Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Cornering the Market On Zero-Day Exploits

Unknown Lamer posted about 3 months ago | from the sell-out-or-get-the-hammer dept.

Security 118

Nicola Hahn (1482985) writes Kim Zetter of Wired Magazine has recently covered Dan Greer's keynote speech at Black Hat USA. In his lengthy address Greer, representing the CIA's venture funding arm, suggested that one way that the United States government could improve cyber security would be to use its unparalleled budget to buy up all the underground's zero-day vulnerabilities.

While this would no doubt make zero-day vendors like VUPEN and middlemen like the Grugq very wealthy, is this strategy really a good idea? Can the public really trust the NSA to do the right thing with all those zero-day exploits? Furthermore, recall the financial meltdown of 2008 where the public paid the bill for Wall Street's greed. If the government pays for information on all these unpatched bugs would society simply be socializing the cost of hi-tech's sloppy engineering? Whose interests does this "corner-the-market" approach actually serve?

Sorry! There are no comments related to the filter you selected.

Really? (5, Insightful)

meerling (1487879) | about 3 months ago | (#47631071)

The answer is NO,
If you don't know the question, it was, "Can the public really trust the NSA to do the right thing with all those zero-day exploits?"

That's not speculation, that's based on what they are already known to have done with exploits they've discovered or otherwise obtained already.

The answer is to lessen the bugs at the source (4, Interesting)

Taco Cowboy (5327) | about 3 months ago | (#47631119)

The zero-day bugs are bugs, while we know bugs are inevitable (nobody is perfect), it does not mean that we should just throw up our hands and say "Oh, there is nothing we can do"

We can !

We can do something at the source level - at the very least we should be able to, after so many years of programming culture, to inculcate the correct way to future crops of programmer so that they produce stuffs that contain less bugs

Some of those bugs were actually added when the original program gone through an update, with extra bells and whistles - and if we can stick to the original Unix principle, in which, one utility does one thing, and one thing only, and does it very efficiently, the chances of "introducing added bugs" would be drastically lessen

Re:The answer is to lessen the bugs at the source (0)

Anonymous Coward | about 3 months ago | (#47632139)

Not using C or C++ would be a good start.

HIS NAME IS "GEER" NOT "GREER" (2)

Jeremiah Cornelius (137) | about 3 months ago | (#47632687)

He's wicked smart, and has blind spots the size of a subcontinent.

One of which is this: He works for the Gestapo, and thinks they're the "good guys". Reminder to smart guys from the best Universities: The Secret Police are the problem, not a solution. If you want examples of where the CIA bought up all the issues and made them "assets" look at the Afghan Mujaheddin. The CIA equiped them with organizational database technology that quickly produced an "Al Qaeda" as one of its effects.

Bruce Schneier could hand Geer his lunch on the sociological, political and life-quality implications of the proposal. Bruce also has +5 charisma, while Dan is lucky to register +1.

Re:The answer is to lessen the bugs at the source (1)

VortexCortex (1117377) | about 3 months ago | (#47635919)

You'll have to start at the language level. Trigraphs? WTF? En\
d of line continuations absolutely anywhere?

Protip: Languages that are a nightmare to lex parse and implement have terrible security. You made your own bed, now die in it.

Re:Really? (3, Insightful)

Mr D from 63 (3395377) | about 3 months ago | (#47631243)

The government would get screwed in the deal. The most effective exploits would somehow be left out of the deal.

Re:Really? (4, Insightful)

mi (197448) | about 3 months ago | (#47631471)

The government would get screwed in the deal. The most effective exploits would somehow be left out of the deal.

Worse. The proposed program would encourage the software vendors to deliberately place bugs into their code — so as to sell them to government later. It would not even be illegal for them to do so, it seems, not under the current laws [acm.org] .

Re:Really? (2)

jellomizer (103300) | about 3 months ago | (#47631335)

Can you trust anyone with a zero-day exploit?

If you just tell the company and not anyone else, chances are they will thank you, or arrest you, then not put the time or money into fixing the problem.

If you tell the public, or any other group, they will be some bad apples who will use the information for their own misdeeds.

If you tell the government, they will use it to their advantage as well.

Re:Really? (1)

Jeff Flanagan (2981883) | about 3 months ago | (#47631737)

>If you just tell the company and not anyone else, chances are they will thank you, or arrest you, then not put the time or money into fixing the problem.

If you're fearful, and maybe it this case you're right to be, you can always anonymously report exploits to the company that released the software.

Re:Really? (1)

GameboyRMH (1153867) | about 3 months ago | (#47631503)

Just NO? I would have said HELL TO THE FUCK NO to that!

Furthermore to the problems pointed out in TFS, they would quickly drive up the price of vulnerabilities until the US government can't justify the cost, leaving them priced out of the means of garden-variety crooks but conveniently reserved for other very dangerous, high-profile buyers who may be interested.

Re:Really? (3, Insightful)

GuB-42 (2483988) | about 3 months ago | (#47631507)

What's the difference between the NSA having 10 ways to hack into your computer vs having 100 ways ?
The NSA can do whatever it wants in both cases. Except in the second case, there'll be less exloits available to the much more dangerous blackhats.

Why are blackhats more dangerous ? Because the NSA will "just" invade your privacy. Blackhats will steal your identity, ransom you hard drive, use your computer as a spambot and turn over your private data to anyone with money (this includes the NSA).

Re:Really? (1)

Anonymous Coward | about 3 months ago | (#47631743)

What the hell? I know no one reads the linked article, but doesn't the *submitter*, let alone anyone else, even read the *title* of the linked piece? I'll give you a hint:

CIA Insider: U.S. Should Buy All Security Exploits, Then Disclose Them

Also, for the record, his name is Dan Geer, not "Greer". Jeez, people.

Re:Really? (1)

drinkypoo (153816) | about 3 months ago | (#47632525)

Why are blackhats more dangerous ? Because the NSA will "just" invade your privacy. Blackhats will steal your identity, ransom you hard drive, use your computer as a spambot and turn over your private data to anyone with money (this includes the NSA).

hahaha. You haven't been paying attention to the FBI creating terrorists or the various things the CIA has done over its lifetime at all, have you? Government agencies have done all kinds of fun things like that to people for all kinds of reasons.

Re:Really? (1)

suutar (1860506) | about 3 months ago | (#47631825)

sadly true. Sadly because helping fix vulnerabilities is part of the NSA's job, and this would directly contribute to it. But they're in "best defense is a good offense" mode, so they'll sacrifice the defenses of their allies to keep from strengthening the defenses of their opponents.

Proven to not be trustworthy (2)

mcrbids (148650) | about 3 months ago | (#47631867)

We have a well-funded government agency, tasked with securing its country, actively sabotaging the security frameworks of the nation it has been tasked with protecting, in the name of "security". Never mind that any back door left open to the NSA is also left open to other parties. (EG: China) And now we're supposed to *trust* this agency with even more unfettered access to 0-day exploits?

If the NSA was really about securing the United States, it would be auditing commercial security products to ensure the *lack* of back doors, not ensuring the presence of them!

Re:Proven to not be trustworthy (0)

Anonymous Coward | about 3 months ago | (#47632583)

Proven to not be trustworthy

Exhibit #1: NSA initially acknowledged exploiting the Heartbleed bug before its disclosure, then subsequently denied having knowledge.

*cough* BULLSHIT *cough* (4, Insightful)

gstoddart (321705) | about 3 months ago | (#47631101)

Greer, representing the CIA's venture funding arm, suggested that one way that the United States government could improve cyber security would be to use its unparalleled budget to buy up all the underground's zero-day vulnerabilities

This doesn't improve cyber security, it just guarantees the CIA et al have access to everything on the planet.

This enhances their job security, and extends their ways and means ... but in no way does it make anybody else more secure.

The venture funding arm of the CIA presenting at a black hat conference ... capitalism has truly met the surveillance state, and it isn't going to end well.

