156. Re:Another reason... by CAIMLAS · · Score: 1

      Spoken like someone who just runs software, they don't test or maintain it for others.

      What do you do when you've got to temporarily change the database host for a single system in a cluster? What if you need to test a dev system in a production environment temporarily to verify a bug quickly? There are many valid reasons for (temporarily) using a hosts file. What if you've got an isolated cluster, separate but a necessary component of an environment, and they shouldn't be in DNS? What if you can only access a system you're prepping for deployment by the production hostname due to SSL restrictions?

      The sane choice is to repoint the hostname to a different IP. Sure, you could do a split view, but for 2-3 hosts? You could update the zone, but for something you don't want to impact the whole environment (and might actually cause problems in and of itself)?

      The hosts file is there for a reason; it is necessary. I can understand why MS is doing what they are, but it's a reactionary security measure to prevent/ reduce malware from working (presumably, though in this case we see that it's only being used to assist in the serving of ads). That certainly does not make it the right choice. Hosts files are a necessary evil.

      --
      ~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
    157. Re:Another reason... by AK+Marc · · Score: 1
      Then try dev1.realdomain.com for internal dev, and dev.realdomain.com for deployed but not released dev, I'm not sure why you require your dev to be externally accessible, I usually do such trickery with internal DNS servers to simulate in dev environment and don't deploy dev machines to the public Internet, but that's just me.

      There's a whole slew of reasons for having a hostsfile (especially for developers) that DNS doesn't solve.

      I've not seen one. I've only seen amateur hacks that some lazy admin thinks is easier in hosts than DNS.

      Or perhaps I need to ensure when I load realdomain.com I go directly to a specific IP address instead of the default one that hits the load balancer.

      See, too lazy to put in s1.realdomain.com and s2.realdomain.com to get to servers 1 and 2 directly. DNS solves it all, but only if you tell it to.

    158. Re:Another reason... by AK+Marc · · Score: 1

      They haven't specified a problem to solve here. So my abusive way of exposing their incompetence isn't going to solve anything. A thoughtful expert answer wouldn't solve it either. So I'll stick with what I know, sarcasm and abuse.

      And no, the marketing people don't edit their hosts file, that's up to the IT people who could just manage it all in DNS and never touch user computers, at least that's what the competent admins do.

    159. Re:Another reason... by raju1kabir · · Score: 1

      The IT people are not going to change it in DNS because that would make the change organization-wide, before marketing has had a chance to proof it. Forcing 5,000 people to see the new web site before it's ready, just so that 3 people can test it, isn't the kind of decision-making that "competent" admins employ.

      --
      "Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
    160. Re:Another reason... by afidel · · Score: 1

      Expecting random DNS servers to respect TTL is incompetence if you work in the real world. Whenever I make a DNS change on the public internet I expect that a certain percentage of clients will not be able to reach the new destination for up to 72 hours. Of course if your clients are competent enough to modify a HOST file then you can probably just tell them to point their DNS client at Google's anycast DNS servers which respect TTL.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    161. Re:Another reason... by hairyfeet · · Score: 1

      Exactly. This frankly would have been a trivial problem to fix if MSFT would have spent more than 4 seconds to think about it, but ever since Apple came out with iPad the entire corp has lost their damned minds and have focused so much on consumers the thought that businesses might still have use of this never even entered their thought processes.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    162. Re:Another reason... by Dynedain · · Score: 1

      I usually do such trickery with internal DNS servers

      Thats great, but I don't have control over our internal DNS. IT does. However, I do have control over the hostfiles on my local dev workstation, and from there I can toggle to point to my local machine.

      See, too lazy to put in s1.realdomain.com and s2.realdomain.com to get to servers 1 and 2 directly. DNS solves it all, but only if you tell it to.

      That assumes the app you're working responds the same to s1.example.com as it does to www.example.com. That's not always the case. And in the cases where it doesn't, you may not have the authority to change the underlying behavior.

      --
      I'm out of my mind right now, but feel free to leave a message.....
    163. Re:Another reason... by hairyfeet · · Score: 1

      If you need PCI slots you best bet would be the ECS Board as it comes with TWO PCI plus a PCIe x16 as well as 4 SATA slots. great for building a mini, not sure what chip it uses for PCI but I think its all AMD so there shouldn't be any hassle if you wanna go Linux. Its also passively cooled so it makes a great silent office box in the corner doing all those little jobs you may need and finally it has the 9w max Brazos chip so it'll idle around 4w.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    164. Re:Another reason... by afidel · · Score: 1

      Apple's revenue comes from selling ads? Oracle's does? IBM's does?

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    165. Re:Another reason... by TheRealGrogan · · Score: 1

      I am talking about moving dedicated web hosting servers where we are either using the DNS at the domain registrar or the hosting company. If you consider that being an "IT task" then I'll leave you to your idiotic buzzwords. As for ISPs and their DNS caching, the stupidity would be to do nothing and let the forum users suffer. What part about caching for days don't you understand?

      Moral of the story: The hosts file behaviour will stand, as a defacto standard, and you really don't matter.

    166. Re:Another reason... by AK+Marc · · Score: 1

      I don't understand. What idiocy has development not falling under IT? Is it information or technology? Yes? IT? That your company's processes are broken doesn't change best practices. With devs like you, there's a reason IT blocks admin access to devs.

    167. Re:Another reason... by Dynedain · · Score: 1

      Tons of places don't mix IT and Dev.

      IT here handles network, server admin, workstation deploy, network credentials, service and hardware provisioning, etc.

      Dev is busy building apps, websites, and more for clients. Different projects have radically different architecture and infrastructure needs. Everything from a simple one-off HTML page to specialized Android builds to run on targeted embedded devices.

      I have root acces to my workstation, and my workstation only. If I need to test something, I can test it on my workstation and not have to commit, get a deploy approved to staging environments, trigger the QA process, etc, etc. I don't, and shouldn't need, DNS admin abilities to do this. Screwing with DNS affects far more people around here than just me.

      I have a real world example for you. I am working on a client's website we inherited a few months ago (~1 million visitors /month) troubleshooting some login issues. Because of the CMS, and a whole lot of legacy code, it currently requires absolute URLs to load resources. We were having a problem with sessions between servers. To isolate the problem, we needed to bypass the load balancer. However, because of absolute URL requirements, the site won't function properly if you visit www1.example.com. The only way for me to bypass the load balancer and ensure I was loading everything from one specific server was to edit my host file.

      Now, short of DNS changes (which I don't have access to because it would affect at least 50 other people in my office and up to 1200 people across our corporate network) or admin access to my client's servers (even the client doesn't directly have this and has to submit formal request changes through their system engineering department) how should I go about guaranteeing I am targeting a specific server?

      --
      I'm out of my mind right now, but feel free to leave a message.....
    168. Re:Another reason... by TCM · · Score: 1

      Where did you read that I was saying the hosts file is useless?

      You equate development work with expecting your clients(!) to modify their hosts file to compensate for the idiocy of ISPs and "forum admins"? Give me a break and get back under your rock. Thank you.

      --
      Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
    169. Re:Another reason... by TCM · · Score: 1

      Of course if your clients are competent enough to modify a HOST file then you can probably just tell them to point their DNS client at Google's anycast DNS servers which respect TTL.

      See, even in this case there should be no reason to touch the hosts file on a client computer.

      --
      Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
    170. Re:Another reason... by uninformedLuddite · · Score: 1

      You're mean! I bet you hate Pokemon too.

      --
      The new right fascists are bilingual. They speak English and Bullshit.
    171. Re:Another reason... by uninformedLuddite · · Score: 1

      in the case of the host file you could simply require administrator permission.

      They already do. Can we end this stupid discussion now?

      Not until the MyCleanPC guy has his say

      --
      The new right fascists are bilingual. They speak English and Bullshit.
    172. Re:Another reason... by ancientt · · Score: 2

      I agree that Windows does have a better firewall than it used to, but saying it is no iptables is an understatement. Blocking incoming traffic is important and blocking outgoing traffic is important but the important thing for me about iptables is the ability to redirect traffic. I redirect traffic coming in on 80 to a completely different machine (or not if it isn't up) and capture outbound DNS and redirect it to my own server. I can do port-knocking to open up ftp, telnet or ssh to only friendly users and turn the rest away. My favorite trick right now is a monitor that looks at my logs and adds the IPs of hacking attempts to a block everything list that is dynamically updated. I write my own tools to some degree, but there are tools to do that reactive blocking automatically that I utilize as well.That the job I want and the Windows firewall is a far cry from capable in that regard.

      --
      B) Eliminate all the stupid users. This is frowned upon by society.
    173. Re:Another reason... by msauve · · Score: 1

      So, MS has basically thrown in the towel, admitting that they can't fix the root problem and therefore have reverted to trying to fix the symptoms.

      BTW, I'm not sure you're correct. I'm currently on Win7, and have never had any issue with modifying the hosts file with no special effort, in 95/2K/XP/7, if I have admin rights.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    174. Re:Another reason... by AK+Marc · · Score: 1

      I mentioned "broken processes" being a reason to do that. And your example serves more as a poster-boy of broken services than an example where local hosts is absolutely necessary. Not to mention that the hosts issues is only for a small number of phishing-related sites and would likely not affect your example. But a better way would be to put your computer on an exemption list in the load balancer to statically map you to the server to be tested. But then, you do what you have access to, without regards to best practices, so I'm sure you'll argue against that because you don't want to bother getting the load balancer to ensure you always hit the server you want.

    175. Re:Another reason... by DarwinSurvivor · · Score: 1

      I'm not disagreeing with you here. Just pointing out that GP can most likely dole out some more tasks to a few of his/her employees :P

    176. Re:Another reason... by LordLimecat · · Score: 1

      Dont know about him, but APK seems to have plenty to say about my posts. Not sure if I should be flattered to have my own personal stalker troll, or not.

    177. Re:Another reason... by Lumpy · · Score: 1

      I block it at the firewall and transparent proxy. Only a fool will make and maintain a Group policy and or DNS for internet traffic blocking.

      --
      Do not look at laser with remaining good eye.
    178. Re:Another reason... by Lumpy · · Score: 1

      Solution then is to run a Linux Host OS and windows as a VM.

      --
      Do not look at laser with remaining good eye.
    179. Re:Another reason... by Lumpy · · Score: 1

      "These people defending MIcrosoft's behaviour are just tools... I wouldn't pay much attention to them."

      They are worse than tools. they are MCSE's!

      --
      Do not look at laser with remaining good eye.
    180. Re:Another reason... by Lumpy · · Score: 1

      Nothing that does not have admin rights, in fact no software should be able to modify anything in the system directory from normal runtime. it should require a reboot into safe mode to install updates.

      This will solve 99% of the problem.

      --
      Do not look at laser with remaining good eye.
    181. Re:Another reason... by DeathFromSomewhere · · Score: 1

      Nothing that does not have admin rights, in fact no software should be able to modify anything in the system directory from normal runtime

      You could have spent the 30 seconds to verify that this is the case. It would take you less time than writing up that post.

      it should require a reboot into safe mode to install updates.

      That's just ridiculous. There is no reason for that.

      --
      -1 overrated isn't the same thing as "I disagree".
    182. Re:Another reason... by mjwx · · Score: 1

      If you do a DNS filter right (DPI + intercept all outgoing DNS packets), it is not easy to to override DNS settings (it has no effect). The cheap consumer-brand router at my house can do this, I would be surprised if enterprise packet filters lacked this capability.

      So basically you're saying I'm right, get the firewall (DPI) to do it. In which case, why even bother with DNS and just set the firewall to drop all packets to/from *.blockedsite.com. If you can bypass the FW (I.E with a VPN) it'll get passed local DNS and GP too.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    183. Re:Another reason... by jimmyfrank · · Score: 1

      Having to turn off Windows Defender is the nail?

    184. Re:Another reason... by Dynedain · · Score: 1

      But a better way would be to put your computer on an exemption list in the load balancer to statically map you to the server to be tested.

      mmhmmm.... and how would that happen exactly? My company is behind a firewall and appear as a single IP. How would you target my machine specifically? And when I need to switch to another server behind the load balancer, or switch back to "normal" operation? Are you honestly suggesting wasting the time of the various admins and approvers multiple times, not to mention making changes to a production environment, just so that a dev doesn't change his host file while troubleshooting?

      The load balancer is managed by a complete different department in the client's company. My contacts don't have direct access and have to formally request changes that can take hours or more to get made. Neither my direct client, nor my company, has the access permissions to make the necessary changes directly.

      Sounds to me like you work in the kind of shop where anyone has access to do anything (and hence break anything) any time they want to any system they want. And you accuse me of not following best practices????

      --
      I'm out of my mind right now, but feel free to leave a message.....
    185. Re:Another reason... by AK+Marc · · Score: 1

      Again, your processes and procedural separation is causing you the problems. At least idiots like you keep me in business, as the more idiots there are in IT, the more demand there is for IT (and thus, more idiots, drawn to the money, aim for it).

