What is the HOSTS file?

[ah]

Jan Il wrote:

[snip]

I sort of get the idea of how it works now...

[snip]

Well, your friends don't say "Hi 123-45-6789!" . . . they say "Hi Jan!"

Hi Jan!

Lol! Hi Andrew..;-)
lo

yo

HELO

Twas nice to wear sandals, today (yeah, right!--it's way too cool to be cool) ;-)

Well... now I didn't say _wear_ them....I just said to break them out...
;<g>

Oh, I broke 'em out, alright--snapped clean in two . . . just like a goldfish in
liquid nitrogen!

o.k. . . . bad analogy: the names and SSNs are kinda fixed in the
bipedal-hominid world. Well, SSNs /can/ be re-used after the hominid's term has
expired (and people can change their name), but that's still not quite right....

Just remember that the A=B mapping between the # and the Name has to take place
somewhere . . . local or distal. Convincing HOSTS (i.e., beat it into
submission with a text-editor) to lie is a way to circumvent the OS's
reaching-out on the wire to ask some other system (e.g., DNSS) it's opinion on
what # equals what Name.

...distal??....'k.... <g>

Yeah! <a-HEM>:

"The local-host bone is conected to the LAN bone.
The LAN bone is connected to the WAN bone.
And the WAN bone is connected to the Backbone.
[. . .]"

;-)

I see....yes..well...it's good that you keep your day job.

Does that mean you don't want to hear 'Old MacDonald had a Server Farm'?

Ooohooo....secrets.....kewl! <g>

'k....'s long as I don't have to be held accountable for the caper by
myself. When the questions arise as to who the culprit is, I'll just shrug
and say "Never mind the butler, the HOSTS-ess did it!"

.. . . with the modem . . . in the Office

Heh...not to worry....there's never a lack of fog in my Domain.. vbg>

Oh....yeah....there is a question that drifted in from the downlift.....when
I go to the sites, where do I find the information for the ad server that I
need to put in the HOSTS file? I know, I know...but, I haven't seen one
yet, so I don't know what I should be looking for. I guess it would be good
to know what I'm looking at, or need to look for to make it work right. ??

Ans-word by Yo better'n I

I don't use no stinkin' HOSTS file--I'm one of those
'continually-prompt-for-Permit-or-Deny' peeps . . . if I can't determine what
www.xxx.yyy.zzz is knockin', it's not coming in ;-)

That is, when I'm hooked into Windows . . . exciting, but . . . very . . . very
.. . . dangerous.

 

[YoKenny]

In all probability mvp.org was taken before mvps.org in which case it
is the Microsoft volunteer blackguards causing the confusion by
choosing their name similar to someone else's.

Maybe they think they have some sort of divine right to those
initials? They don't!

Jim.

You have your right to your opinion but people with honest ethics don't
hijack your browser's hompepage nor install software that insures that you
can not change it to what you want.

Can you provide proof of when each Web page was registered?

=== Korea one of the major sources of spam and hosts of wanabe "hackers"
=====
Trace mvp.org (220.80.108.130)
Final results obtained from whois.apnic.net.
Results:
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 220.72.0.0 - 220.87.255.255
netname: KORNET
descr: KOREA TELECOM
descr: Network Management Center
country: KR
admin-c: DL248-AP
tech-c: GK40-AP
remarks: ******************************************
remarks: Allocated to KRNIC Member.
remarks: If you would like to find assignment
remarks: information in detail please refer to
remarks: the KRNIC Whois Database at:
remarks: http://whois.nic.or.kr/english/index.html
remarks: ******************************************
mnt-by: MNT-KRNIC-AP
mnt-lower: MNT-KRNIC-AP
changed: (e-mail address removed) 20020829
status: ALLOCATED PORTABLE
source: APNIC

=== shows the registration date ======
Trace mvps.org (209.68.48.119)
OrgName: pair Networks
OrgID: PAIR
Address: 4100 Butler St
Address: Pittsburgh PA 15201
City:
StateProv:
PostalCode:
Country: US

NetRange: 209.68.0.0 - 209.68.63.255
CIDR: 209.68.0.0/18
NetName: PAIRNET
NetHandle: NET-209-68-0-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.PAIR.COM
NameServer: NS0.NS0.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1997-04-15
Updated: 2001-06-14

 

[Duane Arnold]

This warning has been posted by several MVP's in most all, if not all
of the MS newsgroups, as obviously the ruse has worked very well for
the blackards.
:-((

Jan

BTW, I did go to the mvp.org just to see what would happen and was
confident that BlackIce would stop the *Drive BY*, so I went to the site.

First of all, IE stopped the download of whatever was coming from the
site based on IE checking for certificates. BlackIce would have stopped
it too since it wouldn't have had it in its program inventory. But that
HOST file kicked in and my computer's login screen popped-up when I tried
to move away from the site. <g> I think it was trying to send some porn
stuff.