Re:*cough* BULLSHIT *cough* (1)

Anonymous Coward | about 3 months ago | (#47631195)

Exactly, that's defining "security" as "pwning all computer based systems on the planet, all at once"

Re:*cough* BULLSHIT *cough* (1)

dasacc22 (1830082) | about 3 months ago | (#47631241)

This is bullshit but I can't help but think "bug bounties" aren't proper capitalism since there's little competition. What if zero day exploits were part of an actual legit market? Google or Mozilla or Microsoft could go there and haggle and possibly drive initially high prices down, etc. Disclosure is considered a responsibility, and I'm all for that, but if there's going to be an underground market for it, then why not just legitimize and potentially mitigate risks instead of these pat-on-the-head-and-here-is-a-quarter bug bounties? Given a generation of this type of market, people with these kinds of interests could likely find better work and such a market could be a stepping stone for people interested in these types of things instead of being demonized and sucked down into the underground.

? Plenty of competition when I looked (3, Interesting)

raymorris (2726007) | about 3 months ago | (#47631701)

> can't help but think "bug bounties" aren't proper capitalism since there's little competition.

I'm not sure quite what you mean here. Just the other day I looked over a list of bug bounty programs to see if it might mange sense for me to analyze some of the software specifically for the purpose of collecting bounties. There were quite a few companies offering bounties, competing for my services analyzing their software. Based on what I saw, there is a reasonable amount if competition on that side, many buyers of bugs.

One company I saw has a bug bounty program sells software that I use on a daily basis and occasionally debug. I've sent them patches and suggestions before, outside of any bug-bounty program. Looking at the rewards offered, it seemed to me that it _might_ make sense for me to analyze certain software for security bugs. The price offered, based on the number of other programmers competing for the money, seemed just about right, maybe slightly low. On the other hand, the rewards are enough that it DEFINITELY makes sense for me to spend the time and hassle reporting bugs that I happen to notice while I'm using and configuring the software. So based on what I saw, there is enough competition on both sides to have prices tend toward reasonable numbers.

I noticed that a lot of companies don't have bug-bounty programs yet, though many do. It reminds me of 15 years ago when a lot of sites had referral programs, but most did not. That changed when third parties including CCBill made it easy to add a referral program. I suspect many more companies will add bug-bounty programs when they don't have to develop and manage the system themselves. If they can just buy or subscribe to an easy-to-use software package for running it, and maybe let the third party vendor handle payments, it will become much more common.

Re:? Plenty of competition when I looked (0)

Anonymous Coward | about 3 months ago | (#47633891)

Are you a professional security researcher or a marketing/advertising or affilated with them type?

technical side, security and incident response (1)

raymorris (2726007) | about 3 months ago | (#47634187)

I'm on the technical side. Marketing and especially advertising annoys me greatly. My experience is primary in prevention and incident response for web server security. So finding and eliminating potential risks. "Security researcher" might emplo imply actually developing specific exploits, whereas I'd sanitize and bind all input, not often spending time developing a specific injection string.

I've tried to get a breadth of relevant experience, though. My time working as a locksmith informs my info sec work, I've been a licensed private investigator, I'm licensed as a security officer, etc. Same on the code side - programming microcontrollers a little bit gives an appreciation for timing attacks, etc.

Why do you ask?

Re:technical side, security and incident response (0)

Anonymous Coward | about 3 months ago | (#47635755)

Are you employed directly by advertising firms (or affiliates)?

no, apk. Have you not read any of posts? (1)

raymorris (2726007) | about 3 months ago | (#47636801)

Have you not read any of my posts you've replied to?
My company does no advertising whatsoever. Since 1997, we've had all the work we can handle.

Re:no, apk. Have you not read any of posts? (0)

Anonymous Coward | about 3 months ago | (#47637125)

Do you work for advertiser redirectors raymorris? Clickbank's one. This says you do http://www.linkedin.com/in/ray... [linkedin.com] if that's you. It's why you were asked about affiliates of advertisers. Apk? What's apk got to do with anything here? You are either that profile on linkedin or you're not. Which is it? If you do work for them are you ashamed of it? It seems it.

Re:no, apk. Have you not read any of posts? (0)

Anonymous Coward | about 3 months ago | (#47637393)

haha raymorris, APK got you this time! Good work, APK! -- can't believe I'm writing this.

Re:no, apk. Have you not read any of posts? (0)

Anonymous Coward | about 3 months ago | (#47637445)

Raymorris is just asked a question to verify if he works for or does work for clickbank http://en.wikipedia.org/wiki/C... [wikipedia.org] and vertis http://www.linkedin.com/compan... [linkedin.com] before that and if he does work for, or works for advertisers' affiliated companies. Both clickbank and vertis clearly are such companies per wikipedia and linkedin in those links descriptions. That's all. If he doesn't, then he doesn't and someone named raymorris also does is all. If he does then he's in the wrong job if he hates advertisements as he claimed here earlier imo. He said nobody wants to read about hosts files. I'd suspect that most advertisers would say that.

yeah I'm the CEO of Microsoft too, spammer (1)

raymorris (2726007) | about 3 months ago | (#47637495)

Yeah, sure I'm the CTO of Clickbank. I'm all 296 people on Linked In named Ray Morris.
https://www.linkedin.com/vsear... [linkedin.com]

Just like I'm also the CEO of Microsoft, and the president of the United States.

If you'd read half of my posts that you replied to, you'd know exactly who I am. I talk about my work all the damn time on Slashdot.

How about you. We know who you are. You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer. Advertisers are annoying, but pay for free sites like this one. Spammers are much, much, worse. Their (your) messages are neither wanted on the site nor have the redeeming value of paying for the site. Spammers, like you, are just parasitic scum.

You're not answering the question raymorris (0)

Anonymous Coward | about 3 months ago | (#47637529)

Do you work for, or do work for advertisers or affliated companies http://www.linkedin.com/in/ray... [linkedin.com] ? If that's not you, then it's not. Is that you? Do you do work for clickbank http://en.wikipedia.org/wiki/C... [wikipedia.org] and/or vertis http://www.linkedin.com/compan... [linkedin.com] before that? Both clickbank and vertis clearly are such companies per wikipedia and linkedin in those links descriptions. Just curious. Can't see why you don't say "yes" or "no" is all, and that's all. If you don't, then you don't and someone named raymorris also does is all. However, IF YOU DO then you're in the wrong job if you hate ads as you claimed here earlier imo. You said nobody wants to read about hosts files http://slashdot.org/comments.p... [slashdot.org] and it's easy to show otherwise and I will next post. I'd suspect that most advertisers would say what you said raymorris. Answer the question yes or no if you work for clickbank or have worked for them or done work for them, or vertis. Thank you.

Counter proofs outnumber raymorris #1 of 2 (0)

Anonymous Coward | about 3 months ago | (#47637551)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." -

Unwanted by whom, raymorris? Clickbank, vertis, & their affiliates whom they work with?

You don't answer if you do work for them or not either and You're outnumbered 100's to 1 (starting with these and continuing later):

http://ask.slashdot.org/commen... [slashdot.org]
http://slashdot.org/comments.p... [slashdot.org]
http://it.slashdot.org/comment... [slashdot.org]
http://it.slashdot.org/comment... [slashdot.org]
http://it.slashdot.org/comment... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]

Seems you're outnumbered here raymorris, with verifiable fact.

Counter proofs outnumber raymorris #2 of 2 (0)

Anonymous Coward | about 3 months ago | (#47637585)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Unwanted by whom, raymorris? Clickbank, vertis, & their affiliates whom they work with?