      What seems to be the best solution to your problem is a customizable web client that can direct a request (GET or POST or whatever you need) to a URL you specify independent of the target IP, then you insert the target IP, which won't be used in the HTTP request. Most assume that the destination IP will be the IP of the requested URL, and I'd have to do more reading of the spec than I care to to determine whether what I suggest is a violation of the protocol, but I'd suspect not, as usually specifications are not so restrictive.

      See, you just invented the "need" for a new program so you don't have to break other things to do what you want. More IT work for us all.

    186. Re:Another reason... by epine · · Score: 1

      It is wise to avoid disparaging what you do not use. You may simply be ignorant.

      I personally refer to this syndrome as "use case blindness".

      We five-digit Hamlets give this lecture a lot to the seven-digit Horatios. That's what made Hamlet so deadly famous for procrastination: don't mess with use cases outside your ken, without pondering the consequences first.

      On choosing a lap to lie in: "No, good mother, here's metal more attractive."

      Always a hacker at heart.

    187. Re:Another reason... by Dynedain · · Score: 1

      No, you invented the "need" as you declared the existing well-understood tools that have been available for decades to be unsuitable.

      --
      I'm out of my mind right now, but feel free to leave a message.....
    188. Re:Another reason... by AK+Marc · · Score: 1

      Just because people use hammers to pound in screws for a long time doesn't mean it is ever right.

    189. Re:Another reason... by Bill,+Shooter+of+Bul · · Score: 1

      No, Mr Smarty pants, an IT manager wouldn't use the hosts file. If its facbook is already being blocked appropriately with the appropriate tools, then what's the harm in allowing it to be routed to localhost? If facebook is not already being blocked appropriately, what is harm in allowing it to be routed to local host?

      --
      Well.. maybe. Or Maybe not. But Definitely not sort of.
    190. Re:Another reason... by TheHappyHippo · · Score: 1

      Have to say the same. I wouldn't mind a function that can protect that file if enabled(not having to turn Windows Defender on/off for it). Or maybe even be able to protect certain rows in it. If I want to point www.facebook.com to 127.0.0.1 on my computer I should be able to do that. But Microsoft is cutting corners and silently resetting arbitrary items.

    191. Re:Another reason... by godefroi · · Score: 1

      No, it's not part of the "TCP/IP implementation" either, unless you include higher level application protocols (such as DNS) in that "implementation". Let's say, "networking stack", because that would be, you know, correct.

      --
      Karma: Poor (Mostly affected by lame karma-joke sigs)
    192. Re:Another reason... by zoloto · · Score: 1

      I'll look into this. Thanks for the heads up.

    193. Re:Another reason... by Slorv · · Score: 1

      >The most annoying thing about these latest versions of Windows is that there appears to be this new class of user with control that supersedes than the owner of the hardware.

      I couldn't agree more. Beeing a mac guy since 6.05 I'm reluctantly realizing that while I haven't yet seen any evidence of a super root in OS-X 10.7 and up unless we actively turn certains functions off we're loosing control over our HW and SW there aswell. And don't come talking about protecting the end-user.

      Linux in the other hand ...

      --
      Bikers.....The only people that understand why a dog hangs his head out a car window.
  2. So... by Anonymous Coward · · Score: 5, Insightful

    Just add the hosts file to the Defender's white list. If you know how to edit the hosts file, you should know how to add it to the white list.

    Otherwise, who says the edits to that file were not malicious.

    1. Re:So... by nurb432 · · Score: 1

      No that is the wrong attitude. You shouldn't have to do 'extra' stuff because they are pretty much flipping standards the bird.

      If everyone always just says 'well, we can get around that', we dig the hole even deeper.

      --
      ---- Booth was a patriot ----
    2. Re:So... by lightknight · · Score: 4, Interesting

      Precisely. It's smells of a bad excuse for some money under the table.

      --
      I am John Hurt.
    3. Re:So... by Darkness404 · · Score: 1

      Any time a system decides to make things more complicated for the end user with no benefits means its time to jump ship to a different system. Just because you -can- perhaps get a work around doesn't make this decision any better. I -could- spend a few hours getting Ubuntu to behave like I want it to, but it makes more sense for me to just jump ship to a better distribution where configuring it to fit my needs takes a couple of minutes of minor changes rather than wasting an entire afternoon to make it behave like it did before the updates ruined it.

      Given how nearly everything is web based, cross platform, able to be emulated via virtualization or WINE or has a Linux/OS X alternative I don't see why anyone would stick with Windows 8 unless you were a gamer.

      --
      Taxation is legalized theft, no more, no less.
    4. Re:So... by scrib · · Score: 4, Informative

      How about this: Windows Defender removes from the hosts file references to well-known and often accessed sites that could be redirected by malware for nefarious purposes?

      I might not want to visit ad.doubleclick.net but I certainly don't want it redirected to some other unknown IP address! Many, many, MANY websites I visit try to pull up links in that domain.

      Perhaps they should make an exception for localhost references, but considering how much of the general population knows about hosts files, I'm inclined to side with GP. Odds are very high that on most machines running Windows Defenders, a redirected ad.doubleclick.net reference is malicious.

      --
      Help! Help! I'm being repressed!
    5. Re:So... by svick · · Score: 1

      Any time a system decides to make things more complicated for the end user with no benefits means its time to jump ship to a different system.

      Really? So, if I don't like this problem with hosts file in Windows, I should switch to another OS, say Linux. Then Linux does some small change that makes it more complicated for me, so I should switch again? To what? Back to Windows? Am I supposed to switch OSes like this every few months?

    6. Re:So... by snemarch · · Score: 1

      If you've been hit by something that's able to modify your hosts file (requiring administrative privileges), worrying about facebook or doubleclick being redirected seems kind of futile.

      OTOH, not being able to retrieve Windows Updates, download MSE and other anti-malware software? That can definitely make a difference. It's dubious, at best, that facebook and doubleclick entries are being removed.

      --
      Coffee-driven development.
    7. Re:So... by Darkness404 · · Score: 2

      Switch to the better Linux distribution. It is unlikely (unless you are writing low level programs) that you will ever have a problem with changes made in the Linux kernel. The biggest problems with Linux distribution are all the UI changes (such as GNOME 3 and Unity). For example, I switched from Vista on my machines to Ubuntu because it took me about 30 minutes to configure a generic Ubuntu install to one that fit my preferences, it took me a good 3-4 hours to configure a Vista install to one that fit my preferences because they system would fight me all the way. A couple of years ago, Ubuntu made a bunch of stupid changes which meant that configuring a new install would take me a good 3-4 hours to configure, configuring a Debian install took only about 30 minutes. Eventually my Debian install became out of date and it made more sense to go to Linux Mint rather than spend 3-4 hours configuring and updating Debian, etc.

      --
      Taxation is legalized theft, no more, no less.
    8. Re:So... by svick · · Score: 1

      That's kind of what I was trying to point out in what you were saying. It doesn't make sense to switch because of a small problem, as you were advising. That's because all OSes (or distributions) have them.

    9. Re:So... by aaarrrgggh · · Score: 2

      Every web page you visit (practically) has an ad.doubleclick reference. Could be a pretty effective attack vector to spoof them. But, clearly preventing someone from doing this through hosts would not eliminate the ability to do it.

    10. Re:So... by LordLimecat · · Score: 4, Informative

      IIRC doubleclick is Google. Are you seriously implying that MS is in some sort of conspiracy to give more money to Google?

      Stop and think about that for a second, then get back to us once you remove the tinfoil hat.

    11. Re:So... by Targon · · Score: 1

      apt-get dist-upgrade is difficult?
      Or, with Vista, turning off UAC to avoid getting prompted for every change while tweaking the machine? I can understand that some people are allergic to change, but those who are technical enough to be able to handle Linux shouldn't be THAT afraid.

      Now, the Windows 8 UI changes are something to be CONCERNED about, but I suspect that it is more about people not wanting to have to learn something new after so many years with Explorer. Note that Mac people would storm the Apple HQ at this point if Apple were to consider changing the UI for MacOS, it's only been what, 11 years since MacOS X first came out?

    12. Re:So... by Nikker · · Score: 1

      The article may have made a reference to Doubleclick but do you really think Microsoft doesn't have equivalents? When was the last time Microsoft made a decision that did not effect the "bottom line" ? Windows is deployed on at least hundreds of millions of machines world wide, if Microsoft got these ad companies together and told them they could "fix" people trying to block their servers ads you think they would pony up a couple bucks?

      I think you replaced you tinfoil had with a dunce cap.

      --
      A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
    13. Re:So... by Kjella · · Score: 2

      Stop and think about that for a second, then get back to us once you remove the tinfoil hat.

      Aha, it's a conspiracy to make me remove my tinfoil hat!

      --
      Live today, because you never know what tomorrow brings
    14. Re:So... by Boaz17 · · Score: 1

      Then stop the malicious software from accessing the hosts file. Not that stupid thing.

      Just make sure that only a user with a keyboard can edit the hosts file, the registry and a slew of other system configuration.

      When was second guessing the user ever a security model?

      No The conspiracy theory sounds better in this case I'm afraid. Though the proverb:
            "never account to malice what can be explained by stupidity"
      But this time it sounds like really dumb even for M$

      Free Life
      Heart

    15. Re:So... by Beefpatrol · · Score: 1

      It is interesting that MS left the hosts file present and mostly functional if it is useless for everything except malware. I wonder how Win 8 resolves ad.doubleclick.com under normal circumstances. Maybe in Win 8 it resolves to MS's doubleclick equivalent if no entry is present in the hosts file for ad.doubleclick.com and they would rather the user keep it that way. Probably the most telling part of all this is the fact that MS may have decided to override the hosts file according to a plan that can be easily disseminated to machines through anti-malware system updates. How long will it be before they start using that capability in self-serving ways that users don't want? Just think about the rushed and surprise announcement of their Surface tablet announcement when the Nexus 7 was about to get media coverage. They could have made their Nexus 7 blackout attempt more effective by adjusting hosts files remotely.

    16. Re:So... by Idbar · · Score: 1

      And hopefully it's parsed faster/efficiently. I remember spybot used to change the file, and make it ridiculously long, such that windows crawled on the network behavior. The file doesn't support wild card for what I know, making it inefficient for ad blocking tasks. So, I'm fine if they offer other ways for doing that, without the performance hit, and perhaps more efficiently.

    17. Re:So... by Charliemopps · · Score: 1

      OR... and I know this may sound crazy... but you could just stick with Windows 7

    18. Re:So... by gweihir · · Score: 1

      I have exactly 2 uses for Windows:

      1. Gaming
      2. Finalizing Office documents before they go to the customer.

      Fortunately we do most reports in LaTeX (far more efficient) as the customer does not get the right to edit and only gets a PDF. So of my working time, perhaps 2% is spent with windows. I also should add that most of our customers are still on Office 2003 (do not want to retrain their staff for the atrocity called the "ribbon"), so professionally, I could even work with XP in a VM (and occasionally do). And as to LibreOffice, as soon as MS is forced to actually standardize their file-formats, and get penalized when they sabotage 3rd party apps (as they do regularly and intentionally), MS office will cease to be important. It is significantly worse than the competition anyways.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    19. Re:So... by gweihir · · Score: 1

      The hosts file making things slow??? Have they never heard of hash-tables??? Well, it is Microsoft, so that is a real possibility...

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    20. Re:So... by Opportunist · · Score: 1

      And how hard do you think it is to check whether it redirects to 127.0.0.1 and if it does leave it be?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    21. Re:So... by DeathFromSomewhere · · Score: 2

      The article may have made a reference to Doubleclick but do you really think Microsoft doesn't have equivalents?

      They do have an equivalent. It's called aQuantive. They just wrote it off a month ago.

      When was the last time Microsoft made a decision that did not effect the "bottom line" ?

      Never. Everything AFFECTS the bottom line in some way.

      Windows is deployed on at least hundreds of millions of machines world wide, if Microsoft got these ad companies together and told them they could "fix" people trying to block their servers ads you think they would pony up a couple bucks?

      More likely they would whine to the media and cause a shitstorm. As if people adding doubleclick to their hosts file was ever a major problem in the first place. I'll go out on a limb here and say that browser adblockers are vastly more common.

      --
      -1 overrated isn't the same thing as "I disagree".
    22. Re:So... by lightknight · · Score: 1

      Don't do it man, it's a trap!

      --
      I am John Hurt.
    23. Re:So... by LordLimecat · · Score: 1

      Windows is deployed on at least hundreds of millions of machines world wide, if Microsoft got these ad companies together and told them they could "fix" people trying to block their servers ads you think they would pony up a couple bucks?

      The number of people who block ads with HOSTS is positively miniscule. The number of THOSE who would be thwarted by hosts being unavailable is even smaller.

      The idea that this is somehow a conspiracy for advertising makes literally no sense, as it would help its rival by an infintesimal amount and gain it no money.

    24. Re:So... by niftymitch · · Score: 1

      Every web page you visit (practically) has an ad.doubleclick reference. Could be a pretty effective attack vector to spoof them. But, clearly preventing someone from doing this through hosts would not eliminate the ability to do it.