I am as pleased as an old hound dog in a fox hunt with this Host file
thing. <g>

I had a guy at work tell me today he left his browser connected to a site
and when he came back, more than a few adds were showing on the screen.
And he has some kind of malware crap on his machine. I'll hip him to the
HOST, Spybot and Ad-Aware. <g>

Later

Duane

Duane

 

[Richard Steven Hack]

Hi Richard,
Actually...Yes! ;-)) I also think it would be better for me, as a very
moderate user of the Net, to do as you say, and get a HOSTS program that
already has the lists of the ad server information, than for me to try at
this point to determine all the friends from foes

Yes, let the people who compile those lists do the work!

Thank you Richard, I really appreciate your extra time to help explain
things so that I have a much clearer understanding of all the aspects and
workings of this kind of program.

You're welcome.

Oh, by the way, when you quote a post on Usenet, try to snip out as
much stuff as you can that you're not directly replying to. It's
considered good form.

 

[Richard Steven Hack]

"The local-host bone is conected to the LAN bone.
The LAN bone is connected to the WAN bone.
And the WAN bone is connected to the Backbone.
[. . .]"

"Now hear the word of the RFC!"

 

[Jan Il]

Hi RIchard,

Oh, by the way, when you quote a post on Usenet, try to snip out as
much stuff as you can that you're not directly replying to. It's
considered good form.

Thank you, I don't wish to be an unwelcome guest. <g>

Jan

 

[Jan Il]

Hi,

Oh, I broke 'em out, alright--snapped clean in two . . . just like a goldfish in
liquid nitrogen!

...distal??....'k.... <g>

Yeah! <a-HEM>:

"The local-host bone is conected to the LAN bone.
The LAN bone is connected to the WAN bone.
And the WAN bone is connected to the Backbone.
[. . .]"

;-)

I see....yes..well...it's good that you keep your day job.

Does that mean you don't want to hear 'Old MacDonald had a Server Farm'?
Yes....

Ooohooo....secrets.....kewl! <g>

'k....'s long as I don't have to be held accountable for the caper by
myself. When the questions arise as to who the culprit is, I'll just shrug
and say "Never mind the butler, the HOSTS-ess did it!"

. . . with the modem . . . in the Office

Geeeez! Not the 'Murder by Modem' plot again? What happened to the
candlestick?

??

Ans-word by Yo better'n I
'k

I don't use no stinkin' HOSTS file--I'm one of those
'continually-prompt-for-Permit-or-Deny' peeps . . . if I can't determine what
www.xxx.yyy.zzz is knockin', it's not coming in ;-)

That is, when I'm hooked into Windows . . . exciting, but . . . very . . . very
. . . dangerous.

Ahmm...now I know what happened to the candlestick....
'Tuna!'

 

[Jan Il]

BTW, I did go to the mvp.org just to see what would happen and was
confident that BlackIce would stop the *Drive BY*, so I went to the site.

First of all, IE stopped the download of whatever was coming from the
site based on IE checking for certificates. BlackIce would have stopped
it too since it wouldn't have had it in its program inventory. But that
HOST file kicked in and my computer's login screen popped-up when I tried
to move away from the site. <g> I think it was trying to send some porn
stuff.

I am as pleased as an old hound dog in a fox hunt with this Host file
thing. <g>

I had a guy at work tell me today he left his browser connected to a site
and when he came back, more than a few adds were showing on the screen.
And he has some kind of malware crap on his machine. I'll hip him to the
HOST, Spybot and Ad-Aware. <g>

Later

Duane

Duane

 

[Jan Il]

Hi Duane,

Sorry all for the double post, I forgot and double clicked, the second, of
course, was the send button..<sigh>

BTW, I did go to the mvp.org just to see what would happen and was
confident that BlackIce would stop the *Drive BY*, so I went to the site.

First of all, IE stopped the download of whatever was coming from the
site based on IE checking for certificates. BlackIce would have stopped
it too since it wouldn't have had it in its program inventory. But that
HOST file kicked in and my computer's login screen popped-up when I tried
to move away from the site. <g> I think it was trying to send some porn
stuff.

I am as pleased as an old hound dog in a fox hunt with this Host file
thing. <g>

I had a guy at work tell me today he left his browser connected to a site
and when he came back, more than a few adds were showing on the screen.
And he has some kind of malware crap on his machine. I'll hip him to the
HOST, Spybot and Ad-Aware. <g>

That is good to hear. It's reassuring to know that things work as well as
you hope/expect them too when the time comes. It is very good to know that
IE fired the first round, and the rest followed suit and performed as they
should. ;-)Thank you for the update.