You don't answer YES or NO directly if you do work for them or not either and You're outnumbered 100's to 1 (starting with these and continuing later):

http://yro.slashdot.org/commen... [slashdot.org]

http://yro.slashdot.org/commen... [slashdot.org]

http://linux.slashdot.org/comm... [slashdot.org]

http://slashdot.org/comments.p... [slashdot.org]

http://yro.slashdot.org/commen... [slashdot.org]

http://mobile.slashdot.org/com... [slashdot.org]

http://it.slashdot.org/comment... [slashdot.org]

http://mobile.slashdot.org/com... [slashdot.org]

http://it.slashdot.org/comment... [slashdot.org]

http://yro.slashdot.org/commen... [slashdot.org]

Next will be literally 110++ posts of others posting on hosts on THIS SITE on hosts' value for added speed, security, reliability, and anonymity (and more) they give end users also raymorris. Just to show you don't tell the truth in your quoted words above.

If posts on hosts aren't wanted (0)

Anonymous Coward | about 3 months ago | (#47637607)

Then why are posts on hosts upmodded here on slashdot raymorris here http://it.slashdot.org/comment... [slashdot.org] and here (with many more under those 2 also into the 100's with testimonials even by many others on slashdot as to the value of hosts files)?

Answer that too raymorris. It's a simple question.

You also don't seem to be willing to say "yes" or "no" if you work for, or have done work for, advertisers, their affiliates, or clickbank and vertis specifically either here http://it.slashdot.org/comment... [slashdot.org] so why's that? If you don't, then you don't. However stating disproven falsehoods as you have been shown to do doesn't look good for you either in those links above.

Even more counterproofs vs. raymorris (0)

Anonymous Coward | about 3 months ago | (#47637665)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Why are these posts on hosts files upmodded then also raymorris?

http://yro.slashdot.org/commen... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://it.slashdot.org/comment... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://it.slashdot.org/comment... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://hardware.slashdot.org/c... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://mobile.slashdot.org/com... [slashdot.org]
http://news.slashdot.org/comme... [slashdot.org]

You also don't tell us a simple "yes" or "no" if you work for, or have done work for, clickbank and vertis (advertiser redirectors iirc) either.

Why's that raymorris?

You say you hate ads in this very exchange earlier, so why not answer yes or no (if you do work for them, or advertiser affiliates of theirs)? You also are shown stating noone wants to read hosts files posts which block ads and do much for security, speed, reliability, and even anonymity but proofs here show quite otherwise vs. your quoted words above in upmodded hosts posts yet again for the 3rd time.

If you don't work for or with advertisers, then you don't. Someone named raymorris does as was shown here is all.

Still more upmodded posts on hosts raymorris (0)

Anonymous Coward | about 3 months ago | (#47637689)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Raymorris, you're wrong yet again vs. your quote above:

http://tech.slashdot.org/comme... [slashdot.org]

http://apple.slashdot.org/comm... [slashdot.org]

http://it.slashdot.org/comment... [slashdot.org]

http://it.slashdot.org/comment... [slashdot.org]

http://it.slashdot.org/comment... [slashdot.org]

http://yro.slashdot.org/commen... [slashdot.org]

http://it.slashdot.org/comment... [slashdot.org]

http://tech.slashdot.org/comme... [slashdot.org]

http://tech.slashdot.org/comme... [slashdot.org]

http://tech.slashdot.org/comme... [slashdot.org]

There's plenty more coming raymorris. Eat your words, and answer if you work for, or have done work for, clickbank or vertis and their affliated advertiser marketers. Yes or No will do. Thank you.

Still more upmodded WANTED posts on hosts (0)

Anonymous Coward | about 3 months ago | (#47637705)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Raymorris, you're wrong yet again vs. your quote above:

http://tech.slashdot.org/comme... [slashdot.org]
http://hardware.slashdot.org/c... [slashdot.org] (still says INSIGHTFUL)
http://tech.slashdot.org/comme... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]
http://mobile.slashdot.org/com... [slashdot.org]
http://yro.slashdot.org/commen... [slashdot.org]
http://games.slashdot.org/comm... [slashdot.org]
http://politics.slashdot.org/c... [slashdot.org]
http://tech.slashdot.org/comme... [slashdot.org]

There's plenty more coming raymorris. Eat your words, and answer if you work for, or have done work for, clickbank or vertis and their affliated advertiser marketers. Yes or No will do. Thank you.

1 of 100's of others posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47637757)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 1 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates), spammers, in your quoted words above:

"I want my surfing speed back so I block EVERY fucking ad. i.e. http://someonewhocares.org/hos... [someonewhocares.org] and http://winhelp2002.mvps.org/ho... [mvps.org] FTW" - by UnknownSoldier (67820) on Tuesday December 13, @12:04PM (#38356782)

"this is not a troll, which hosts file source you recommend nowadays? it's a really handy method for speeding up web and it works." - by gl4ss (559668) on Thursday March 22, @08:07PM (#39446525)

"I use a custom /etc/hosts to block ads... my file gets parsed basically instantly ... So basically, for any modern computer, it has zero visible impact. And even if it took, say, a second to parse, that would be more than offset by the MANY seconds saved by not downloading and rendering ads. I have noticed NO ill effects from running a custom /etc/hosts file for the last several years. And as a matter of fact I DO run http servers on my computers and I've never had an /etc/hosts-related problem... it FUCKING WORKS and makes my life better overall." - by sootman (158191) on Monday July 13 2009, @11:47AM (#28677363)

"I actually went and downloaded a 16k line hosts file and started using that after seeing that post, you know just for trying it out. some sites load up faster." - by gl4ss (559668) on Thursday November 17, @11:20AM (#38086752)

So what's that you said raymorris?

2 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47637793)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 2 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

---

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

"Better than an ad blocker, imo. Hosts file entries: http://www.mvps.org/winhelp200... [mvps.org] " - by TempestRose (1187397) on Tuesday March 15, @12:53PM (#35493274)

"^^ One of the many reasons why I like the user-friendliness of the /etc/hosts file." - by lennier1 (264730) on Saturday March 05, @09:26PM (#35393448)

"They've been on my HOSTS block for years" - by ScottCooperDotNet (929575) on Thursday August 05 2010, @01:52AM (#33147212)

"I'm currently only using my hosts file to block pheedo ads from showing up in my RSS feeds and causing them to take forever to load. Regardless of its original intent, it's still a valid tool, when used judiciously." - by Bill Dog (726542) on Monday April 25, @02:16AM (#35927050)

So what's that you said quoted above, raymorris?

3 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47637817)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 3 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

---

"you're right about hosts files" - by drinkypoo (153816) on Thursday May 26, @01:21PM (#36252958)

"APK's monolithic hosts file is looking pretty good at the moment." - by Culture20 (968837) on Thursday November 17, @10:08AM (#38085666)

"I also use the MVPS ad blocking hosts file." - by Rick17JJ (744063) on Wednesday January 19, @03:04PM (#34931482)

"I use ad-Block and a hostfile" - by Ol Olsoc (1175323) on Tuesday March 01, @10:11AM (#35346902)

"I do use Hosts, for a couple fake domains I use." - by icebraining (1313345) on Saturday December 11, @09:34AM (#34523012)

So what was that you said quoted above, raymorris?

4 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47637833)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 4 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

---

"It's a good write up on something everybody should use, why you were modded down is beyond me. Using a HOSTS file, ADblock is of no concern and they can do what they want." - by Trax3001BBS (2368736) on Monday December 12, @10:07PM (#38351398)

"Let me introduce you to the file: /etc/hosts" - by fahrbot-bot (874524) on Monday December 19, @05:03PM (#38427432)

"I use a hosts file" - by EdIII (1114411) on Tuesday December 13, @01:17PM (#38357816)

"I'm tempted to go for a hacked hosts file that simply resolves most advert sites to 127.0.0.1" - by bLanark (123342) on Tuesday December 13, @01:13PM (#38357760)

"A hosts file certainly does not require "a lot of work" to maintain, and it quite effectively kills a LOT of advertising and tracking schemes. . In fact, I never would have considered trying to use it for ddefending against viruses or malware." - by RocketRabbit (830691) on Thursday December 30 2010, @05:48PM (#34715060)

"I make use of the hosts file for various purposes, including getting my forum users set up with hosts file entries to the new server, beforehand, whenever our DNS entries are changing so they can still reach the forum while changes are propagating. THIS is a prime example of why the hosts file still exists and the behaviour should not be fucked with by those assclowns at Microsoft." - by TheRealGrogan (1660825) on Sunday August 19, @11:45PM (#41050749)

So what was that you said quoted above, raymorris?