      One critical key in this is that the issue and risk is not at doubleclick but at one of the many
      cascaded CSS and the embedded JS that these pages contain. We know of
      services and ISPs that rewrite JS on the fly to their own ends and have
      discussed them here. And yes adding JS to this tangle is a distraction but
      necessary to make the point that the masses trust the internet to work and
      their machines to work as expected.

      There is value in this yet the silent un-announced activity that changes
      things behind our collective back is troubling. Clearly this mechanism
      can be employed by law enforcement and others to intercept what
      they might not see in other ways.

      If I know that you have moved... I should be able to send snail mail to
      you with an address I know to be better than yesterday's default.
      you % hotel
      Holiday destination
      foreign shore
      some nation
      planet earth.

      --
      Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
    25. Re:So... by marka63 · · Score: 1

      Then if I'm a black hat I just run a local http server and redirect traffic where I please. Now if applications checked for 0.0.0.0 and :: and didn't make a connection attempt one could use these to indicate that a site is not to be talked to. Unfortunately most applications will happily attempt to connect to 0.0.0.0 and :: and if there is a local service it will succeed.

  3. How will APK react to this? by metrix007 · · Score: 5, Funny

    APK's sole existence seems to be reliant on advocating the hosts file as a means of host filtering, despite more modern, flexible, easier, convenient and powerful alternatives existing.

    How will APK stay relevant with the demise of the hosts file in Windows 8? Stay tuned....

    --
    If you ignore ACs because they are anonymous - you're an idiot.
    1. Re:How will APK react to this? by couchslug · · Score: 1, Funny

      There are many ways to maintain a CleanPC.

      --
      "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
    2. Re:How will APK react to this? by Foxhoundz · · Score: 1

      I wouldn't say "demise". All you have to do is disable Windows Defender and install third party AV alternatives, which is the first thing most power users do anyway.

  4. Calm down by Anonymous Coward · · Score: 5, Informative

    Before everyone gets all excited... the article has already been updated with the fact that this is a feature of “windows defender” (and imo a reasonable one) and can be disabled.

    The hosts file is popular for blocking sites, but also popular for redirecting to phishing sites as well. This seems like a very ineffective way of solving that problem, but at least it doesn’t look like there is some evil malicious intent..

    In other news, running certain anti-virus products will prevent you from writing to the boot sector while they are running

    1. Re:Calm down by Anonymous Coward · · Score: 2, Insightful

      Linux isn't an operating system, just a kernel. Fedora 17 is an operating system. Windows is an operating system. All of windows is developed and produced by microsoft.

      I think the point you were tryign to make is that its an optional part of windows.

    2. Re:Calm down by jedidiah · · Score: 4, Informative

      Linux is not owned by a single entity like Windows is.

      Windows is what MIcrosoft says it is because they own it and they can do anything they like with it. If you're offended, your only alternatives are to "hack it" or abandon it.

      There isn't some other pre-packaged variant of Windows you can switch to.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    3. Re:Calm down by khasim · · Score: 5, Insightful

      This seems like a very ineffective way of solving that problem, but at least it doesnâ(TM)t look like there is some evil malicious intent..

      Considering that one of the sites they are unblocking is ad.doubleclick.net (which is often blocked because the user wants it blocked) then Microsoft is taking away an option from the user.

      What will be interesting will be when someone compiles a list of the sites that will be unblocked ... and finds how many BANKS will still be subject to phishing like this ... but ad.doubleclick.net will be protected.

      This is a stupid move by Microsoft done in a stupid fashion.

    4. Re:Calm down by mrnobo1024 · · Score: 5, Insightful

      The hosts file can only be modified by administrators. Any additional protection is useless because if malware has gotten itself running as administrator, it can just kill or modify windows defender anyway.

    5. Re:Calm down by DragonWriter · · Score: 1

      Really, fucktard? Let's ask all the Linux shitheads how they like Gnome 3 being Linux, 'cause it's in Linux right?

      The analogy fails because, while Windows Defender is in Windows 8, Gnome 3 is not in Linux. It may be part of some Linux-based operating systems, but that's a different thing. (Windows 8 is a family of operating system products from Microsoft, Linux is a kernel. And because Linux is an open-source kernel, the variety of operating systems based on it are much bigger than the variety of Windows 8 operating systems.)

    6. Re:Calm down by Firehed · · Score: 4, Insightful

      Yes, but among the vast majority of users (i.e., not Slashdot readers), the hosts file is an attack vector rather than an adblocker or development tool. All of that security training people should receive around double-checking what's in the address bar goes out the window when the hosts file has been compromised.

      It sounds like MS's security tools have been a bit overzealous in trying to protect this file and can't determine what's a legitimate versus non-legit edit. But it's better to err on the side of being more rather than less secure here, especially with the amount of damage a maliciously-edited hosts file can do.

      Basically: yes, it's Windows 8's fault that this happens, but it's not Microsoft trying to screw you over like the headline makes out. There should be a tool that can edit, save, and sign the hosts file to make this distinction, not entirely unlike visudo - and all operating systems should have something similar. My Cisco VPN client straight-up replaces my hosts file every time I connect, and while I was able to find and update the file it uses to make that less annoying (I have hosts for a lot of VMs in there), the fact that a non-privileged application can do that is quite scary.

      --
      How are sites slashdotted when nobody reads TFAs?
    7. Re:Calm down by Darkness404 · · Score: 1

      Exactly. If you can modify the hosts file which should only be able to be edited by an administrator the system has been fully and utterly compromised.

      --
      Taxation is legalized theft, no more, no less.
    8. Re:Calm down by techno-vampire · · Score: 5, Insightful

      Basically: yes, it's Windows 8's fault that this happens, but it's not Microsoft trying to screw you over like the headline makes out.

      No, it's Microsoft being stupid and ignoring its own security. If a non-privileged program is permitted to ignore the fact that a file is set to be Read-Only, you have absolutely no protection against malicious code changing anything it wants. All it has to do is infect Windows Defender and it can do anything it wants. If I were still a Windows user, I'd be very reluctant to trust Windows 8 at this point because of this obvious lack of common sense in how it handles this.

      --
      Good, inexpensive web hosting
    9. Re:Calm down by SuricouRaven · · Score: 4, Interesting

      The read-only flag is largely disused. The NTFS permissions are the new one and, oddly enough, it's impossible to write to the hosts file without running as admin and clicking the 'this program wants unrestricted access' dialog. But Microsoft knows just as well as everyone else in IT that to the typical user, that dialog is meaningless: All they know is that clicking yes makes the computer do as it's told.

    10. Re:Calm down by viperidaenz · · Score: 1

      I can't write to the boot sector? That's absurd. This is surely going to be the nail in the coffin for Microsoft! Everyone is going to move to OSX and Ubuntu!

    11. Re:Calm down by jader3rd · · Score: 1

      The hosts file can only be modified by administrators. Any additional protection is useless because if malware has gotten itself running as administrator, it can just kill or modify windows defender anyway.

      True, but that's also assuming that all malware is very thorough and well written. While your statement holds true for a targeted attack I don't think it applies generally. Take my father-in-law for example. He thought of himself as being technically competent, and then I show up and make him look like the town fool by comparison. I can't convince him to not run as administrator. My mother-in-law has mentioned that it's partly an ego thing where if he did listen to my technical advice, it means he's not as hot technically as he wants to be. There's a shot in the dark that he'll check AV settings, but there's no way he'd ever open a hosts file or even grep it's contents if he did see it.

    12. Re:Calm down by LordLimecat · · Score: 2

      If a non-privileged program is permitted to ignore the fact that a file is set to be Read-Only, you have absolutely no protection against malicious code changing anything it wants.

      Im going to go out on a limb and say you have no idea what youre talking about-- primarily because you seem to think that Windows Defender is non-privileged. It would be a pretty sorry anti-malware / virus software that ran in user-mode.

      Im going to go further out on a limb here and say that Defender probably runs with System rights, and can do pretty much whatever it wants from a OS security perspective.

    13. Re:Calm down by Impy+the+Impiuos+Imp · · Score: 1

      So basically they're stopping malware from redirecting doubleclick or facebook links to their own scam sites?

      So...I guess strike 3 for the M$ conspiracy theorists.

      --
      (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
    14. Re:Calm down by techno-vampire · · Score: 1

      Im going to go out on a limb and say you have no idea what youre talking about-- primarily because you seem to think that Windows Defender is non-privileged. It would be a pretty sorry anti-malware / virus software that ran in user-mode.

      Not much of a limb, considering that I stated that I no longer use Windows.

      --
      Good, inexpensive web hosting
    15. Re:Calm down by DigiShaman · · Score: 5, Insightful

      Within NTFS permissions, an explicit "Deny" will take priority over an explicit "Allow". Have they even tried flagging the file with deny writes? In theory, that should prevent modifications to the file.

      It's a pain in the ass, but you could always reset the NTFS permissions via ownership and inheritance each time you wanted to make or change an entry to the host file.

      --
      Life is not for the lazy.
    16. Re:Calm down by VGPowerlord · · Score: 1

      If a non-privileged program is permitted to ignore the fact that a file is set to be Read-Only, you have absolutely no protection against malicious code changing anything it wants

      Windows Defender is a system process and likely runs as the System user, a special account used by non-interactive services that require Administrative privileges.

      --
      GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
    17. Re:Calm down by cbiltcliffe · · Score: 2

      Not using Windows is irrelevant.

      Any security software, by definition, and regardless of operating system, has to have access to the entire system, ergo, needs system rights.
      The fact that you missed this has nothing to do with your lack of Windows knowledge, and everything to do with your lack of security knowledge.

      I'd say that's quite the limb, after all.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    18. Re:Calm down by antifoidulus · · Score: 1

      You have to think about what happens AFTER the malware is removed though(and this seems to be the issue that Microsoft is addressing) If the hosts file was not modified/restored after getting rid of the malware, then any sort of malicious entries it put into the hosts file will remain even after the initial attack agent is gone.

    19. Re:Calm down by crutchy · · Score: 1

      the real problem is that for malware to be able to corrupt the hosts file it would also require admin priveliges... how the hell does malware get admin priveliges? maybe its the bullshit click through privelige escalation where users just click "allow" without having any idea or even caring what it means...

      schnier has a name for these kinds of garbage security measures (including "protection" of the hosts file)... "security theater"

    20. Re:Calm down by LordLimecat · · Score: 1

      Not much of a limb, considering that I stated that I no longer use Windows.

      Maybe you shouldnt comment on the state of OS security for an OS you know nothing about, then.

    21. Re:Calm down by SuricouRaven · · Score: 2

      Easily done, but then the malware would simply change the permissions on the host. Or right now, it might disable windows defender. Any account in the administrators group can do that. The problem is that, due to legacy issues, Microsoft is doing it's permissions backwards: Rather than making it possible to provide non-administrator users with more granular access, they are instead having to find ways to restrict what the administrator account can do.

    22. Re:Calm down by flirno · · Score: 1

      This is microsoft shifting the nature of the OS from what it has been historically to a marketing app-fest.

    23. Re:Calm down by DigiShaman · · Score: 1

      To my knowledge, malware would not be able to change permissions on its own because it would have to run under the user credentials currently logged in. Even logged in with Administrative access, UAC would not allow a program to "sudo" execute on behalf of the user. In theory at least. Though I suppose the user could be tricked into the process via malware at which point they're walking their PC off a cliff anyways.

      --
      Life is not for the lazy.
    24. Re:Calm down by yoshi_mon · · Score: 1

      I know this is /. but at this point and time there is no need to defend the knowledge/usage of Windows. You would have to be living under a rock for the past 20 years to not know about Windows and no serious IT person could make the claim that they don't know how to use it.

      I can accept the fact that there might be very serious IT people out there who do not know Windows as well as *nix or even MacOS, but that they would not know and or have used Windows is just silly.

      Finally you do need to move away from XP. It has reached its end of life in terms of support and if a 0 day exploit comes around, MS is not obligated to patch it for you. Move to Win7. It is a solid OS and you can even tweak the UI to make it look very close to XP if you need.

      --

      Really, I know what I'm doing...Ohhhh, look at the shiny buttons!
    25. Re:Calm down by SuricouRaven · · Score: 1

      The user credentials currently logged in are not able to write to the hosts file anyway, unless the user is logged in as a member of the administrators group. So if the extension of system file protection to the hosts file is supposed to stop malware, it can only be concluded it is intended to stop malware that already has some way (probably via dumb user) to run as administrator.

    26. Re:Calm down by crutchy · · Score: 1

      P.S.=> Especially on custom HOSTS files - he wouldn't be the 1st "Big Name" or even PhD I've blown away on things computing... apk

      ummm... no he's just one of the (if not the) most respected experts in security in general. why the fuck would he give a shit about you and your custom hosts files? maybe you should introduce yourself to iptables, which does everything that hosts can do and more. if you came up with some good iptables scripts, who knows, some people may actually take you slightly seriously.

      dude... do you have ANY real friends? i bet blathering on about how you "burn asses" of "blowhards" on slashdot with your custom hosts file godliness goes down great with the ladies :)

  5. This makes sense... for (most) Windows users by Anonymous Coward · · Score: 5, Insightful

    As comments in the article point out, this behavior can be turned off by going to the Windows Defender settings... But by and large this make sense for 95% of Windows users as they will have NO clue about the hosts file, and even less of a clue if it has been modified for a phising attack. Nice to see microsoft take another step forward in protecting the blindingly ignorant and inept.