Jan

 

[Bart Bailey]

In Message-ID:<[email protected]> posted

First of all, IE stopped the download of whatever was coming from the
site based on IE checking for certificates.

The certificate that it tries to get you to accept at the site,
http://mvp.org/ is:

Name:

---begin---
pharmacycharge.com
PCM Venture I
Terms of use at www.verisign.com/RPA (c)01
Scottsdale
Arizona, US
---end---

Issuer:

---begin---
VeriSign Trust Network
www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign
---end---

Content Information:

---begin---
https://pharmacycharge.com/rxmoney/images/aron_newlook_banners2.gif
Connection : TLS v1.0 128 bit C4 (RSA/SHA)

Certificate version: 3
Serial number: 0x4CB178CE4726F49A461076A34D9CF4CE
Not valid before: Dec 9 00:00:00 2003 GMT
Not valid after: Dec 28 23:59:59 2005 GMT
Fingerprint: C5 1D BD 78 E1 28 61 DA 02 93 F7 42 F1 E5 82 23

Public key algorithm: rsaEncryption
Public-Key (1024 bit):
Modulus:
00: 57 9B 9B FA 8E 21 95 41 71 DB C0 FB 4C B1 44 2E
10: F9 8E 4C 89 23 98 98 D5 40 11 6C C6 97 AD 84 C4
20: E3 76 B0 8D 8E 63 E6 91 10 8D 93 A2 A2 E1 62 FF
30: 82 C7 A7 10 D8 A2 6F 99 6D 20 96 EA D0 17 9A 10
40: A3 5C AA 04 E2 7B 17 0A 87 E4 27 7D BF 76 CA 17
50: 7A C6 C0 9F 63 10 37 DC 8D C8 62 B0 2D EF 23 F5
60: 5C 7D EC 2C B6 7B CB B5 9A 99 BF 58 43 D1 16 FB
70: 6C 72 FE 31 D9 B5 3A 3D D1 72 AD D3 8D D4 50 CE

Exponent:
01 00 01

Signature algorithm: sha1WithRSAEncryption

00: B5 A8 9C B7 BA A1 E2 80 CE C0 BA 75 30 62 3D BD
10: 11 72 88 85 EA A1 68 95 37 27 8F E0 34 27 7F F2
20: AF 01 63 12 E7 0C D2 C9 C9 42 95 26 A5 85 A6 F5
30: B0 97 17 C5 AA CD 65 FC A7 2F 20 26 D5 7B 8E 50
40: FB 1D 04 32 07 B0 EE 4F 24 7B 4C A3 75 63 67 44
50: 95 7B 65 05 E3 4C D8 CB D5 3C DE 79 94 3A 7A 8B
60: 1D 12 F6 0D 80 17 FA 57 F1 9B 06 5F 8C 9F 28 89
70: 04 CA B8 AB 78 A0 67 53 A2 F8 4A 70 E3 ED E8 3A

Extensions:

X509v3 Basic Constraints: CA:FALSE
X509v3 Certificate Policies:
Policy: 2.16.840.1.113733.1.7.23.3
CPS: https://www.verisign.com/rpa
X509v3 Key Usage: Digital Signature, Key Encipherment
X509v3 Extended Key Usage: Netscape Server Gated Crypto, TLS Web
Server Authentication, TLS Web Client Authentication
Authority Information Access:
OCSP - URI:http://ocsp.verisign.com
X509v3 CRL Distribution Points:
URI:http://crl.verisign.com/Class3InternationalServer.crl
Unknown extension object ID 2 16 840 1 113733 1 6 7: .
0c63a58b3f2301fe7556a5abed595833
Unknown extension object ID 1 3 6 1 5 5 7 1 12:
0].[.Y0W0U..image/gif0!0.0...+.......l..pbhe.UI...2[..B.0%.#http://logo.verisign.com/vslogo.gif
---end---

 

[James Egan]

You have your right to your opinion but people with honest ethics don't
hijack your browser's hompepage nor install software that insures that you
can not change it to what you want.

Can you provide proof of when each Web page was registered?

What is actually on the site is irrelevant to the point I was making.

I haven't looked specifically, I was speaking generally about the
likelyhood of three character domain names being snapped up before
four character ones.

I would also guess that given the choice between the two, the ms
(supposedly independent) people would have chosen the three character
option if available or at the very least registered both names if both
were available.

When you choose a name with such a few characters in it you have to
expect similar names, and that mvp site does not purport in any way to
be the other site.

To register a site second and then moan about the first one is
reprehensible.


Jim.

 

[YoKenny]

What is actually on the site is irrelevant to the point I was making.

The only point you are trying to make is from the thing on top of your head.

I haven't looked specifically,

So you admit ignorance of the matter!

I was speaking generally about the
likelyhood of three character domain names being snapped up before
four character ones.