5 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47637863)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 5 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"I recognize the need for HOSTS files in certain circumstances." - by Martin Blank (154261) on Monday August 20, @12:56PM

"The hosts file is there for a reason; it is necessary" - by CAIMLAS (41445) on Monday August 20, @02:11PM (#41057409)

"How about for those of us who have to deal with internal and external IP addresses on websites as we move in and out of client networks. I have lots of hosts entries that *I* put there (and comment out, and uncomment) so that I can get to a site by one of several IP addresses without having to throw up an internal DNS server wherever one might be missing (like on a client's DMZ)." - by drakaan (688386) on Monday August 20, @01:20PM (#41056643)

"There's a whole slew of reasons for having a hostsfile (especially for developers) that DNS doesn't solve." - by Dynedain (141758) on on Sunday August 19, @10:31PM (#41050345)

"We use hosts files with shop floor manufacturing software that requires it." - by Lime Green Bowler (937876) on Sunday August 19, @10:20PM (#41050279)

So what's that you said quoted above, raymorris?

6 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47637999)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 6 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"I also have a couple dozen SSH tunnel host overrides and various custom paths. The hosts file is used to define per-machine address resolution." - by Bob9113 (14996) on Monday August 20, @01:32AM (#41051303)

"The HOSTS file provides a convenient way to do this for those without direct control over their DNS server." - by wolrahnaes (632574) on Sunday August 19, @08:24PM (#41049667)

"Since the dawn of time, it's been typical for the marketing people to edit the hosts file to make a final review before authorizing something to go live." - by raju1kabir (251972) on Sunday August 19, @10:01PM (#41050173)

"I use a hosts file on my home machine to block the ads, and OpenDns for the kids machines." - by mrbcs (737902) on Monday August 20, @12:12AM (#41050909)

"Using the hosts file this way is legitimate" - by gweihir (88907) on Sunday August 19, @10:29PM (#41050333)

So what was that you said quoted above, raymorris?

7 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638027)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 7 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"I started using the hosts file over a decade ago" - by frovingslosh (582462) on Sunday August 19, @05:38PM (#41048641)

"The advantage of a hosts file is that one doesn't need to install extra firewall software" - by tepples (727027) on Monday August 20, @08:05PM (#41062129)

"One common use of the hosts file is to test staging servers, particularly web servers before pushing them live, and without the complexity and time it takes to set up an additional DNS server." - by kimvette (919543) on Sunday August 19, @04:56PM (#41048345)

"I'm often tinkering with the hosts file in a development setting" - by Geeky (90998) on Sunday August 19, @05:06PM (#41048409)

"I like to play Doom 3 every so often (particularly with mods like The Dark Mod, a great Thief clone), and the hosts file is something of a necessity." - by humanrev (2606607) on Sunday August 19, @09:20PM (#41049949)

So what's that you said quoted above, raymorris?

8 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638057)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 8 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"The hosts file is a popular, cross-platform way of blocking access to certain domains" - by maestroX (1061960) on Monday August 20, @03:43PM (#41058621)

"another cool trick is to set up a host file. http://winhelp2002.mvps.org/ho... [mvps.org] " - by phrostie (121428) on Friday February 17 2012, @11:39AM (#39074805)

"I modify my hosts file directly. I don't need extra shit using resources." - by ElectricTurtle (1171201) on Thursday November 17 2011, @02:56PM (#38088942)

"The fix? Edit my Windows /etc/hosts file" - by mattbee (17533) on Sunday August 30 2009, @04:52PM (#29254321)

"Web browsing is really very fast, provided you turn off advertising. I set them up with a combo of Ad Block Plus on Firefox, and a customised hosts file. They can't believe the difference." - by VShael (62735) on Monday June 29 2009, @11:35AM (#28514655)

"you can also edit the hosts file if all else fails. We have a few (Vista) laptops where we needed to hardconfig LAN side server addresses in the hosts file" - by AndGodSed (968378) on Wednesday May 13 2009, @02:31PM (#27941353)

So what's that you said in your words quoted above, raymorris?

9 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638111)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 9 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"If it's servers on your network you need, you could just stick a hosts file entry on their computers to resolve "webserver" to 10.1.200.34 etc." - by jafiwam (310805) on Wednesday May 13 2009, @02:51PM (#27941723)

"A logon script here loads a hosts file that null-routes a lot of known bad (spyware, etc) sites" - by i.r.id10t (595143) on Wednesday May 13 2009, @03:22PM (#27942211)

"check out an enhanced hosts file at http://www.mvps.org/winhelp200... [mvps.org] " - by NeverVotedBush (1041088) on Tuesday March 17 2009, @01:42PM (#27228373)

"Instead of using a filter maybe a hosts file would work better for you" - by falconwolf (725481) on Tuesday March 17 2009, @01:36PM (#27228241)

"I maintain a large hosts file to kill traffic with any server I find to be suspect." - by BrokenHalo (565198) on Thursday February 05 2009, @12:02PM (#26738403)

"I modified my hosts file to black-hole all of the worst offenders with regards to ads/malware" - by orclevegam (940336) on Thursday February 05 2009, @02:02PM (#26740813)

"I've been using a hosts file since around 2003. It blocks out all those ads, popups, spyware,adware, stops alot of virii from calling home, you name it" - by cyberjock1980 (1131059) on Thursday February 05 2009, @11:30AM (#26737795)

So what was that you said in your words quoted above, raymorris?

10 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638121)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 10 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"HOSTS file FTW! This really is the best method. Its cross-platform and no matter what strategies the ad people try" - by gad_zuki! (70830) on Thursday February 05 2009, @11:40AM (#26737963)

"Recommendation 2: Go line and look for hosts files people have put available on the web. Copy it and save it. I once had a hosts file that was about 2 megs in size. Considering it is plain text that was a LOT of sites it blocked. It was my own little slice of heaven" - by furby076 (1461805) on Thursday February 05 2009, @11:48AM (#26738109)

"I have several notorious slow adservers in my /etc/hosts" - by jandrese (485) on Friday August 17 2007, @01:00PM (#20263547)

"If you're interested in populating your hosts file, check out http://www.mvps.org/winhelp200... [mvps.org] " - by halcyon1234 (834388) on Friday August 17 2007, @01:43PM (#20264387)

"(Ads) they dont bother me at all c:\windows\system32\drivers\etc\hosts 127.0.0.2 analytics.google.com" - by Anonymous Admin (304403) on Friday August 17 2007, @01:15PM (#20263863)

"On top of noscript and adblock, I block complete domains with http://winhelp2002.mvps.org/ho... [mvps.org] And I also edit the css of the most visited websites with http://userstyles.org/ [userstyles.org] " - by by houghi (78078) on Sunday September 23, @10:09AM (#41427821)

"I use the mvps.org HOSTS file as well, and have been very happy with it." - by drooling-dog (189103) on Sunday September 23, @11:39AM (#41428527)

So what was that you said in your words quoted above, raymorris?

