Poor-Mans-IDS/blacklists/README.md

ChipMaster's Black Lists
========================

These are provided simply for the curious. I'm actively using these
lists to block traffic I don't want happening. I'm very militant
about traffic on my network. I don't want my computers doing anything
I didn't ask it to do. So I block for the following reasons:

 1. I find a program reaching out across the net when there is no visual
    reason for them to do so. This could be any number of things
    like: update servers, feature use tracking, DRM tracking, ...

 2. Website advertisers: IMO these are particularly nasty. Its not
    that I necessarily have anything against a site funding itself
    with ads. Although some sites are rude in how they place them or
    they perform rude, malware like actions. But the **REAL** risk,
    as far as I'm concerned, is that many cyber-thugs use ad services
    to distribute malware. Unfortunately the ad services don't seem
    to have any interest in vetting their scuzz.

 3. Some host names are specifically used for tracking, like "g00gle
    analytics". I have nothing against a site owner wanting to know
    how their site is being used. All of us, with websites, want to
    know how popular the site is and specifically which pages are the
    most viewed and common occurring browse patterns, to tell us how
    we may be able to better our sites. But off-site trackers slow
    down my browsing experience and someone as massive as g00gle can
    aggregate this with a lot of other data sources to learn and sell
    waaay too much about me.

 4. I want to deliberately block updates. Although as a Linux user
    that's not usually my concern. But I do it for clients to prevent
    M$ and others from breaking stuff. I also do it so I won't be
    constantly hounded by "I can't update" or "there is a new
    version" messages.

 5. Unknown traffic being generated by device X, like Android
    devices. What on earth are they busy chattering about? That's
    malware like activity. Or maybe its **real** malware activity?
    =-O

 6. Some location was causing me to _wait_. Common examples are the
    "like" buttons for major social networks. The off-site hosted
    code is either large, on a slow server or behaving in suspicious
    manner like taking too much CPU power. I've had some of those
    literally lock a machine up until I kill them. If nothing else
    this is extremely poor coding but it could be worse.

 7. I just don't know what its for and I notice nothing wrong when I
    block it. :-D

 8. Something in its behavior alerts me to potential danger.

And there are other reasons something might tweak me funny and I say,
"That's enough of that."

All of that to say that the things I'm blocking might not actually be
_bad_ but they annoy me for one reason or another and it may just be
a philosophical disagreement on my part. But think about the enormous
amount of browsing information that can be accumulated by g00gle
simply hosting popular JavaScript libraries and then linking that to
your g00gle login...

Use any of this at your own peril.

- ChipMaster