DOH! <bart simpson smily> So your assertion is that a three letter domain
name is preferable to a four letter domain. There are four letter words
that aptly describe things but in your simple mind three letters are better.

X-Newsreader: Forte Agent 1.93/32.576 English (American)

Ah yes this explains it! It's the "Simple newsreader for simple people"

I would also guess that given the choice between the two, the ms
(supposedly independent) people would have chosen the three character
option if available or at the very least registered both names if both
were available.

They would have if they had to type with one finger and half a brain using
your logic.

When you choose a name with such a few characters in it you have to
expect similar names, and that mvp site does not purport in any way to
be the other site.

It does not "purport" it just likes to "import" junk to your system.

To register a site second and then moan about the first one is
reprehensible.

DOH! We want proof! Prove that mvps.com was registered AFTER mvp.com

I gave you proof that it was not but your inability to read and comprehend
maybe clouded your mind.

By your posting maybe means you are one of the nasties trying to entice
people to get infected with their junk?
NNTP-Posting-Host: host81-129-108-36.in-addr.btopenworld.com (81.129.108.36)

 

[James Egan]

I gave you proof

You posted a current record. Big deal!

I thought you had more up top than that but it appears you're just
another moron who thinks he knows it all.

By your posting maybe means you are one of the nasties trying to entice
people to get infected with their junk?
NNTP-Posting-Host: host81-129-108-36.in-addr.btopenworld.com (81.129.108.36)

Wow! you have a newsreader which can do headers. Boy, I've got to get
me one of those!


Jim.

 

[Nadie Ninguno]

On Wed, 14 Jan 2004 13:16:47 +0000, YoKenny wrote:

X-Newsreader: Forte Agent 1.93/32.576 English (American)

Ah yes this explains it! It's the "Simple newsreader for simple people"

X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

Ah yes this explains it!
Even Simpler newsreader for even simpler people"

 

[FromTheRafters]

On Wed, 14 Jan 2004 13:16:47 +0000, YoKenny wrote:



X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

Ah yes this explains it!
Even Simpler newsreader for even simpler people"

Ho ho hehe haha oooo yah that was a good comeback! ;O)

...hey...wait a minute...I use that newsreader... (

Grrrr!

 

[Frederic Bonroy]

FromTheRafters a écrit :

..hey...wait a minute...I use that newsreader... (

A rather unpatched version of that self-appointed newsreader if
I correctly interpret its version number.

 

[FromTheRafters]

FromTheRafters a écrit :


A rather unpatched version of that self-appointed newsreader if
I correctly interpret its version number.

Yeah, it's not the latest and greatest of the line, but it works
for me. This one doesn't have an easy way to turn off HTML
when reading.

I *live* on the edge! :O)

 

[ah]

Hi,


Oh? Hmmm..must have been some really 'snappy' sandals ya had there. <g>

Well, it may have been better with some sand.

...distal??....'k.... <g>

Yeah! <a-HEM>:

"The local-host bone is conected to the LAN bone.
The LAN bone is connected to the WAN bone.
And the WAN bone is connected to the Backbone.
[. . .]"

;-)

I see....yes..well...it's good that you keep your day job.

Does that mean you don't want to hear 'Old MacDonald had a Server Farm'?
Yes....

Ah, but HOSTS is your buddy, too . . . sorta 'your partner in crime'.

But, grounding links isn't a crime . . . think of it as a little secret between
just you and your HOSTS

Ooohooo....secrets.....kewl! <g>

'k....'s long as I don't have to be held accountable for the caper by
myself. When the questions arise as to who the culprit is, I'll just shrug
and say "Never mind the butler, the HOSTS-ess did it!"

. . . with the modem . . . in the Office

Geeeez! Not the 'Murder by Modem' plot again? What happened to the
candlestick?

??

Ans-word by Yo better'n I
'k

I don't use no stinkin' HOSTS file--I'm one of those
'continually-prompt-for-Permit-or-Deny' peeps . . . if I can't determine what
www.xxx.yyy.zzz is knockin', it's not coming in ;-)

That is, when I'm hooked into Windows . . . exciting, but . . . very . . . very
. . . dangerous.

Ahmm...now I know what happened to the candlestick....

Aye; it was waxed.

'Tuna!'

Be Safe, and don't let'em get caught in the Net

 

[Jan Il]

Be Safe, and don't let'em get caught in the Net

 

[James Egan]

DOH! We want proof! Prove that mvps.com was registered AFTER mvp.com

It's .org not .com

I asked them by email.

<QUOTE>
Back when we registered mvps.org -- early in 1997 -- mvp.com, org, net
were taken. Otherwise we would have snagged it in preference to
mvps.org.

Cheers,
Felix.

</QUOTE>

All pretty much as expected, really.


Jim.