11 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638143)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 11 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"Custom hosts files will probably go far for this. Instead of keeping a txt file or something of your ipv6 ips. Throw them all in your hosts file." - by dracocat (554744) on Tuesday September 18, @02:48AM (#41371793)

"if you are not a Facebook user, then you can and should use your hosts file or firewall to block *.facebook.com and *.fbcdn.com" - by betterunixthanunix (980855) on Sunday September 23, @12:06PM (#41428715)

"All you need to not be tracked, is allready an your machine. /etc/hosts (even windows has that)" - by someones (2687911) on Sunday September 23, @03:21PM (#41430121)

"I'm going to continue running ABP, blocking third party cookies, running noscript, and blackholing known ad servers in my hosts file." - by sqrt(2) (786011) on Sunday September 23, @05:07PM (#41430971)

"So they want to play that game? Drop this line in your /etc/hosts file:" - by cratermoon (765155) on Sunday September 30, @01:13PM (#41506965)

"And this is me adding them to my hosts file: 0.0.0.0 [tab] www.itif.org [enter]" - by bmo (77928) on Sunday September 30, @12:47PM (#41506805)

"I get exactly the same effect with my Hosts file and for those that don't understand how they work, it's pretty god damn simple. I never make the connection to the god damn server - no ad/malware or other crap to see." - by fast turtle (1118037) on Sunday September 30, @03:00PM (#41507585)

So what's that you said in your words quoted above, raymorris?

12 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638161)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 12 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"They're visually annoying and distracting. They're a waste of bandwidth. Sometimes they're even noisy. I block them with a hosts file" - by Kris_J (10111) on Monday October 10 2005, @11:12PM (#13761572)

"I not only ad blocked, but set up a hosts file to block entirely, just so the pages would load." - by SydShamino (547793) on Tuesday October 11 2005, @10:03AM (#13764385)

"I was on a roll and obtained hosts files. It started when ads got big time IN YOUR FACE" - by Technician (215283) on Tuesday October 11 2005, @01:01AM (#13762338)

"I use a hosts file to block ads" - by pjkeyzer (645364) on Monday October 10 2005, @11:46PM (#13761877)

"Go to Gorilla Design Studios: Using the Hosts File and read their explanation of how to use a HOSTS file to block out unwanted sites." - by srmalloy (263556) on Tuesday October 11 2005, @03:15PM (#13767229)

"http://winhelp2002.mvps.org/hosts.txt " - by schwit1 (797399) on Thursday November 15, @11:40AM (#41992625)

"Am I the only one that uses a hosts file? Takes care of more than just ads. It's to the point now that when I see ads, I'm shocked. I've had them blocked for years. They may be able to stop adblock, but good luck trying to outlaw a hosts file." - by mrbcs (737902) on Friday November 23, @06:59PM (#42077997)

So what was that you said in your words quoted above, raymorris?

13 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638167)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 13 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"127.0.0.1's in my hosts file. Some shady ads do cause trouble, and similar methods can be used to block some troublesome non-ads." - by KingAlanI (1270538) on Friday November 23, @06:06PM (#42077587)

"I haven't seen an ad online since 2004 since I learned about Privoxy, and the hosts file modification" - by ksemlerK (610016) on Friday November 23, @10:29PM (#42079275)

"My frustration with ads in the in-game browser from the steam overlay led me learn about and begin using hosts files." - by Scorch_Mechanic (1879132) on Friday November 23, @10:30PM (#42079283)

"I have a scheduled process (twice a month) to download (and rename and properly place) this fine file: http://winhelp2002.mvps.org/ho... [mvps.org] Entirely free, works VERY VERY well." - by NealBScott (1168201) on Thursday November 29, @10:39AM (#42130127)

"a modified hosts file when I'm at home in Safari on my Mac, I haven't seen an ad in months, let alone one following me around." - by Anubis IV (1279820) on Thursday December 06, @06:28PM (#42210239)

"hosts is useful" - by crutchy (1949900) on Saturday August 25, @09:41PM (#41126337)

"Indeed, I have used modified HOSTS files myself at times to deal with specific sites." - by damn_registrars (1103043) on Monday January 21, @07:36PM (#42652623)

So what's that you said in your words quoted above, raymorris?

14 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638199)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 14 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"Blocking adverts is trivial. Hosts file, anyone?" - by couchslug (175151) on Saturday September 22, @10:43AM (#41420821)

"Of course using a hosts file is a better solution for people who have one single computer that connects to all sorts of networks." - by green1 (322787) on Friday February 01, @05:31PM (#42766255)

"Hosts file and no script, only enable the stuff that you need. Plus with all of that worthless javascript wasting cpu cycles and memory gone, you can use your computers resources for something more useful, like a hundred more tabs." - by wakeboarder (2695839) on Thursday February 14, @01:24AM (#42892845)

"hello hosts file 127.0.0.1 product.canonical.com" - by Gothmolly on Monday February 18, @12:49PM (#42936961)

"i simply manually block ads with my hosts file only when they are particularly annoying" - by lesincompetent (2836253) on Sunday March 10, @08:14AM (#43129989)

"You should actually notice a speed up! Host file lookups are negligible compared to DNS lookups and HTTP queries..." - by ls671 (1122017) on Sunday March 17, @03:59PM (#43198353)

"If you're running Vista, Windows 7, or 8, you can further restrict access to the Hosts file for users that are a member of the Local Administrators group." - by DigiShaman (671371) on Sunday March 17, @12:03PM (#43197203)

So what's that you said in your words quoted above, raymorris?

15 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638223)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 15 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"Ads are also vectors for information gathering and tracking across the web, which is why it is perfectly justifiable to cut them off at the ankles, right in your hosts file." - by drooling-dog (189103) on Sunday March 17, @10:55AM (#43196845)

"The hosts file can be effective for all traffic from a single machine." - by P. Don (2867899) on Sunday March 17, @01:44PM (#43197711)

"It lives in C:\windows\system32\drivers\etc\hosts on windows systems at least up till win7. Here is an add-block hosts file: http://pgl.yoyo.org/as/serverl... [yoyo.org] This info is brough by a Linux user... :-)" - by Yaa 101 (664725) on Sunday March 17, @10:42AM (#43196767)

"I do it on the /etc/hosts level on my dns server. You can find large lists of ad domains that can be added to your hosts file with 127.0.0.1 or 0.0.0.0 to cause them to fail. This covers all machines on your network that use your dns server. The one I use is http://winhelp2002.mvps.org/ho... [mvps.org] however they have become slow with updating it. You might want to invest some time in looking for one that is updated more frequently." - by qwertyatwork (668720) on Sunday March 17, @10:39AM (#43196749)

"I also install a Host's file which does a good job at blocking ad's (I don't buy a platform that I can't install at least that)." - by dehole (1577363) on Saturday April 20, @12:21PM (#43504151)

So what was that you said in your words quoted above, raymorris?

16 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638233)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 16 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"After much gnashing of teeth, I discovered it was undetectable by any known virus checker I use (AVG, Malwarebytes, Spybot), so I had to dig deeper. It turned out that the malware was using any references to 127.0.0.1 (local machine) for it's hook. All I had to do was edit the HOSTS file and add the domain names of the miscreant with a reference to a different IP address that is known to be a deadend (you could, for example, use 127.7.7.7). When the malware couldn't execute, it couldn't disable the various malware detectors, and several files were then identified and removed." - by by CAOgdin (984672) on Tuesday June 04, 2013 @01:18PM (#43906343)

"HOSTS file http://winhelp2002.mvps.org/ho... [mvps.org] " - by schwit1 (797399) on Friday January 17, 2014 @05:27PM (#45992149)

"^^^^^ EXACTLY!!! I've been using a hosts file for years. Best thing I ever did." - by mrbcs (737902) on Saturday January 18, 2014 @12:26AM (#45996149)

So what was that you said in your words quoted above, raymorris?

17 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638251)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 17 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"I find that between my hosts file, my local firewall policy and my router's firewall policy, running apps and browsing the world wide web is a pretty zippy and painless experience. For the few places that fail to run correctly, I just don't go there." - by Em Adespoton (792954) on Tuesday April 30, 2013 @05:11PM (#43594963)

"Slashdot was surprisingly one of the first sites I saw that showed an SWF ad for Splunk log analysis software, and whatever server was serving it was the first to get 0.0.0.0'd in my hosts file." - by tepples (727027) on Friday January 17, 2014 @06:24PM (#45993041)

"most ads can be killed with a simple hosts file." - by MightyYar (622222) on Friday January 17, 2014 @06:13PM (#45992891)

So what's that you said in your words quoted above, raymorris?