    1. Re:This makes sense... for (most) Windows users by lowlymarine · · Score: 5, Insightful

      Exactly, this is a perfectly reasonable anti-phishing measure that can be easily disabled, as is clearly explained in the linked article. But hey, we can't have any such pesky facts sneak into a /. summary, it might stymie some good old-fashioned MS bashing.

    2. Re:This makes sense... for (most) Windows users by Anonymous Coward · · Score: 1

      A much better solution would be to alert the user -- in plain and simple English -- that something important has been modified on their system, ideally also telling them what program made the modification. Windows Defender could let the user know "it's been handled" and no need to worry, but at least the user would know something is not right on their system. If it keeps happening, then the user knows they have some sort of malware they need to deal with.

      This modern design motif of "protect the user but don't tell them something attacked them" is bad design. It is a reflection of the blinding ignorance and ineptness of the current generation of UX people.

    3. Re:This makes sense... for (most) Windows users by Anonymous Coward · · Score: 1

      Why wouldn't they build the feature to prompt the user? "Your hosts file has been modified to add xyz/delete xyz. Windows Defender can restore the file to its previous state. If you would like Windows Defender to restore the file, click OK, otherwise click CANCEL to keep the changes." Beyond host blocking, many people doing local web development use this. Of course, many people doing web development are now Mac users.

    4. Re:This makes sense... for (most) Windows users by gmuslera · · Score: 1

      You mean that not only Microsoft introduced a whole new concept on how to be unsafe in internet, but that also is enabled by default? And that does it specifically for the windows users that are clueless?

      Hope it don't get widespread, or car makers will start to remove the safety belt because is too hard for clueless people to use it.

    5. Re:This makes sense... for (most) Windows users by VortexCortex · · Score: 2

      As comments in the article point out, this behavior can be turned off by going to the Windows Defender settings... Nice to see microsoft take another step forward in protecting the blindingly ignorant and inept.

      No, a step forward would be requiring administrator rights to write to the file, and then ensuring admin access is granted only when actually needed. Please, understand this: If you've got software modifying your hosts file, then Windows Defender hasn't done its job and you've got much bigger problems already.

    6. Re:This makes sense... for (most) Windows users by Firehed · · Score: 2

      Prompting users to make security decisions means you have less security. If Defender prompted you every time it was blocking a write to a sensitive/monitored file, most people (the ones that really need the extra security software) would be inundated with requests eventually causing them to hit allow every time just to make the dialog boxes go away.

      There should be a comment in the hosts file indicating how to opt-out of this behavior, but I think what Microsoft has done here is both reasonable and a good security decision. People doing local dev work (myself included, although I don't do web development on Windows) would see the comment and how to disable things, and the rest of the world would have a secure, non-compromised hosts file - as they should.

      --
      How are sites slashdotted when nobody reads TFAs?
    7. Re:This makes sense... for (most) Windows users by Firehed · · Score: 1

      It's a reflection of the fact that people don't want to deal with security. It working silently in the background and staying out of your way whenever possible is absolutely the right decision, or else the protections would all get turned off because they'd be so damn annoying.

      If you got a pop-up every time your firewall blocked a port scan, wouldn't you inevitably turn off your firewall?

      Thought so.

      --
      How are sites slashdotted when nobody reads TFAs?
    8. Re:This makes sense... for (most) Windows users by Dr_Barnowl · · Score: 1

      You do need admin rights to edit it - it's nested in the system folders, on both Windows and Unix.

      It does this for Facebook - you could argue that was reasonable, because it prevents malicious software redirecting you and phishing your Facebook password.

      But it also does this for Doubleclick, which sounds more like someone sucking up to their corporate partners.

    9. Re:This makes sense... for (most) Windows users by wolrahnaes · · Score: 2

      It seems to make sense. Inject your own ads in place of one of the most popular ad networks. Any other content you want to bundle along with those ads you can as well of course.

      --
      I used to get high on life, but I developed a tolerance. Now I need something stronger.
    10. Re:This makes sense... for (most) Windows users by wolrahnaes · · Score: 4, Insightful

      But it also does this for Doubleclick, which sounds more like someone sucking up to their corporate partners.

      You do realize who owns DoubleClick, right? Google. Not exactly a partner of Microsoft. Microsoft has their own ad network that competes with DoubleClick, so that part actually helps make a case to me that this was not ill-intentioned.

      --
      I used to get high on life, but I developed a tolerance. Now I need something stronger.
    11. Re:This makes sense... for (most) Windows users by fermion · · Score: 1

      True. I am not sure how popular the Host file is. I don't talk about it, but I do use it to block web sites. When I do talk about it with Windows admins, most do not know what I am talking about or how it can be used. Also, i seem to recall that spybot S&D did some magic to keep the integrity fo the Hosts file from changes.

      --
      "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
    12. Re:This makes sense... for (most) Windows users by nobodyman · · Score: 1

      Wow. "blindingly ignorant and inept" seems a bit strong for someone whose crime against humanity is not knowing what a hosts file does. Honestly this sort of statement typifies what's wrong with IT.

    13. Re:This makes sense... for (most) Windows users by LordLimecat · · Score: 1

      Because noone will know what HOSTS is-- mostly because its a largely disused relic from an age before DNS, and is basically only used by poorly written DOS-era programs (which are still DNS-ignorant) and a niche of geeks who seem to think it somehow superior to firewall rules or adblock lists.

    14. Re:This makes sense... for (most) Windows users by nzac · · Score: 1

      Yes this is good idea for the general public but it is the worst way to do it.
      Modifying a user edited text-file silently before it gets used by the system is just crappy for everyone.
      The better solution would be to ignore the "bad" entries or make host file redirections an error and not follow them. This alerts the user that their computer may have been compromised and give them opportunity to turn it off though some difficult method.

    15. Re:This makes sense... for (most) Windows users by flimflammer · · Score: 1

      Because that sort of functionality worked so well for user morale with UAC in Vista, right?

    16. Re:This makes sense... for (most) Windows users by bloodhawk · · Score: 1

      yes, it is a url used on millions of websites, hijacking an ad allows them to redirect to their own content or have millions of sites that would trigger whatever else they want.

    17. Re:This makes sense... for (most) Windows users by xenobyte · · Score: 1

      Why wouldn't they build the feature to prompt the user? "Your hosts file has been modified to add xyz/delete xyz. Windows Defender can restore the file to its previous state. If you would like Windows Defender to restore the file, click OK, otherwise click CANCEL to keep the changes."

      People are stupid! - They don't read the popup and just blindly click OK, CANCEL or whatever the option is.

      I remember a test where a bunch of people were 'infected' with a small program that basically just randomly displayed a popup with a huge warning in bold letters and lots of red NOT to click the OK button but to press to make the dialog go away. Almost 70% clicked the button anyway. Go figure.

      --
      "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
    18. Re:This makes sense... for (most) Windows users by LordLimecat · · Score: 1

      The hosts file is one of the most fundamental STANDARDS in TCP/IP networking.

      No, its not. I challenge you to find me in the TCP or IP specifications where it is so core. It has nothing to do with packet structure, headers, payload, or anything else remotely "core" on TCP / IP, and is only defined in 2 auxiliary RFCs.

      If it were "fundamental", you would have a HOSTS file on Cisco routers and all firewall appliances, but apart from BSD and Linux based distros I cannot think of a one that has such a thing (Cisco DOES have static name mappings, but its not a "HOSTS file", nor does it meet the spec AFAIK).

      The take-home message is the fact that Microsoft thought they NEEDED to do this because their OS design is so shitty.

      The takeaway is that microsoft made a rather small error, and most people on slashdot utilizing HOSTS are armchair IT admins who have no idea how networking works or why HOSTS is a terrible idea (at least for the last 10 years).

    19. Re:This makes sense... for (most) Windows users by bingoUV · · Score: 1

      If it is not a standard, why doesn't Microsoft remove hosts file completely instead of imposing this ugly hack ?

      --
      Bingo Dictionary - Pragmatist, n. A myopic idealist.
    20. Re:This makes sense... for (most) Windows users by bingoUV · · Score: 1

      But MS is moving to an app-store model. Where some apps might be ad-supported. Crippling hosts way of ad blocking can give confidence to potential app developers about revenue stream .E.g. hosts way of ad blocking is quite popular in Android (rooted, of course).

      This is as ill-intentioned as they come, especially the SILENT ignore part.

      --
      Bingo Dictionary - Pragmatist, n. A myopic idealist.
  6. Adobe's Activation Servers by Anonymous Coward · · Score: 5, Funny

    Prepare them for the shitstorm.

  7. Bad/lazy programming by bobbutts · · Score: 2

    This seems like one of those situations where someone didn't think of the potential side effects. The goal was to fix some attack on specific sites, but the solution failed to consider that the mere presence of entries like Facebook is not enough to determine of the entry is in fact malicious and/or unintended. Security and expected behavior is compromised in too high a number of situations to use this software imo.

    1. Re:Bad/lazy programming by bobbutts · · Score: 1

      If it's me in charge of the software, I'd omit the feature and most likely never implement it.
      The most obvious solutions would be to prompt the user before modifying the file, but considering the target argument that is not realistic.
      I can't think of any sufficiently reliable way to protect against rogue entries here automatically since they essentially look the same as intentional ones. Maybe there's a way I'm not thinking of.
      Since it's base software included with the OS, it should be solid for a very high percentage of users, not simply ok for most people.

    2. Re:Bad/lazy programming by gweihir · · Score: 1

      I completely agree. Server settings are completely off-limits for any amount of automated changes unless an admin user specifically requests it. That is how any sane OS handles it.

      Although there are severe violations of that in the Linux world as well. I recently nearly went crazy until I found out that dependency-based booting removed my own boot scripts. Admittedly, just the symbolic links were removed but still. Or the things udev does. Automagic is nice if it works and a huge, huge pain when it does not. It must never be used unless really important for the task at hand and very obviously in place. (I admit that I did not look at the README in /etc/rc2.d for the dependency based boot. Force of habit.)

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  8. Re:was going to buy, not interested now by artor3 · · Score: 1, Funny

    Were you really? Why?

  9. MSE: Microsoft Screws Everything by Blue+Stone · · Score: 4, Insightful

    Yeah, this is basically a cack-handed way of fixing malicious hosts redirects.

    It'll prevent malicious programmes from sending you to fake Facebook, but at the expense of entirely overriding any preferences YOU as tthe computer owner might wish to make via the Hosts file.

    It's a staggering level of incompetence that this is their solution. It needs to be changed and they need to find either another way of solving it or allow some form of granulation and user input.

    --
    Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
    1. Re:MSE: Microsoft Screws Everything by VortexCortex · · Score: 1

      It'll prevent malicious programmes from sending you to fake Facebook

      No, it will not. If a malicious program is writing to your hosts file then it can also disable Windows Defender or just white-list itself or the hosts file. There's no reason to buy tickets to this security theatre.

      /me eats popcorn.

    2. Re:MSE: Microsoft Screws Everything by Blue+Stone · · Score: 1

      Replying to myself - apparently the way to fix this, in the short term, is to take control of the Hosts file and then kick the system out of write and modify privilleges.

      --
      Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
    3. Re:MSE: Microsoft Screws Everything by SuricouRaven · · Score: 2

      It'll break some existing malware. It'll take the authors a week or so to adapt, and then a few more weeks for the scammers to deploy patches. Doesn't seem worth the effort, really.

    4. Re:MSE: Microsoft Screws Everything by LordLimecat · · Score: 1

      No, it will not. If a malicious program is writing to your hosts file then it can also disable Windows Defender or just white-list itself or the hosts file.

      One does not follow from the other. The HOSTS file is just a file, and can be written by anything with administrative priveleges. Antivirus software tends to be much harder to disable than simply "get admin, and disable"-- there can be boot-time drivers that prevent such tampering.

    5. Re:MSE: Microsoft Screws Everything by LordLimecat · · Score: 2

      If anyone is considering trying this, I highly recommend you leave SYSTEM read privileges in there if you want it to continue to work.

    6. Re:MSE: Microsoft Screws Everything by firewrought · · Score: 3, Interesting

      Yeah, this is basically a cack-handed way of fixing malicious hosts redirects.

      Every OS does this: starts out with a simple (possibly easy-to-understand) model and evolves to something with more and more layers of cruft. It's called technical debt, and the long-term consequences are that these systems become harder to learn and understand.

      Linux is better than Windows in this regard, but open source is by no means immune to crud formation. The maintenance tools for Debian packaging and the GNU Build System come to mind.

      Which brings me to my rant: in order to remain viable as a hobbyist OS, Linux should strive to simplify and remove "stupid complexity" that needlessly hinders technical understanding of its internals. I'm not speaking of user-friendliness per se (because that's a term that we use in reference to end users), I'm talking about removing complexity that isn't inherently necessary for the purpose of the system.

