Hosts file localhost loopback failure for 127.0.0.1 twitter.com

General information.
https://en.wikiversity.org/wiki/Hosts_file
https://en.wikipedia.org/wiki/Hosts_(file)
https://en.wikipedia.org/wiki/Localhost
https://en.wikipedia.org/wiki/Loopback
https://en.wikipedia.org/wiki/Reserved_IP_addresses
https://en.wikipedia.org/wiki/Bogon_filtering
https://en.wikipedia.org/wiki/Virtual_network_interface

6.3. Domain Name Reservation Considerations for “localhost.”
https://www.rfc-editor.org/rfc/rfc6761.html

3.2.1.3 Addressing
(g) { 127, < any > }

           Internal host loopback address.  Addresses of this form
            MUST NOT appear outside a host.

https://www.rfc-editor.org/rfc/rfc1122.html

IANA IPv4 Special-Purpose Address Registry
https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml

Please raise a Class 0 criticality defect with immediate effect.

https://en.wikipedia.org/wiki/Defect_criticality

Brave or Chromium or both are non conformant with IETF and IANA.

There are multiple issues which all likely need separate but related defects raised.

Internal host loop back address is likely the most pressing.

The testing above would seem to indicate strongly that despite a domain name being assigned an 127 < any > loopback address Brave forwards the domain name for resolution by a regional DNS or its own DNS for resolution.

As specified by IETF 1122

Brave and/or Chromium appear to be favouring Internet Protocols in the Application Layer like DNS above lower level Internet Protocols in the Internet Layer like IP (v4 v6) .

https://en.wikipedia.org/wiki/Internet_Protocol

The browser is acting as a de facto Virtual Network Interface.

In the ISO model the respective layers are Application and Network.

https://en.wikipedia.org/wiki/OSI_model

The lower level Internet/Network layer should take precedence over the higher level Application layer.

The mastheads in the images of the news outlets cbsnews and inews in the thread above indicates an http server associated with the domain name has returned a default HTTP response to its own bogon filtering. This poses at minimum a security risk as the host that allocated the loopback address did not want the domain to be contacted. Ignoring the loopback address and applying DNS resolution and forwarding an HTTP request is a breach of trust.

Further the response message is clearly not true, that is it is false. Both the domain which sent the response and the host which received the response are clearly ‘online’ and there is an ‘internet connection’. A response from the domain to a request the host was intent should never be sent in the first place. This message will confuse an inexperienced or naïve user. The message, in these two cases from a news organisation, is ‘fake news’. Although it is likely the intent was good to provide a user friendly message.

The default response from other news organisations throws an exception that is a little more honest. The connection was refused, probably due to bogon filtering, by the domain. Again to note no request was sought and no response expected. Therefore also providing confusion to an inexperienced or naïve user.

It will be interesting to see if these sites owners opt for free advertising with a mast head display or report the issue for resolution to stay in line with, conformant to, IETF specifications and IANA guidance. That is they should not be receiving these bogus logon bogon messages in the first place. However communication in regard to this topic would likely be request to the domains ISP from internal networking staff. This is amongst other things a separation of concern issue. Network admins would not expect the Application layer to highjack Internet/Network layer internet protocols as this is a network security issue.

It is likely at the domain side this is lost in low level logging and there is little or no reporting up lines of responsibility. Network management at this level for a large corporate is likely outsourced in part to an IT Services Provider. Particularly for webhosting. For an SME it would likely not even register. Reporting would therefore likely not even reach service owner managers or if it did appear seemingly so low level as to not bother reporting to the enterprise architecture practice let alone the CIO or CSO or COO and there would be no board visibility of the issue.

Yet it should. As loopbacks might have been set as one means adhere to internal policy or external regulation. Loopbacks might also have been used to stop communication with competitors from insiders,. See also regulation like MiFID II on separation between business functions. Digital hygiene issues. And so on.

To be clear, the internal loopback defect is a back door for communication which had been presumed shut.

protocol://domain = address
/resource = postbox, dropbox
? query string = payload, message,
and for the HTTP protocol HTTP header information.

In IoT parlance communication which might include inter alia; H2H, H2M, M2H, M2M.

0 - Affects critical data or functionality and leaves users with no workaround
Class 0
Stability, Reliability and Availability
Security
Legal (Liability, ADA, Copyright)
Testability
Storage (data loss/corruption)

Please advise on the timeline for the resolution of this defect.

Just speaking for myself here and not anyone else, I can’t keep up with this thread. Tossing an overwhelming amount of background info out there and expecting community volunteer folks to follow along – and document – every detail of something that may or may even be normal behavior, is going to steer people away. The whole thing could probably have been summarized in a paragraph, with simple and succinct observations and tests.

If I get time in the next few days I will see if I can at least reproduce the issue on my end in a VM. But if you really want to ‘raise a defect’ then the place to do that is here: https://github.com/brave/brave-browser/issues/

One other thing I suggest you do though, since it seems you have considerable time and interest devoted to this, is download or clone a copy of the GitHub repo and search the code for ‘twitter’ and see if there’s any “special” handling of Twitter for some reason.

Some of the various search results I’ve come across indicated there might be things baked into Chromium to protect certain popular – but highly targeted – sites from being hijacked by subverting local name resolution. I didn’t bother to validate any of it, but the above is how you might approach it if you wanted to rule it out.

And then if you do find that it’s something originating with Chromium, you can deal with that here: https://bugs.chromium.org/p/chromium/issues/list

Lastly, taking a step back a bit, if you’re considering using ‘hosts’ entries as some sort of general-purpose site blocking tool, you may want to re-think that as it is not generally scalable. I think we get that you want to block Twitter and that’s fine, but maybe starting off with a simple ‘problem statement’ (either in this forum or elsewhere) might get you some other ideas on how best to solve that problem – even if it isn’t by fiddling with /etc/hosts.

Thanks @JimB1 for the feedback and links.

It was not the expectation that community members would necessarily do the documentation. Any directives were as much to self, see workings out below, as well as seeking an understanding of the issue.

Regarding hosts file it is an example of a single point from which any browser can be ‘configured’ externally. It is used solely as an example in relation to other posts elsewhere on a single source to simultaneously set many distinct browsers behaviour.

You are right to point out the hosts file is suboptimal for blacklist capability. It does not permit resource level blocking. It also has no whitelist capability.

The use of the hosts file had unintended consequences in terms of expected browser behaviour. The anomalous behaviour should not have occurred which is why it was unexpected. The community forum seemed like a good a place to seek help in understanding the issues found.

The intention with the background information was to support the theory proposed. It was also a convenient place to put reference sources during troubleshooting. So they might be found easily again and others would have access to them too. The post was used as a ‘Notebook’ for problem solving and reasoning. Workings out, notes to self, and aide-mémoire.

The hosts file issue is also one that crops up in many other forums. As do internal loopback and localhost issues. Not in relation to Brave but other browsers. Also in relation to other scenarios many to do with development environments.

The thread of this post helps to find a prospective explanation to some of these issues in this forum and others.

Both your input and that of @anon57438784 were very helpful and informative. In fact the line of reasoning finally arrived at could not have happend without both your insight. Thanks to both.

A misspelling of the domain name

https://m.facsbook.com/
DNS_PROBE_POSSIBLE

Spelled correctly

https://m.facebook.com/
ERR_CONNECTION_REFUSED

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.