18 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638257)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 18 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"Ad blocking hosts file, I use it as an adult ;-) http://winhelp2002.mvps.org/ho... [mvps.org] " - by RJFerret (1279530) on Friday June 22, 2012 @01:15AM (#40407983)

"Yes. HOSTS files. Exchange HOSTS files. Manually merge and edit them." - by idontgno (624372) on Tuesday March 11, 2014 @05:12PM (#46457983)

"etc/hosts - 127.0.0.1 block.this.com (there are tons of blacklists, pick one or several and add an entry for each" - by technosaurus (1704630) on Friday June 22, 2012 @12:37AM (#40407683)

So what's that you said in your words quoted above, raymorris?

19 of 100's of others' posts on hosts here ray (0)

Anonymous Coward | about 3 months ago | (#47638267)

"You post unwanted promotional messages. Unwanted promotional messages are spam. You are therefore a spammer." - by raymorris (2726007) on Saturday August 09, 2014 @11:56AM (#47637495)

Here's 19 of 20++ evidences in 100's on /. posting on hosts to the contrary (vs you calling others asking honest questions of you here if you work for or do work for advertisers and their affiliates which you don't answer yes or no if you work for or have done work for them and their partners/customers, spammers), in your quoted words above:

"Use the hosts file to block certain domains from being accessible." - by wickerprints (1094741) on Friday June 22, 2012 @12:57AM (#40407865)

"HOSTS FILES FTW!!!!!" - by noh8rz10 (2716597) on Tuesday September 03, 2013 @12:19AM (#44743131)

"I've never used Droidwall, but you can block Google with just a few entries in your /etc/hosts file (just like on any other Linux box) just as easily, and without having to run any other services" - by BrokenHalo (565198) on Monday September 02, 2013 @11:24PM (#44742895)

"At the Risk of Summoning APK - Welcome to my HOSTS file, Yahoo." - by sexconker (1179573) on Friday May 02, 2014 @12:40PM (#46900373)

"She needs to learn about host file blocks" - by sandbagger (654585) on Saturday May 03, 2014 @10:13PM (#46910933)

So what's that you said in your words quoted above, raymorris?

Saw your post history (0)

Anonymous Coward | about 3 months ago | (#47637203)

You claim you hate advertisement yet you said nobody wants to read this http://slashdot.org/comments.p... [slashdot.org] yet hosts block ads raymorris. Appears you work for Clickbank (before them vertis): They do advertising redirects don't they? Feel free to correct me if I am wrong. You were also asked here if you work for anybody affiliated with advertisers/marketers too, so is that you, raymorris? If so, you seem to be bending the truth a bit in your replies here. Again, feel free to correct me if I am wrong. I will accept it.

Re:technical side, security and incident response (0)

Anonymous Coward | about 3 months ago | (#47637261)

Answer these questions raymorris. Set us all straight then http://it.slashdot.org/comment... [slashdot.org]

Re:? Plenty of competition when I looked (0)

Anonymous Coward | about 3 months ago | (#47637267)

Answer these questions raymorris. Set us all straight then http://it.slashdot.org/comment... [slashdot.org]

Typical great government idea (4, Insightful)

frovingslosh (582462) | about 3 months ago | (#47631107)

This is a typical great government idea. The really great thing about the idea is that once you deal with a zero-day vendor and buy a vulnerability, giving them a lot of money in the process, you can rest assured that they would never sell the same vulnerability to anyone else. 'cause that would be wrong.

Re:Typical great government idea (1)

turkeydance (1266624) | about 3 months ago | (#47631141)

paraphrase: they will sell us the exploits we use to spy on them.

Re:Typical great government idea (1)

meta-monkey (321000) | about 3 months ago | (#47631527)

How about instead of paying them to turn the exploits over to the CIA, we pay them to publish them publicly? Then the developers can see them and patch the vulnerability.

Re:Typical great government idea (0)

Anonymous Coward | about 3 months ago | (#47631775)

Except that the developpers don't pay shit for zero days.
Go ask the assholes at VUPEN, they don't make money by helping the devs.

Re:Typical great government idea (0)

Anonymous Coward | about 3 months ago | (#47631795)

Yes! That's exactly what this is! Blame the submitter and editor for not fucking paying attention!!!

Re:Typical great government idea (1)

Bill, Shooter of Bul (629286) | about 3 months ago | (#47631929)

Typical CIA Front story. This isn't something they *could* do, its something they don't need to do because they've already gained access to the servers distributing the zero days. But by announcing a plan to go through the front door, they're hoping the miscreants wont realize they already broke in through the window out back.

Re:Typical great government idea (1)

clustermonkey (320537) | about 3 months ago | (#47631991)

Or redouble their efforts to find/create as many more exploits as possible to capitalize on the guaranteed market created by the government......

Typical great government idea (0)

Anonymous Coward | about 3 months ago | (#47632059)

*sigh* I posted this already, but, come *on*, people -- the whole reason that this is newsworthy is the fact that it's a proposal to *disclose* all the exploits. If the submitter or the editor had been paying attention at all, they would have noticed that it's even right there in the article title:

CIA Insider: U.S. Should Buy All Security Exploits, Then Disclose Them

Also, for the record, his name is Dan Geer, not "Greer". Jeez, people.

NOPE (1)

Anonymous Coward | about 3 months ago | (#47631135)

Wouldn't be so bad if the US gov wasn't just trying to HOARD all the zero-day exploits. This is an issue, because instead of figuring the exploits and then making the systems *more secure* from those kinds of unknown vulnerabilities, we've seen how the NSA actively goes out and EXPLOITS these vulnerabilities regardless of whether they are a foreign agent or a citizen of the US..

Let corporations pay (0)

Anonymous Coward | about 3 months ago | (#47631207)

Let each company cover its own bill for exploits. If they don't care about their reputation / customers, screw 'em.

Look at the giant black-eye Microsoft gave itself over the years.

But no. For gods' sakes don't fund exploits with government money.

Leaked Files: German Spy Company (-1)

Anonymous Coward | about 3 months ago | (#47631217)

Leaked Files: German Spy Company Helped Bahrain Hack Arab Spring Protesters

https://firstlook.org/theinter... [firstlook.org]

[Anarchism]/u/PhineasFisher leaks 40GB of data taken from security firm Gamma International, proving how their software FinFisher was used by Middle Eastern governments to spy on dissidents and journalists.

http://www.reddit.com/r/bestof... [reddit.com]

Gamma FinFisher hacked: 40 GB of internal documents and source code of government malware published

http://www.reddit.com/r/techno... [reddit.com]

Gamma International Leaked

http://www.reddit.com/r/Anarch... [reddit.com]

Also:

https://news.ycombinator.com/i... [ycombinator.com]

More money just increases the price (3, Interesting)

petes_PoV (912422) | about 3 months ago | (#47631235)

If a new buyer comes into the market - a buyer with lots of money, then all that happens is that the price goes up. It's simple economics and we see this happening in every market: from commodities to TV programmes.

If the price becomes high enough, new exploiters will enter the market and start discovering exploits, in competition with the original suppliers. Then the NSA would have to start dealing with those guys, too. And so the circle would keep going round: more money, new exploit finders, asking higher prices.

If the NSA wants to improve security, they would set up their own zero-day exploiters to not only find, but to fix security holes and then issue those fixes for free (or use the exploits to force fixes on the exploited software. They might also ask for new laws that would require software vendors to pay them for fixing these problems. However, it's by no means certain that this would be their intention. They may simply be collecting hacks for their own nefarious purposes.

After all, we haven't seen a government agency buying up all the drugs, in order to stop them being supplied to the population - so why would they use that tactic here?

Re:More money just increases the price (3, Interesting)

Geoffrey.landis (926948) | about 3 months ago | (#47631417)

If a new buyer comes into the market - a buyer with lots of money, then all that happens is that the price goes up. It's simple economics

Well, yes, but that's exactly what was desired:
You want the price to go up, so that it's more valuable to disclose the bug than it is for some thief exploit it.