      --
      -1, Too Many Layers Of Abstraction
    7. Re:MSE: Microsoft Screws Everything by gweihir · · Score: 1

      Indeed. Properly this is a task of the firewall settings. But there seems to be no easy way to tell the firewall to do it. (Yes, there will be some way, but who wants to spend an hour of research time just to find it?) I have to admit I have given up on Windows in this regard. It is just a toy that needs protection by something more professional. That is why I have a proper firewall between it and the Internet.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    8. Re:MSE: Microsoft Screws Everything by LordLimecat · · Score: 1

      There are practically monthly updates that fix privilege escalation bugs for Windows.

      Source, please. Malware has largely evolved to run userland precisely because of UAC, and AFAIK escalation bugs remain quite rare on most systems, including windows

  10. Where do WE want you to go to today? by nurb432 · · Score: 4, Insightful

    Hope you enjoy your new 'media consumption appliance'. Its becoming less and less of a 'general purpose computer' every day.

    --
    ---- Booth was a patriot ----
  11. The internet (or networks) are more than the web by vlm · · Score: 1

    The internet (or networks in general) are more than the web.

    The main problem I see is I've never worked at a place without an airgapped or at least hyperfirewalled production/engineering network. Its actually pretty rare for that design to have a DNS server on the private net. So host file distribution is popular. As is forcing people to use/memorize ip addresses. After all, its not like a "computer" could automate hostname lookups or something like that, and enforcement and procedures give management something to do.

    Anyway sounds like upgrading a production network from hosts files to DNS system suddenly got a whole lot more exciting if you've got windows 8.. Then again, people who use windows for production are pretty much already used to suffering and intense pain, so making it even less ready for the enterprise is not so big of an idea.

    --
    "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
  12. Another reason to skip Windows 8 by kimvette · · Score: 5, Insightful

    This is another good reason to stick with Windows 7, giving Windows 8 a miss.

    One common use of the hosts file is to test staging servers, particularly web servers before pushing them live, and without the complexity and time it takes to set up an additional DNS server.

    --
    The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
    1. Re:Another reason to skip Windows 8 by Geeky · · Score: 1

      I was about to post the same thing, as I'm often tinkering with the hosts file in a development setting just because it's quick and easy, but from at least one comment above it does appear that it's possible to turn this behaviour off.

      --
      Sigs are so 1990s. No way would I be seen dead with one.
    2. Re:Another reason to skip Windows 8 by Darkness404 · · Score: 1

      Yep. After Windows 7 I actually thought Microsoft was getting better, after all IE is now actually usable, Windows Phone 7 is actually pretty neat (not good enough to replace my Android phone, but not the buggy crap which was the old Windows Mobile). But Windows 8 just seems to be stupid decision after stupid decision. I don't think I've really seen a decent idea implemented in Windows 8 so far...

      --
      Taxation is legalized theft, no more, no less.
    3. Re:Another reason to skip Windows 8 by vux984 · · Score: 1

      You don't even have to turn it off unless you are staging for facebook.com or something like it.

    4. Re:Another reason to skip Windows 8 by LordLimecat · · Score: 1

      No, its another reason to say "wow, Slashdot really likes to make mountains out of molehills".

      Is this retarded and probably not terribly useful? Yeah. Is it terribly noteworthy, except for a very few people who still rely on something as arcane as HOSTS filtering? No, not really.

      The reason to skip Win8 is the training overhead and the massive mess that is the new GUI. Changes to the way HOSTS files are dealt with dont really fit my top 100 things that I care about, because if I want something blocked Ill use a system that is actually designed for it-- not some stupid hack for a kludgy system thats been outdated for about 20 years (Protip: redirecting to 127.0.0.1 is NOT what it was designed for, and is a retarded method for people who dont understand networking; 0.0.0.0 is slightly better, but still a stupid way of filtering).

    5. Re:Another reason to skip Windows 8 by LordLimecat · · Score: 1

      I was about to post the same thing, as I'm often tinkering with the hosts file in a development setting just because it's quick and easy,

      This is why dealing with devs can be painful. Just request that the IP be added to DNS so that the IT admin can actually reprovision IPs without having to check each and every PC for custom HOSTS.

      This is why one of my clients is such a pain to deal with; we could rearchitect the network into something less painful, but each developer seems to think its a good idea to ignore DNS and directly refer to server IPs. Which is great, up until those IPs change.

    6. Re:Another reason to skip Windows 8 by SEE · · Score: 1

      Ballmer took over as CEO, and Microsoft released Windows Me nine months later which was actively stupid.

      Me was followed with XP, which was not actively stupid.

      XP was followed by Vista, which was actively stupid.

      Vista was followed by 7, which was not actively stupid.

      7 is being followed by 8. Hey, guess what? It's Actively Stupid's turn again.

    7. Re:Another reason to skip Windows 8 by Geeky · · Score: 1

      It's only my laptop, and I'm expected to know what I'm doing - if I break something, I'm expected to fix it. When it comes to reprovisioning, the IT admins just re-image from a master copy so they don't care in the slightest what I've been doing.

      --
      Sigs are so 1990s. No way would I be seen dead with one.
    8. Re:Another reason to skip Windows 8 by LordLimecat · · Score: 1

      It's only my laptop, and I'm expected to know what I'm doing

      Now imagine I have to coordinate with 30 other users with the same attitudes, and different hosts files on each, and you will begin to understand why this is a manageability nightmare.

      Its not that you dont know what youre doing, and Im not saying that. There is just no easy way in that scenario for me to reprovision a server IP without tons of manual labor, and reimaging a dev laptop for a DNS change sounds like an enormously bad idea ("where did all my source code go?").

  13. Re:was going to buy, not interested now by NemosomeN · · Score: 1

    Is anyone seriously this flaky? If you decided not to buy because of this, you were likely to change your mind later when you saw am ugly cursor or renamed mspaint or some other nonsense.

    --
    I hate grammar Nazi's.
  14. Not a problem by Todd+Knarr · · Score: 1

    Not a problem on my LAN. Those hosts are blocked in the main DNS server. And don't even bother trying to bypass DHCP DNS assignment. My firewall rules don't forward destination port 53 packets to the WAN interface. You either use my DNS server or you get ICMP administratively-prohibited errors. Problem solved. Next!

    1. Re:Not a problem by SuricouRaven · · Score: 1

      I use a squid proxy with a blacklist of ad-servers. It worked great, until about two weeks ago when I noticed the sudden return of ads. On further investigation, it turned out that some of the ad-networks had switched to HTTPS, which doesn't get proxied. So I had to configure bind with a bodgey DNS block too.

      The really annoying thing is that sooner or later one of those ad networks will forget to renew their cert and everyone visiting a webpage with one of their ads will get a 'untrusted certificate' message.

    2. Re:Not a problem by omnichad · · Score: 1

      Not bulletproof. I could just use ssh port forwarding to connect to my DNS server through a shell account?

  15. Not only windows 8 by Anonymous Coward · · Score: 1

    Just tried it on XP and 7 with MSE. MSE removes ad.doubleclick.net from the read only HOSTS file. So it's not just windows 8.

    1. Re:Not only windows 8 by sideslash · · Score: 1

      Indeed. It is interesting that some people on one hand complain about how malware-prone Windows is for non power users, and simultaneously complain whenever Microsoft takes a step to obstruct an attack vector. If you're a power user, you will be able to work around your antivirus's blocking of obvious hacks in your HOSTS file (and yes, it is a hack, even if you're doing it to block facebook for yourself).

    2. Re:Not only windows 8 by Alioth · · Score: 1

      It's not interesting at all. There is more than one person, so the fact that one person may complain that Windows is malware prone for non power users might - just might - not be the same person who is complaining when Microsoft obstructs an attack vector. It is not at all surprising that in a large group of people, there may be differing and even conflicting opinions on a subject.

    3. Re:Not only windows 8 by alexo · · Score: 1

      Does it happen if you add a DENY permission to the account MSE runs under to the file's security list?

  16. Hamhandedness. by khasim · · Score: 5, Insightful

    If you are an enterprise IT manager this is your dream come true.

    Hardly. At the enterprise level there are multiple different ways of handling situations such as this. Which one(s) you choose depends upon how you've organized Active Directory and your network.

    But a different point is that this is an OLD way of phishing. The phisher is publishing the IP addresses that need to be blocked. So, again, at the enterprise level this kind of phishing would not be an issue.

    If a phisher really needed to redirect traffic like that he'd have an easier time just getting the information in the local machine's DNS cache. That way it would never show up in the hosts file which means that it would be that much harder to spot. Then just keep updating the DNS cache.

    So this is the wrong solution to the wrong problem and it is implemented in the wrong way. And it will probably cause more issues in the future as 3rd party developers have to work around not having the hosts file as a reliable option any more.

    Nice way to remove a useful tool that's been around for decades.

  17. Re:The internet (or networks) are more than the we by vux984 · · Score: 1

    The main problem I see is

    That you didn't read the article and have no idea what you are talking about?

    ... host file distribution is popular.

    And it will still work, so what is the main problem you see again?

  18. Mutually incompatible options by LocalH · · Score: 4, Informative

    The option on one end is to allow the user to have full, unfettered access to everything on their system, from the highest levels down to the lowest. This was done back in the DOS and Win9x days, and although it does have a few benefits in certain niches, it's also very bad for security.

    The option on the other end is to disallow access to modifying the underlying system and related settings, and only allow such actions from full administrator accounts, and maybe not even then (depending on the mindset of the development team). This pisses off a lot of the hardcore techies who like to modify everything they can, but to be fair it does help protect the average user.

    Now, I'm not defending Microsoft on how they've implemented this silently and without notification to the user, but on the face of it I think it's a good idea for the average user, at least with regards to the Facebook part of it (not so much on the Doubleclick part). Think about it - the average non-techie person wants Facebook to work. They will want to get their notifications on the Start screen (and elsewhere).

    I agree with other posters - they should have openly done this and notified the user before "fixing" it - something like "Your hosts file has been modified to prevent access to <site on this list>. Is this desirable to you?" with three options - "Yes", "No", "More information". That way, the techies can click "Yes" and go about their business, average users can click "More information" and maybe actually learn a little bit in the process, then come back and click "Yes" or "No" as per their wishes.

    As with many things, the idea is sound, but the implementation is not. To those saying "well, malware wouldn't redirect to localhost, it'd redirect to a false Facebook", there's nothing stopping a piece of malware from being written that is similar to the existing rogue security software, but that also uses hosts to block access to various social media sites, in an attempt to give the uneducated user further reason to believe they're truly infected as bad as the rogue software tells them they are, and also as a weak attempt to prevent the user from going online and telling people about it even after the rogue software has been removed. They'll do anything to get a few more successful purchases of their crap software. I'm quite surprised they haven't really done this already, to be honest.

    --
    FC Closer
    1. Re:Mutually incompatible options by cbiltcliffe · · Score: 1

      There is malware that uses the hosts file to block access to update sites for all the major antivirus programs, which isn't really much different to what you're proposing.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    2. Re:Mutually incompatible options by humanrev · · Score: 1

      I agree with other posters - they should have openly done this and notified the user before "fixing" it - something like "Your hosts file has been modified to prevent access to . Is this desirable to you?" with three options - "Yes", "No", "More information". That way, the techies can click "Yes" and go about their business, average users can click "More information" and maybe actually learn a little bit in the process, then come back and click "Yes" or "No" as per their wishes.

      You really think users will bother to click on "More information" and actually read that stuff? "Yes" "Yes" "Yes" is going to be the only thing they see and click, and possibly for some more paranoid people "No". But never "More information" unless you actually like computers.

      UAC is enough evidence to show that people will click the confirmation option in any window no matter what it says, just to get the damn thing to disappear. I don't agree with it but I understand why people do it.

      --
      Most people on Slashdot are fucking idiots.
    3. Re:Mutually incompatible options by omnichad · · Score: 1

      OK, then make it like IE9's new download window for apps that haven't been digitally signed. Your choices are more like "No," "More Information" and a tiny link that says Other Options, that lets you choose Yes.

  19. Re:The internet (or networks) are more than the we by nurb432 · · Score: 1

    For the average joe the web is all that matters. Its web + buying stuff they can either have sent to their house ( ebay, amazon ) or watch ( netflix, etc ) + social networking...

    --
    ---- Booth was a patriot ----
  20. If all you're trying to do is block by jader3rd · · Score: 1

    If all you're trying to do is block ad sites, and you're willing to do it on a system wide scale, use a firewall. Set a bunch of outbound rules to block certain address. It works, the settings will survive OS upgrades, and Windows 8 won't undo the settings on your behalf.

  21. Not user friendly, hostile by frovingslosh · · Score: 4, Insightful

    From the article, Two of the sites that you can’t block using the hosts file are facebook.com and ad.doubleclick.net

    I started using the hosts file over a decade ago, when I traced crashes that I was having to doubleclick.net. Ad supported software that I was using was receiving files from them, but it was doing a lot more than just displaying the ads (which I would not have objected to). Many users were experiencing this, but the author would not fix it so I and others started blocking the site (which resolved the problem, although the author lost some small amount of revenue).