If the price becomes high enough, new exploiters will enter the market and start discovering exploits

Exactly. You mine out the easy-to-find exploits until they are depleted, and start in on the harder-to-find bugs, so that you get to the point where amateur hackers simply aren't sophisticated enough to find them.

... After all, we haven't seen a government agency buying up all the drugs, in order to stop them being supplied to the population

Well, of course you can always manufacture more drugs; you don't "find" them. They don't get harder to make as the market increases.

If the objection here is "software companies will start deliberately introducing vulnerabilities, so that they can make money by selling the vulnerabilities to the government"-- yes, that might be an objection.

Re:More money just increases the price (1)

petes_PoV (912422) | about 3 months ago | (#47631853)

Exactly. You mine out the easy-to-find exploits until they are depleted

Which assumes there are a finite (and small) number of bugs - even zero-day exploits. I think we can safely say that's not the case.

As the "incentives" for finding new 0-day exploits grows, then more people will have a reason to start looking for them. If the government then buys up the "popular" ones, everyone who's running non-mainstream software will suddenly find they are being hacked. Whereas previously the 0-day exploiters would just have gone for the low-hanging fruit, now they'll be going higher up the (almost infinitely tall) tree.

Re:More money just increases the price (1)

drinkypoo (153816) | about 3 months ago | (#47632555)

If the objection here is "software companies will start deliberately introducing vulnerabilities, so that they can make money by selling the vulnerabilities to the government"-- yes, that might be an objection.

Fraud is a felony and you don't want to end up in federal PMITA prison. The only real kernel of objection here is that it produces a new means for pork production.

Re:More money just increases the price (1)

fuzzyfuzzyfungus (1223518) | about 3 months ago | (#47631547)

There's also the difficulty of what counts as 'a zero day' for purchasing purposes. An unpatched exploit in any software? Do I need X thousand installs? Are just five enough, if they are paying a lot for it? How do we tally users of other things that are indirectly related to the issue?

People buying them to weaponize them have a fairly straightforward set of incentives(which may vary depending on what they are looking to access, whether they are after money or information, and so on). People looking to buy them for disclosure don't get the same, because virtually any exploit on the market is theoretically within that goal; but actually establishing the value of a specific one is harder unless you go down the troublesome road of defining your priorities(in terms of what systems, users, and activities you consider more or less high priority when assigning a value to exploits that would affect them).

If you are selling dangerous ones, to be used, you'll have some trouble getting repeat customers if your stuff is nonsense or works on things that aren't worth attacking. If you are selling to someone with a 'buy up the exploits' mandate you potentially have much more flexibility to haggle over stuff you more dangerous buyers aren't interested in. In the same vein, various vendors, users, and organizations would be inclined to try to lobby their way up the priority list in order to score an outside QA team.

There are likely some unambiguous cases; but telling the spooks 'do what you think best' is obviously a terrible plan, while trying to codify a reliable and unambiguous set of criteria to be followed seems quite difficult and prone to influence.

So many problems (4, Insightful)

sideslash (1865434) | about 3 months ago | (#47631345)

1. Exploit sellers will turn around and secretly sell the same goods to other parties regardless of any agreement they signed with the US government.

2. This will inflate the sale price and create perverse incentives to inject defects to "discover" and sell them later.

3. The government is really bad at pretty much everything it does. Some of it is necessary stuff so we tolerate it, but c'mon, this isn't!

4. Everybody is mad at the NSA for its misbehavior and spying on Americans/the world right now -- is this really the best time to remind people that the US government wants to collect tools to hack everybody?

Re:So many problems (0)

Anonymous Coward | about 3 months ago | (#47631829)

>1. Exploit sellers will turn around and secretly sell the same goods to other parties regardless of any agreement they signed with the US government.
Hardly a sustainable business. An exploit seller without a good reputation or people to vouch for him is essentially dead. You don't deal with anyone. That's why nobody deals with the russians, among other things.

>2. This will inflate the sale price and create perverse incentives to inject defects to "discover" and sell them later.
I know one guy who tries to do this, it's working OK for him so far. He's probably not the only genius who though of that.

>3. The government is really bad at pretty much everything it does. Some of it is necessary stuff so we tolerate it, but c'mon, this isn't!
The job of the public-facing govt is looking stupid while doing clever things behind your back.

>4. Everybody is mad at the NSA for its misbehavior and spying on Americans/the world right now -- is this really the best time to remind people that the US government wants to collect tools to hack everybody?
In the middle of the BlackHat is the best time to talk about this, for everyone involved.

So many problems (0)

Anonymous Coward | about 3 months ago | (#47632153)

Again, since *nobody* appears to have actually read the article (or even the frakking title) :

CIA Insider: U.S. Should Buy All Security Exploits, Then Disclose Them

Also, for the record, his name is Dan Geer, not "Greer". Jeez, people.

Re:So many problems (1)

sideslash (1865434) | about 3 months ago | (#47633123)

Forgot to mention: any official policy that the US would disclose the purchased security vulnerabilities would be a sham. They would undoubtedly hang onto the most important/useful ones for some period of time. Lying is not an aberration at the TLA's, it's more like their job description.

They'll do the right thing (0)

Anonymous Coward | about 3 months ago | (#47631359)

Can the public really trust the NSA to do the right thing with all those zero-day exploits?

Now, what is the right thing for a spy agency to do with zero-day exploits? To spy the fuck out of american citizens, of course, which they will.

Re:They'll do the right thing (3, Insightful)

mr_mischief (456295) | about 3 months ago | (#47631449)

Nah. The CIA spies overseas. The FBI spies domestically. The NSA does both. Then they all hand their analyses to DHS overlords to put us on watch lists for further Fourth Amendment violations with no actual evidence of anything.

No, the CIA spies on the US Senate. (0)

Anonymous Coward | about 3 months ago | (#47631803)

http://www.washingtontimes.com... [washingtontimes.com]

Questions (0)

Anonymous Coward | about 3 months ago | (#47631363)

the United States government could improve cyber security would be to use its unparalleled budget to buy up all the underground's zero-day vulnerabilities.

What chance does a government have in being successful subjecting itself to cyber (or any kind of) blackmail - that's effectively what this is - on this scale? What guarantee is there that all these vulnerabilities will be put on the market? And finally, isn't the national debt also "unparalleled"?

The NSA etc. already are buying exploits (2)

sasparillascott (1267058) | about 3 months ago | (#47631423)

I think the point of the speaker was to create a silo-ed verifiable way to do this (so things couldn't be siphoned off to the NSA like they currently are as those costs are a rounding error for the NSA). I like the idea if its implemented properly, currently we have the NSA & foreign intelligence agencies being the big buyers, keepers and exploiters. JMHO...

The Republicans that rule over us... (1)

greenwow (3635575) | about 3 months ago | (#47631461)

would never agree to that since they're not smart enough to comprehend what is being sold. They'd never go for it. Also, it would protect the poor and minorities who can't afford good AV software so they have a huge incentive to spreading exploits.

NSA already buys everything ! (2)

eulernet (1132389) | about 3 months ago | (#47631521)

One way that the United States government could improve cyber security would be to use its unparalleled budget to buy up all the underground's zero-day vulnerabilities.

In my opinion, NSA already buys all existing exploits (as all other secret services), because these are military weapons for the Cyberwar.
An expensive exploit is nothing for their budget.

Why would they be required to share these exploits ?
Any weapon that the enemy doesn't have is a strategic advantage !

Re:NSA already buys everything ! (1)

Intrepid imaginaut (1970940) | about 3 months ago | (#47636817)

Not just your opinion, and everyone can calm down, they've been doing it for a while -> http://www.scmagazine.com/nsa-... [scmagazine.com]

The Fundamental Flaw (2, Interesting)

Anonymous Coward | about 3 months ago | (#47631591)

The fundamental flaw with this idea is that it assumes there is a finite supply of these 0 day exploits. Even if you think that you can trust who ever we would be buying it from to not sell it to anyone else and that no one else would discover the same exploit you still don't gain anything because you can never buy up all the exploits possible. Creating a stronger market for those exploits will just ensure that more people are looking for and finding them and you have to continue buying them or they'll hit the open market.

"Once you pay the Dane-geld, you never get rid ... (3, Interesting)

davidwr (791652) | about 3 months ago | (#47631815)

... of the Dane." -Rudyard Kipling

Rudyard Kipling, Dane-Geld, A.D. 980-1016 [poetryloverspage.com]

It is always a temptation to an armed and agile nation
    To call upon a neighbour and to say: --
"We invaded you last night--we are quite prepared to fight,
    Unless you pay us cash to go away."

And that is called asking for Dane-geld,
    And the people who ask it explain
That you've only to pay 'em the Dane-geld
    And then you'll get rid of the Dane!

It is always a temptation for a rich and lazy nation,
    To puff and look important and to say: --
"Though we know we should defeat you, we have not the time to meet you.
    We will therefore pay you cash to go away."

And that is called paying the Dane-geld;
    But we've proved it again and again,
That if once you have paid him the Dane-geld
    You never get rid of the Dane.

It is wrong to put temptation in the path of any nation,
    For fear they should succumb and go astray;
So when you are requested to pay up or be molested,
    You will find it better policy to say: --

"We never pay any-one Dane-geld,
    No matter how trifling the cost;
For the end of that game is oppression and shame,
    And the nation that pays it is lost!"

Re:"Once you pay the Dane-geld, you never get rid (0)

Anonymous Coward | about 3 months ago | (#47633611)

"You gotta pay the troll toll,
if you wanna get in that boy's hole."

Let's create bugs and get paid for fixing them (2)

SBatman (985340) | about 3 months ago | (#47631955)

Reminds me of this Dilbert: http://dilbert.com/strips/comi... [dilbert.com]

Totally infiltrated (0)

Anonymous Coward | about 3 months ago | (#47632333)

Nice to see the Keynote speak is a CIA agent, representing their "funding arm" (taxpayer money that doesn't represent you one bit)

Just a hunch, I'm sure any real blackhat would never ever work with these CIA douches.

Another organization totally infiltrated.

How about instead (2, Insightful)

Anonymous Coward | about 3 months ago | (#47633609)

How about instead governments issuing fines to software companies for every security vulnerability found. Perhaps the fines might be calculated based on the amount of copies of the software sold with a set minimum amount. Fines could increase the longer the vulnerability remains unpatched. The revenue raised by these fines could then pay for more education and tools for ensuring better software security and security researchers.

code myself a minivan (1)

mmogilvi (685746) | about 3 months ago | (#47633863)

I hope this is implemented. Then I'll just code mysefl up a minivan: http://dilbert.com/strips/comi... [dilbert.com]

Already being done I suspect... (1)

0x537461746943 (781157) | about 3 months ago | (#47634205)

Do you really think the CIA (or some other group) doesn't already do this? $10000 for an exploit to use against an enemy (or friend?) of the government... I doubt they even flinch when making a decision to buy something like that (disguising their identity of course). They wouldn't advertise such behavior and surely it would be protected from most of the government knowing about it because of the sensitive nature of it. We just wouldn't ever know such things.

Re:Already being done I suspect... (1)

VortexCortex (1117377) | about 3 months ago | (#47635945)

I don't suspect. I know. [theatlantic.com]

This is because: I read.

Inflating the Exploit marketplace hurts us all. (1)

dweller_below (136040) | about 3 months ago | (#47634345)

Anything that inflates the Exploit/Vul marketplace just hurts us all. We can fight hackers. We can even fight governments. But, we can't fight economics. If economics strongly encourage the discovery and secret utilization of exploit, we are all doomed. A few may experience a short-term benefit from a booming market in exploit and vulnerability, but the consequences of that marketplace will harm all the rest of us. The only sane behavior is to do everything we can to depress the market for vulnerability and exploit. We have to change the economics.
  • 1) The government must always, immediately, publicly, disclose any purchased vulnerability or exploit. Once they are for sale, there is no point in keeping them secret. Secrecy inflates the market. Then the market creates more vulnerability and exploit.
  • 2) Any benevolent government should target the exploit marketplace. This is a sensible and reasonable target for the NSA and the FBI. The exploit market creates the uncontrollable weapons of the internet apocalypse. Any exploit or vulnerability that the FBI or NSA can seize from others should be immediately published. This will suppress the desirability of the goods in the exploit marketplace.
    • * The legal fictions of intellectual property should never be allowed to adhere to exploit information.
    • * There is no public interest in preserving exploit.
    • * There is a great deal of public harm in encouraging exploit.
  • 3) For the good of us all, we need to beat the NSA black and blue and force them to publicly disclose any of their vulnerabilities and exploits that are over a year old.
    • * This provides the NSA with tangible deliverables that they can use to justify their existence and we can use to measure their competence.
    • * This gives them a year to play with their toys.
    • * This will greatly suppress the exploit marketplace.

Re:Inflating the Exploit marketplace hurts us all. (1)

VortexCortex (1117377) | about 3 months ago | (#47635951)

If you have a hole in the side of your bank, you don't fight the theves forever, you fix the fucking hole in your bank.

You've made some terrible assesments of reality. You can't even see the holes anymore. [bell-labs.com]

"Fight this", "fight that", you're a shadowboxing fool.

Dan Geer is a founder of computer security. (1)

jg (16880) | about 3 months ago | (#47634349)

First: In-Q-Tel is the venture capital arm of all of the U.S. intelligence services, including DHS, FBI, etc; not just CIA. DHS, for example, will be blamed for any big security disaster; you should not presume that the motives of the agencies are uniform. Nor is all of what those agencies do bad.... It's the pervasive surveillance we *must* stop, and compromising our security standards. See: https://www.iqt.org/about-iqt/ for In-Q-Tel rather than the Wikipedia entry for Dan.

Second: Dan has never taken a security clearance, over his entire career.

Third: He's actually not a In-Q-Tel employee, but a consultant (full time) for them. This is so that he does *not* have to sign a employee agreement, but can remain able to speak freely. Which he does regularly: See http://geer.tinho.net/pubs for some of his publications. One I sparked him to write recently is: http://geer.tinho.net/geer.lawfare.15iv14.txt in reaction to the information I cover in my Berkman Center talk you can find at: https://cyber.law.harvard.edu/events/luncheon/2014/06/gettys

Fourth: people who know Dan, who is really one of the founders of the computer security field, hold him in very high regard and trust, as I do.

If you look at Dan Geer's career, rather than jumping to unfounded, ill informed presumptions based on news reports that don't bother to go beyond reading the Wikipedia entry, you will find:
    1) he managed the development of Kerberous at Project Athena (where I got to know him)
    2) he co-authored the famous Microsoft is a dangerous monoculture paper a bit over a decade ago (which Microsoft hated so much they
          got @Stake to fire him.
    3) he is a holder of the USENEX Flame award https://www.usenix.org/about/flame

In short, guys, he's one of "us"....

Don't be ill-informed slashdotters....

Re:Dan Geer is a founder of computer security. (1)

VortexCortex (1117377) | about 3 months ago | (#47636001)

"One of us"

Speak for your self. I haven't been compromised.

Multinational, independent organisation? (0)

Anonymous Coward | about 3 months ago | (#47636647)

Why should it be the US or for that matter any one country? An organisation similar in principle to the WHO but for the internet? The internet gains utility with gains in connectivity, the more countries part of the internet the greater the potential. Why should it be solely dependent on the US, a proportional funding effort from those countries utilising this worldwide resource would surely help maintain a measure of openness whilst reducing the risk of bank hand deals operated by a multinational group. Nothing worse then putting all your cyber nukes in one basket.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?