    More recently I have also started blocking facebook. I never use it, have no account there, but I've noticed an awful lot of network traffic going to and from my site with facebook.com. I'm not even a member, so I don't feel the need for them to track most of the sites that I visit. The hosts file has so far worked very well for this.

    And argument that this feature is in any way for the benefit of the clueless user is bogus. The common way to block a site via the hosts file is to equate it to the IP address 127.0.0.1, which is the local machine. If Microsoft were doing this for the benefit of their users then they would simply look at the hosts file and, if they found redirects for sites that they were concerned about that were not pointed to the local machine, they might well conclude that it was potentially an attempt to hijack a domain name and then, after warning the user (and even asking him) correct the problem. This would even show the user that Microsoft was doing something good for the user for a change. But if the address is redirected to the local machine, the only reasonable conclusion that I can see is that the user wanted it that way (as it provides no attack vector). It took me about 30 seconds to realize that changing 127.0.0.1 redirects was user unfriendly and could easily be avoided if Microsoft were really concerned about their users who paid for the software. They just have to look at the IP address that the hosts file contains and if it is 127.0.0.1 then allow it to stay! Clearly Microsoft realized this too. The only reasonable conclusion is that they are doing this because they have a motive that is against customers interests.

    --
    I'm an American. I love this country and the freedoms that we used to have.
    1. Re:Not user friendly, hostile by frovingslosh · · Score: 1

      Bovine waste! If MS were even thinking that, they could easily detect such a server and warn the user about it. Besides, they are apparently detecting some URLs in the hosts file and "fixing" them, without even warning the user that the "fix" was needed. Since they are not detecting all URLs and any attacker who wrote to the hosts file is likely to have added more than one or two bad entries, some undetected hosts entries would still get through. It would be better to not even use the hosts file, it would be a lot safer than going to all the effort to mess with what the user put in there. Clearly this isn't for the users sake.

      --
      I'm an American. I love this country and the freedoms that we used to have.
    2. Re:Not user friendly, hostile by cbiltcliffe · · Score: 2

      Assuming that all redirects to localhost are user-specified is all well and good, until you figure out that some malware makes the hosts file looks like this:

      update.symantec.com 127.0.0.1
      update.trendmicro.com 127.0.0.1
      update.mcafee.com 127.0.0.1
      update.microsoft.com 127.0.0.1

      Not that I consider this a good move by Microsoft, by any means, but implying that the situation is as simple as you're making it out to be is dangerous.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    3. Re:Not user friendly, hostile by tepples · · Score: 1

      If you want to block all traffic, you can blackhole the complete domain with a single line in your DNS server.

      Which would require running a DNS server on a machine that is turned on whenever web clients on the same network are turned on.

  22. redmond should... by crutchy · · Score: 1

    ...just rip off iptables and be done with it already... wtf is this "protecting the hosts file" bullshit (pointless if root/admin priveliges are required to modify it in the first place)? ...and haven't they yet realised that "windows defender" is an oxymoron?

    1. Re:redmond should... by omnichad · · Score: 1

      A linux machine with iptables has a hosts file too. If anyone were targeting desktop linux with a virus, they can still modify the hosts file (assuming they find a privilege escalation bug to get them that far).

    2. Re:redmond should... by crutchy · · Score: 1

      assuming they find a privilege escalation bug to get them that far

      that's sort of what i was getting at... they patch and bolt things on that they hope will improve security, but privelige escalation is the root cause of the problem... linux doesn't need protection for the hosts file because most programs just can't write to it (file permissions are the security measure, and they work), but i'm pretty sure most linux servers are protected from interweb nasties using iptables rather than hosts... the only thing i use hosts for is to access the web server on my lan because my router doesn't have loopback

      i guess microsoft would probably still botch iptables up as well... if malware can overwrite hosts it can overwrite an iptables script too, as well as pretty much anything else on the system... yeah they should really improve filesystem permissions to actually protect system files rather than just as a gimmick (ACLs)

    3. Re:redmond should... by omnichad · · Score: 1

      My point is that privilege escalation bugs are found in Linux or Linux modules all the time (esp. the commercial Nvidia drivers).

      Windows' hosts file is just as protected as the Linux hosts file. Even if Windows had iptables, it would still have hosts, and hosts is an attack vector on Linux and Windows both.

    4. Re:redmond should... by crutchy · · Score: 1

      privilege escalation bugs are found in Linux or Linux modules all the time

      care to share a few (not even sarcastic here)... i came across the nvidia one through a google search, but i'm interested what other ones there are (please keep them reasonably current, maybe in the last 4 years)

      is there a wikipedia page?

      http://en.wikipedia.org/wiki/Privilege_escalation#Examples_of_vertical_privilege_escalation mentions a vulnerability using cron... not sure how old that exploit would be

    5. Re:redmond should... by omnichad · · Score: 1

      I don't have them. I don't even use desktop linux regularly. But I'm sure it's at least as rare as similar bugs in Windows 7, if not more rare. Most cases of root-required viruses on Windows are let in by the user explicitly. The difference is more in the user than the OS, and the target audience size.

    6. Re:redmond should... by crutchy · · Score: 1

      yeah i never liked the stupid...

      "the program you're trying to install wants to pwn your machine... just click yes without even reading this and don't worry about security if it allows the program to install"

      ...popups from vista onwards

  23. The answer is simple enough by __aaqvdr516 · · Score: 4, Insightful

    The answer is simple enough:
    If you're already smart enough to edit the hosts file, you should be smart enough to add hosts to Windows Defender exclusion list.

    Is this a change from the way that things were done in the past? Of course it is. This is how systems become more secure for the average user. Average Joe isn't messing with hosts.

    Chicken Little, the sky is not falling.

  24. Re:Thank-You, & here's a challenge I always ma by LordLimecat · · Score: 2

    Advantages over "other things"? Two words:

    Firewall entries.

    More flexible, centrally maintained, more granular, more reliable, and not prone to user tampering. Yea, how horrible.

  25. Nope by Fujisawa+Sensei · · Score: 1

    Still not a reason to switch to Ubuntu. Especially with the new tablet optimized desktop.

    --
    If someone is passing you on the right, you are an asshole for driving in the wrong lane.
    1. Re:Nope by rrohbeck · · Score: 1

      Looks like you never heard of Xubuntu, Kubuntu or Lubuntu, let alone Gnobuntu (although I don't know if that works yet.)

    2. Re:Nope by Threni · · Score: 1

      Linux Mint LXDE/XFCE. Ubuntu, but without the nonsense.

    3. Re:Nope by Fujisawa+Sensei · · Score: 1

      I specifically stated Ubuntu, and not the others.

      I spent more than a year on Kubuntu and was never happy with it. And I still use Ubuntu everyday as well. At least I can install the KDE apps I want.

      For other systems I switched to OpenSUSE more than a year ago and life is very good. Personally I have no use for the *buntu family.

      --
      If someone is passing you on the right, you are an asshole for driving in the wrong lane.
  26. Re:The internet (or networks) are more than the we by xlsior · · Score: 1

    As is forcing people to use/memorize ip addresses

    Which is not even an option for shared hosting setups - you can literally have thousands of websites sharing a single IP after all.

  27. I hope you're not in IT security. by Anonymous Coward · · Score: 1

    Here are a few words I want you to consider:

    Defence
    In
    Depth.

    What do you think that means?

    It means that you have multiple layers of defence. Your PC should not be infected by another PC on your network or off, nor should it contribute to infection. Your router to that PC should not be infected by another PC on your network or off, nor should it contribute to infection. Similarly for your firewall and DMZ.

    If you're not using HOSTS file why is the OS looking at the HOSTS file for ANYTHING???

    Really. If you can't trust that file to be correct, then the OS shouldn't decide for you that it is correct.

  28. They aren't getting rid of the hosts file. by Anonymous Coward · · Score: 1

    If they were, then there would be no use of the hosts file by the OS to look up things.

    Now if you set it, but the machine gets infected, the OS can be made, despite your lockdown, a change to that hosts file and screw up the scenario you thought you were protecting.

    If this were about getting rid of the hosts file, why is the OS still looking at it and even changing it?

  29. on what planet? by frovingslosh · · Score: 2

    On what planet does it make sense to change entries in a file on the system and not even warn the user that you are doing so? And since they are reportedly making the changes selectively, then if there were really an attacker his attack could have made other changes, but the user was never warned that the host file had anything "suspicious" in it and so would not be aware to even look at it and see if there was anything that the Great and Powerful Microsoft had missed. This isn't for the user, it is purely for MS's own interests.

    --
    I'm an American. I love this country and the freedoms that we used to have.
  30. Reason number 189 by Anonymous Coward · · Score: 1

    To not buy windows 8 and just stick with windows 7.

    1. Re:Reason number 189 by PPH · · Score: 1

      Even if you don't buy Windows 8, Microsoft will go into your credit card records and change the entry to reflect a purchase.

      --
      Have gnu, will travel.
    2. Re:Reason number 189 by BradleyUffner · · Score: 1

      To not buy windows 8 and just stick with windows 7.

      Windows 7 , and even Vista do it too if you have Defender turned on. It isn't a function of the OS, but of Windows Defender.

  31. Malware. by Deathlizard · · Score: 4, Insightful

    the Hosts file is targeted my malware to redirect to malicious sites and to keep under the radar to infect systems after they have been clean. (or even to a locally hosted proxy to infect sites like Facebook) Personally, I've seen facebook and myspace targeted in it. Never seen doubleclick but my guess is doubleclick is a target so that they can redirect to their own profit generating ads, or more malware to attempt to extort money out of people.

    My guess is that the sites defender removes from hosts are sites that have been targeted by malware in the past. Frankly, I'd like to see the list of domains it looks for, but I'm sure that I woudn't want any of them redirected to some scumware site trying to pawn off fake antivirus.

    1. Re:Malware. by Lumpy · · Score: 1

      And we have had an underwear bomber, should we require people to not wear underwear on airplanes?

      MSFT is doing the stupid trick of being reactive instead of proactive once again.

      --
      Do not look at laser with remaining good eye.
  32. I NEED that hosts file by humanrev · · Score: 1

    Well, need is subjective. But I like to play Doom 3 every so often (particularly with mods like The Dark Mod, a great Thief clone), and the hosts file is something of a necessity. For those who don't know, Doom 3 originally had old-school CD copy protection (i.e. need the disc in the drive when launching the game). The final patch removed that requirement, but changed it so that the game will attempt to authenticate the serial key against a master key server run by id/Activision. If the key fails (in use by someone else and/or a blacklisted key), the game won't run.

    A few years ago I discovered the game thinks my legit serial key is in use/dodgy for some reason, which put me in a bit of a pickle. Fortunately, I discovered that if I put in a particular domain to redirect to 127.0.0.1 in my system hosts file (and this works for both Windows and Linux), the game won't be able to connect to the key server and will simply assume the key is OK and continue. I could have gotten a crack I suppose but I don't want to have to rely on cracks which may or may not have side-effects, plus I doubt one would exist for Linux anyway.

    Side note: This is one thing I like about this authentication system in old games like this- if it can't verify your key/access, the game gives the player the benefit of the doubt and keeps working. Hence if the game is played when the Internet is down, or the key server disappears, the game will continue to work. Not like modern commercial games.

    --
    Most people on Slashdot are fucking idiots.
    1. Re:I NEED that hosts file by jonwil · · Score: 1

      Given that Doom 3 is now open source (thanks ID) you could always modify it and remove the check against this key server. No need to modify the hosts file then...

    2. Re:I NEED that hosts file by humanrev · · Score: 1

      Good point. I'm tempted to wait for the first release of iodoom3 though before I do that, mainly because of all the backend improvements it's likely to have (though they've already specified in an FAQ that the key check won't be removed).

      --
      Most people on Slashdot are fucking idiots.
  33. We dealt with a lot of stuff like this in windows7 by Karmashock · · Score: 1

    Solution was to dive into the registry and turn lots and lots of things off.

    Sites that offer up AIO registry hack packs for windows should be more common.

    I would totally pay for it. My time is worth enough that just getting a giant pack that has everything nicely labeled and organized would be worth a mint.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  34. Evene if it is windows defender it is bad by aepervius · · Score: 2

    If one redirect a site to 127.0.0.1 from the aforementionned double click, chance that it is a malware is nil. Before removing the entry windows defender should check the IP and leave it for those site at 127.0.0.1. OTOH if it is an anti virus site it should remove it if it is precisely 127.0.0.1. If they went the extra way to check for some specific web site, then they should have done the extra way and check for the IP. Or make a pop up windows warning of the behavior and how to stop it.

    --
    C. Sagan : A demon haunted world:
    http://www.amazon.com/gp/product/0345409469/
    visit randi.org
    1. Re:Evene if it is windows defender it is bad by thogard · · Score: 1

      127.0.0.1 is bad for that because if malware sets up a local proxy, it will be on that address. 0.0.0.0 also won't work but 127.0.0.0 might provide the desired effect since its in the local hardware route table with nothing listening so it fails quickly.

    2. Re:Evene if it is windows defender it is bad by IAmR007 · · Score: 1

      What's wrong with using 0.0.0.0? It's defined in ipv4 to designate an invalid IP, and unlike 127.0.0.0/8 addresses, it won't hit local web servers or have to wait to time out.

    3. Re:Evene if it is windows defender it is bad by rastos1 · · Score: 1

      If one redirect a site to 127.0.0.1 ...

      I redirect to 127.0.0.2 you insensitive clod!

      Interestingly RDP won't connect to 'localhost'. In Win7 it won't connect to 127.0.0.1 either. But it will connect to 127.0.0.2.

  35. Re:Non-issue by cbiltcliffe · · Score: 1

    Readers with actual reading comprehension would be a good thing, too.
    From what I've read, it doesn't complain when you actually edit the hosts file, but rather when you visit some specific websites that are listed in the hosts file.

    By the sounds of this, turning of any A/V software during the edit wouldn't help at all, because it isn't that it blocks the save of the edited file, it's that it deletes the individual line for the blocked site you're currently wanting to visit.

    --
    "City hall" in German is "Rathaus" Kinda explains a few things......
  36. Re:chattr +i /etc/hosts by cbiltcliffe · · Score: 1

    See, this is why idiots will always be prone to infection, regardless of what operating system they use: because they don't understand security for shit.

    Think about it: if a process has permission to write to the hosts file, it can also remove the immutable bit in the filesystem attributes.

    --
    "City hall" in German is "Rathaus" Kinda explains a few things......
  37. Re:The internet (or networks) are more than the we by gweihir · · Score: 1

    The "Airgap" meme is still around? Surprises me as it is basically a direct lie. Best implementation I saw was a wireless link combined with a firewall, i.e. reasl, physical and completely meaningless air-gap.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  38. particularly update.microsoft.com by frovingslosh · · Score: 1

    Considering that the only time that software ever deliberately damaged my system (and actually managed to damage my firmware) it was from update.microsoft.com, I wouldn't be so fast to assume that if you frond that URL blocked, that it wasn't intentional on the part of the user..

    --
    I'm an American. I love this country and the freedoms that we used to have.
  39. Is for advertising or piracy? by mimicoctopus · · Score: 1

    A lot of cracks rely on changing the host file to prevent activation / phone home. Maybe this has something to do with Microsoft's decision.

  40. Common hosts file use by mycroft16 · · Score: 1

    Piracy. Using the hosts file to block calls from installers out to verification servers is pretty common. This would effectively end that method for circumvention.

    1. Re:Common hosts file use by allo · · Score: 1

      Piracy. Using the hosts file to block calls from installers out to verification servers is pretty common.

      [citation needed]

    2. Re:Common hosts file use by xenobyte · · Score: 1

      Piracy. Using the hosts file to block calls from installers out to verification servers is pretty common. This would effectively end that method for circumvention.

      No it wouldn't. People that are using cracks would know how to stop Defender (or not use it altogether).

      Besides, it is widely known that you cannot stop piracy using dumb technical means. No DRM or Copy Protection truly works and all have been cracked, broken or circumvented.

      --
      "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
  41. Re:Noise... by hairyfeet · · Score: 1

    Uhhh...he GAVE you an example, his shop floor manufacturing software requires it, end of story. Anybody who has worked with SMBs knows you end up with a ton of niche software that can have some crazy requirements, hell I've had to build a DOS 3 box in 2008 because a shop had a $150k lathe that required a PC with an ISA slot running DOS 3 to use the unit.

    In the end frankly it shouldn't matter WHY he is using it, what should matter is MSFT is taking choice away from you yet again with no real gains. If MSFT thinks its a malware vector? Then let the use of HOSTS be set by GPO using local access. that way those that actually need it can enable it and those that don't use it will have it off by default. Frankly more and more MSFT is reminding me of a bad Apple ripoff with their "our way or the highway" attitude on everything, but unlike Apple their biggest customers aren't consumers, its businesses who are more likely to have the weird corner cases that this will cause headaches for.

    --
    ACs don't waste your time replying, your posts are never seen by me.
  42. Re:Caveat Emptor by Kalriath · · Score: 1

    File Access has been a shattered illusion since I came to understand that any user account to which assigned administrative privileges was still kept from accessing certain files for lack of sufficient 'privilege' regardless of what I attempted to do to circumvent Microsoft's control or that of their partners.

    This is pure bullshit. Even files for which you have no access (on a bog-standard Windows install this is the SAM and the System Volume Information folder, the first of which is the Security Accounts database and is only unreadable because Windows holds it open for exclusive read - for good reason, and the second is the container for system information for which you'd have no interest, such as restore point data), you can take ownership of the files and then just go right ahead and do whatever you want. If an application removes your ability to access a file, then that's a problem with the application not Windows.

    --
    For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
  43. Re:Addendum to 1st reply to you: TROY! by crutchy · · Score: 1

    is that you bill o'rielly?

  44. Re:Real solution to PC Security? Layered! by crutchy · · Score: 1

    you wrote the book on how to be a homo

  45. It's a security improvement. by mysidia · · Score: 1

    The HOSTS file is not for blocking things; it is for optionally providing an alternative way of looking up some local names besides using DNS, in an enterprise network with what is today called a local intranet. It has fallen into disuse, mostly exists for legacy reasons; maintaining HOSTS files across machines in a network is inefficient; maintaining a local DNS service is normally the more appropriate strategy, and blacklisting can be implemented on the Enterprise's DNS service.

    A perfectly appropriate firewalling mechanism exists in Windows called Windows Firewall with Advanced Security; which allows you to set an outbound firewall rule to block opening all connections to a specified server. This is safer than HOSTS file, because it simply blocks the address, without tampering DNS lookup results, and enabling a site to be repointed to a phishing site..

    HOSTS file is commonly abused or misused for nefarious purposes; its use for any purpose is strongly discouraged, and has been unsupported for a long time. It would be no surprise to see the DNS resolver of a future version of Windows drop HOSTS file functionality entirely, and move towards Group policy configuration, or Administrator registry configuration for any 'manual local names'.

    HOSTS file use as a mechanism for blocking or 'firewalling' things is also unsupported. The HOSTS file is not a firewall, and the HOSTS it not a DNS access control mechanism. It's still perfectly legitimate for a DNS resolver to attempt lookup via the DNS as a failover strategy, if the entry in the HOSTS file seems bad or non-responsive. Browsers may do this; browsers may even bypass the HOSTS file entirely, because it is commonly abused by malware.

    Malware and Adware commonly mess with this file to hijack users' browser by creating false host entries for common websites to point them to malware author-controlled domains.

    Disabling the ability to silently do this on consumer-targeted OSes improves security. This security feature/change is appropriate for end-user systems that are not part of a large enterprise intranet with unusual requirements necessitating local resolver entries.

    If the site is intended to be blocked or "legitimately" hijacked/misdirected; enterprises have more appropriate, more scalable means of implementing this; such as DNS server based blacklisting, and configurations on edge firewalls.

  46. Re:chattr +i /etc/hosts by crutchy · · Score: 1

    if a process has permission to write to the hosts file

    that question is the problem with windows security in general...

    the answer is that unless it is required for windows to run, or unless the user logs in as administrator with a password that is at least 6 characters long and consciously executes such process, it shouldn't have such permission.... ever....... full stop

  47. Re:Noise... by Zontar+The+Mindless · · Score: 1

    It looks like you've responded to the wrong post, friend.

    --
    Il n'y a pas de Planet B.
  48. Re:You ac trolls are the ones running around by crutchy · · Score: 1

    i'm sorry i couldn't understand you with your mom's cock in your mouth

  49. Re:Ok - good: I love it (good man, but: See inside by LordLimecat · · Score: 1

    2.) Eats CPU cycles, RAM, & other forms of I/O

    Hosts file doesnt have to be loaded into RAM? Rejecting packets outright is more CPU intensive than trying to route to 0.0.0.0, having to do a route lookup, failing, and discarding the session? Hosts file doesnt incur I/O penalty?

    Dude, you are so far out there on this one, Im not sure you understand how quick your average firewall can drop a session compared to relying on a crappy HOSTS file redirect to 0.0.0.0.

    Hell, look up rootkit.com, & see their article on "Windows Firewall" Vista onwards being EASIER to "unhook".

    When I spoke of a "centrally managed firewall", that is most emphatically not the Windows Firewall. Cisco, Sonicwall, pfSense, ipTables, take your pick, all of them are zillions of times better than Hosts:
    1) faster
    2) easier to maintain
    3) has built in logging
    4) user cant bypass or tamper, even with escalation exploit
    5) less prone to breakage
    6) can filter by protocol, hostname, and port, not just IP

    But you know what? Keep pushing hosts files as a viable business solution, Im sure youll get lots of business doing so.

  50. Doubleclick Is Google! by martin-boundary · · Score: 1

    Doubleclick is Google. This is probably just Microsoft trying to brown-nose its way with them...

  51. Unknown IP address? by Errol+backfiring · · Score: 1

    I certainly don't want it redirected to some other unknown IP address!

    There's no place like 127.0.0.1. It's hardly an unknown IP address

    --
    Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
  52. Re:Noise... by jones_supa · · Score: 1

    No, I believe he did reply to the correct one. If you click the Parent link in his post, you can see. However the problem here is that for some reason Slashdot hides some messages sometimes. I myself see this message above his, when I'm in the main thread view.

  53. typo in summary by maestroX · · Score: 1

    The hosts file is a popular, cross-platform way of blocking access to certain domains, such as adobe-serving websites.

  54. Re:Quit "projecting" already, "CruTcHy" by crutchy · · Score: 1

    retard

  55. Re:You're a tool. by Kalriath · · Score: 1

    No, fuck you. The majority of the stuff in Linux distributions is not GNU. There are various GNU toolchain items, yes. There's also some BSD toolchain items, a metric fuckton of non-GNU items (the entire GUI subsystem for a start).

    And perhaps as important, or even more so, is that the GNU toolchain is useless without a kernel such as Linux, but Linux still retains its usefulness without GNU. So how you can claim that not only is it vitally important that we recognise the GNU components as part of the OS name, but also that we recognise it as the most important part of the OS by including the name GNU first frankly boggles the mind. GNU is not an operating system, and nor is GNU/Linux. If we're required to include the GNU in the name then the system really has to include the name of every major component. So BSD/GNU/X11/.../Linux.

    Moronic fuckwit.

    --
    For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
  56. Old news by jowifi · · Score: 1

    This has apparently been known about a for while in some developer communities. The first result in a Bing search for "windows 8 hosts file" returns a MSDN post from Sept 2011 identifying the problem.

  57. hosts is a firewall rule by tepples · · Score: 1

    a niche of geeks who seem to think it somehow superior to firewall rules

    An entry in a hosts file is a firewall rule. The advantage of a hosts file is that one doesn't need to install extra firewall software. And even if you do install external software, it can still use the widely understood input format of a hosts file.

    or adblock lists

    Adblock is fine for your web browser, but what can you use to block access from applications other than a web browser? You need a firewall, and one that operates at the DNS level is built into your operating system: the hosts file.

    DEY

  58. Version control by tepples · · Score: 1

    reimaging a dev laptop for a DNS change sounds like an enormously bad idea ("where did all my source code go?")

    All you need to do is check it out again, you silly git.

    1. Re:Version control by LordLimecat · · Score: 1

      Well played.

  59. The like button by tepples · · Score: 1

    I don't have a Facebook account; I graduated and lost my .edu address before Facebook even existed. And I don't want Facebook's like button code to slow page loads while building a dossier on me any more than it already has. Other than using a hosts file or installing a DNS server on localhost, what do you recommend for blocking web sites from loading the like button?

    1. Re:The like button by vux984 · · Score: 1

      I don't have one either, and probably despise facebook even more than you.

      For blocking facebook, it doesn't get much simpler than a dedicated plugin like: (although I haven't used it myself)
      http://webgraph.com/resources/facebookblocker/

      Adding a custom filter rule or two to a more generic plug in like adblock pro or any of several site blockers is another option.

      And for blocking in general system-wide, a suitable firewall and/or a filtering proxy server.

    2. Re:The like button by tepples · · Score: 1

      For blocking facebook, it doesn't get much simpler than a dedicated plugin

      ...which doesn't list any support for Internet Explorer or applications that embed Internet Explorer.

      And for blocking in general system-wide, a suitable firewall and/or a filtering proxy server.

      The advantage of a hosts file is that it acts as a system-wide DNS filter no matter what application embeds a browser component, and it doesn't require researching and installing a third-party firewall. Or has Microsoft already begun to include such "a suitable firewall" with Windows?

      DEY

    3. Re:The like button by vux984 · · Score: 1

      ...which doesn't list any support for Internet Explorer

      So don't use internet explorer. If you can figure out how to edit your hosts file you can figure out how to use an an alternate browser.

      or applications that embed Internet Explorer.

      Who browses the web from the cheque layout editor in their accounting software?

      You are right, of course, and my example was a bit tongue in cheek, but while I use several apps that embed IE for help, documention, etc... I've never had any cause to use any of them to browse the web. I'm not convinced its a legitimate issue.

      The advantage of a hosts file is that it acts as a system-wide DNS filter no matter what application embeds a browser component,

      Agreed. But if you want a DNS filter - get a dns filter. Using hosts to manually block hosts one at a time by redirecting the queries back to your own system is about the clumsiest way of doing it.

      A proper dns filter has logging (so you can see what's going on, filters with wildcards so you don't need www.facebook.com, facebook.com, login.facebook.com, and anything else they might add in the future)

      and it doesn't require researching and installing a third-party firewall.

      Right, it requires researching and editing a text file deep within the windows folder.

      So ... you rejected the option of running an alternative browser (you said "but it doesn't work in Internet Explorer") and at the same time you embrace editting the hosts file. Exactly what sort of user is this? One that can't download firefox, but can edit the hosts file??

      Or has Microsoft already begun to include such "a suitable firewall" with Windows?

      It is actually very easy to add a custom blocking rule to the facebook ip addresses. But that is not a DNS filter.

  60. Media production appliance by tepples · · Score: 1

    So what will people use as a media production appliance?

  61. Outbound rules by tepples · · Score: 1

    use a firewall

    Hosts is a DNS-level firewall already built into your operating system.

    Set a bunch of outbound rules to block certain address

    Which works until the hostname starts pointing at a different IP address. Round-robin DNS tends to do this. A hosts file, on the other hand, maps all requests associated with a given hostname to an invalid address. It acts in effect as a hostname-based outbound rule set.

    DEY

  62. Re:Disprove my points in favor of hosts files then by TCM · · Score: 1

    Sorry I don't read at -1.

    --
    Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
  63. Re:Ever heard of gpedit.msc, TCM? by TCM · · Score: 1

    Sure, get your forum users to join your AD first. Call me when you've succeeded. /facepalm

    I can see why all of your posts end up at -1. Lunacy at its best.

    --
    Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
  64. Re:What's this about "cocksucking douche"? by cbiltcliffe · · Score: 1

    That comment wasn't a "random, flailing, insult-hurling rant."

    It was quite directed, and to the point. It was also true.

    This tirade of yours, on the other hand:
    http://slashdot.org/comments.pl?sid=3058625&cid=41051235
    was random, flailing, and somewhat nonsensical.

    I can only think the fact that you immediately jump in to any thread even remotely mentioning "APK" with huge, rambling tomes of crap spouting about how superior you are to virtually everyone in the entire history of computer technology, means that you are, in fact, deeply insecure, unsure of yourself, and require validation from others to improve your pitiful view of yourself, so use a massive, over the top superiority complex to attempt to do this.

    I'm pretty sure a few counselling sessions would help you with that, unless, of course, you attempt to prove how much better you are than the counsellor, and they end up kicking you out for being....well....yourself.

    And if counselling doesn't work, then there's always SIG.....

    --
    "City hall" in German is "Rathaus" Kinda explains a few things......
  65. Re:Back to the topic & reality 'CruTcHy' (lol) by crutchy · · Score: 1

    moron

    and real programmers use iptables scripts, not hosts... moron

  66. Re:Back to reality & the topic, cbiltcliffe by cbiltcliffe · · Score: 1

    Tell me, why is it that you feel the need to reply twice to virtually every single post directed at you? Do you go on frantic Google searches trying to find ammo for your hopeless arguments?

    Ok....here's a response to one of your points:

    You claim blocking sites via a hosts file results in speed. That was your first point in the parent post to this one.

    Only one problem with that:
    A large hosts file will actually slow down the PC, resulting in...well....not speed.
    By the time you get all the ad servers, virus C&C servers, malware servers, drive by download servers, etc, all in there, it's going to be huge.

    From http://www.mvps.org/winhelp2002/hosts.htm:

    Editors Note: in most cases a large HOSTS file (over 135 kb) tends to slow down the machine.

    --
    "City hall" in German is "Rathaus" Kinda explains a few things......
  67. Re:Hahahaha @ 'CruTcHy' by crutchy · · Score: 1

    laughing at your own jokes... good one apk

  68. Re:Thank-You, it is... apk by crutchy · · Score: 2

    def reverse(s):
    try:
    trollstring = ""
    for apksays in s:
    trollstring = apksays + trollstring
    except:
    print("error/abend in reverse function")
    return trollstring
    s = ""
    print reverse(s)
    try:
    s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
    s = reverse(s)
    print(s)
    except Exception as e:
    print(e)

    ParseError: bad input on line5

    http://mathcs.holycross.edu/~kwalsh/python/

  69. Re:No err where it mattered vs. u 'CruTcHy' (lol) by crutchy · · Score: 1

    P.S.=> Additionally + Lastly: Like ALL my code? It works well... apk

    wasn't any error here where it mattered

    if you really were a programmer, you would know that it either compiles/interprets or it doesn't... there is no "where it matters"... tard

  70. Re:Was laughin @ u 'CruTcHy' by crutchy · · Score: 1

    and what is the topic? do you (ever) even know? you like nothing more than crapping on about custom hosts and open sores and all sorts of other unintelligible garbage

    yeah i know... i'm feeding the troll (smacks self)

  71. Re:Was laughin @ u 'CruTcHy' by crutchy · · Score: 1

    i wish i could have seen your face when you read this http://slashdot.org/comments.pl?sid=3058625&cid=41091833

    pwnage

  72. Re:No, 'CruTcHy' (lol): THIS, was "pwnage"... apk by crutchy · · Score: 1

    I always get the last laugh?

    you laugh at your own jokes and you're a troll... duh!

    P.S.=> Care to tell us what the "parse error" was, 'CruTcHy'? I doubt you even know, & the funniest part is, YOU caused it... lol!

    i don't care what it was... python is an ass of a language, and if i had caused the parse error you would have shared it already just to rub it in my face (not that i would give a toss even if you did), so you're full of shit... i make mistakes when i'm programming, but i'm not a self-proclaimed god like you make yourself out to be

    lol i so gotta stop feeding trolls

  73. Re:Ran JUST FINE vs. you here, 'CruTcHy' (lol) by crutchy · · Score: 1

    if it took you 15 minutes to come up with that garbage you aren't really proclaiming yourself to be that great at programming

    i have never programmed python before; my preferred langauges are delphi and php

    anyway, i may have pasted the code with no indents in my slashdot comment, but i pasted it verbatim into the interpreter from your comment (with indentations)... so while it may run in your interpreter, as you posted it in your comment (http://slashdot.org/comments.pl?sid=3058625&cid=41052117) the for loop statement (on line 5) isn't indented... hence the parse error

    error trapping is for runtime exceptions, not compile/interpret time parse errors

  74. Re:Ran JUST FINE vs. you here, 'CruTcHy' (lol) by crutchy · · Score: 1

    and if you want to reverse a string, here's a simpler example (not my code, but you being the expert you supposedly are surely could have come up with it yourself):

    s = 'abc'
    s = s[::-1]
    print s

    only took me about 30 seconds with agoogle search, no indenting required, and it works in the previously linked interpreter

  75. Re:No, 'CruTcHy' (lol): YOU started trolling... ap by crutchy · · Score: 1

    had a squiz at your hosts file program... most of us just use notepad or gedit, but whatever floats your boat... and 37+ Mb of memory!!! did you disable debug info in compile options (or directives)? either that or you just use one of the newer bloatware versions... i guess i'm just lucky i still use delphi 7.

    i develop mainly engineering software (flight test data analysis and structural code compliance, among others) for companies i've worked for using delphi and php... none public sorry

    refer to my other comment for the parse error (http://slashdot.org/comments.pl?sid=3058625&cid=41117989), since you asked

  76. Re:'CruTcHy': I know - print "troll bs here"[::-1] by crutchy · · Score: 1

    Hey, stupid? I knew that already

    the comment you link oesn't show anything about the indentation bug or a simpler way to code your string reversal... you were (before i highlighted it) completely ignorant of it (rotflmao!!!!), what is this "not really coding" bullshit... nice backpedal tard.

    you're an arrogant moron, and i caught you out on your code that you're so proud of.... hahahahahaha!!!!!!!!!!!

    P.S.=> Additionally + Lastly: Like ALL my code? It works well... apk

    lol yeah unless it has a bug that you need someone else to find.... BAHAHAHAHAHA!!!!!!

    apk... the self-proclaimed ruler of programming, that took a whole 15 minutes to write a pointless bit of jibberish just to reverse a string... caught out with a bug in his posted code... THAT HE COULDN'T FIND!!!!!! OMG HOW FOOLISH MUST HE FEEL NOW !!!!!!

    P.S.=> "Onwards, & UPWARDS"... I RULE!

    yeah... you rule your own vagina

  77. Re:No, 'CruTcHy' (lol): Great enough for it to wor by crutchy · · Score: 1

    i don't even use an IDE for my php apps... i use gedit, which is basically windows notepad except with syntax highlighting

  78. Re:'CruTcHy' - you blew it on the print statement by crutchy · · Score: 1

    the only ounce of sense i got from your entire comment was that data explains the memory usage... fair enough (i didn't realize there would be much need for large data stored in memory for something as simple as a hosts file generator... even if you're downloading from a http server or something, and if you have an open file handle for writing out you shouldn't need to store the entire hosts file content in memory)

    maybe look at how you're storing the data... maybe use packed records. i can process gigabytes of flight test data without using much memory (data comes in, gets processed, and gets written out)

    and why the hell would you need a 64-bit program to generate hosts files? sounds like a bit of a dick waving stunt to me.... not surprising for you

  79. Re:Are you blind? by crutchy · · Score: 1

    why would i even bother with the interpreter unless i suspected a bug.... FOOL!!!!

    i found a bug in your posted code that you thought was perfect.... and YOU CAN'T STAND IT... HAHAHAHAHAHAHAHAHAHA!!!!!!!!!!!!

    i'm happy now.... cheers fuckface

  80. Re:'CruTcHy' - now you steer clear of this? by crutchy · · Score: 1

    nobody but you gives a toss about a noob delphi program that creates a blacklist hosts file... even the form layout stinks of amateur

  81. Re:You don't get it, do you? by crutchy · · Score: 1

    python relies on left indentation... you didn't indent the print statement in the for loop in your posted code... i don't care if it worked in your interpreter... the fact is YOUR POSTED CODE HAD A BUG, and you couldn't find it before I did HAHAHAHAHAHAHAHAHA!!!!! suck shit dickwad... i wouldn't know but i imagine it sux to be pwned like you are right now

  82. Re:Security pros disagree... apk by crutchy · · Score: 1

    you can bullshit all you like.... you're pwned on the python script in two ways (first the indentation bug, which i found first, and second the complexity of something that should have been so simple, which highlights how much of a noob you are)

    hosts is useful, but no as much as a proper firewall like iptables, and a blacklist hosts will always be prone to any kind of zero day attack as much as anything else that relies on a blacklist

    you're an amateur freetard who likes to blow smoke out his ass as one of the most infamous slashdot trolls

  83. Re:/. formatting error (not I)... apk by crutchy · · Score: 1

    i found a bug in your posted code before you could and no amount of bitchslapping from you is going to change that fact... you're just going to have to live with it

  84. Re:You FAIL via your PARTIAL QUOTE by cbiltcliffe · · Score: 1

    Turning off the DNS cache doesn't eliminate the problem. It merely increases the size of the hosts file that can be used before the slowdown becomes noticeable.
    Yes, it needs to be a huge hosts file, but it's still going to be a problem.

    --
    "City hall" in German is "Rathaus" Kinda explains a few things......
  85. Re:"CruTcHy"'s truly "greatest hits" (not) part de by crutchy · · Score: 1

    i found a bug in your posted code before you could and no amount of bitchslapping from you is going to change that fact.... you're just going to have to live with it

  86. Re:"CruTcHy"'s truly "greatest hits" (not) & F by crutchy · · Score: 1
    have another read of my comment that first points out where the bug is (before you hahaha)... http://slashdot.org/comments.pl?sid=3058625&cid=41117989

    the code paste in http://slashdot.org/comments.pl?sid=3058625&cid=41091833 was merely to point to the code that you posted... the code that was actually pasted into the interpreter was copied and pasted verbatim from your post, with indents

    go back and have a look at the code you posted...
    http://slashdot.org/comments.pl?sid=3058625&cid=41052117

    the bug is there... on the fifth line

    if i pasted the code without any indents at all, a parse error would have been thrown for line 2... it wouldn't have gotten as far as line 5

    so, like i said, your code may have worked perfectly in your interpreter, but the code as posted IN YOUR COMMENT (http://slashdot.org/comments.pl?sid=3058625&cid=41052117) had the bug, so the bug was not mine

    it wouldn't even be a big deal, except that you can't help but make it a big deal with things like...

    P.S.=> Additionally + Lastly: Like ALL my code? It works well... apk

    ...so if your going to make dipshit comments like that, at least have a look over the code you post, because otherwise you're just begging to be pwned (as you are now)