T145/black-mirror

🌓 Reflection | 💿 Redundancy | ✅ Reliability

---

Aiming to promote security, safety, and sanity across the internet!

---

🛡️ Privacy Protectors

Good causes that help secure your digital life.

• Stop using Cloudflare!
• Use a pcWRT to easily secure your internet!
• Test your browser's tracking resilience with CoverYourTracks!
• Support LetsBlockIt to consolidate and simplify uBlock filters!
• Explore PrivacyGuides and Prism Break to discover services that respect your privacy!
• Use BypassPaywalls to access restricted and useful information, such as the WSJ's Facebook Files.
• Skip over URL shortener links by using FastForward, which is a better alternative to outright domain blocking.

💕 Companion Projects

Great projects that leverage Black Mirror's content!

NXDOMAIN scanner against Black Mirror's lists

🖋️ Manifesto

Please report any hosts that are wrongly blocked or sources that do not wholly align in an issue.

Defines the logic behind why a host is permitted or blocked. It has been written to reflect common ideologies across the blacklisting community and those specific to this project.

Complete author bias reflection is not intended, which is why it speaks from the Black Mirror person. Free thought exchange is encouraged, so feel free to open discussions about any points!

📋 Attributes

1. Produced in builds specific to each host's syntax.
2. Updates at 1:27 AM UTC.
3. No excess or trailing whitespace.
4. No lingering webscraper garbage.
5. Lines are terminated with lf.
6. No blank lines.
7. No comments.

🚚 Deliverables

Source Code

• Tarball
• Zipball

🧮 Checksum Evaluation

sha256sum CHECKSUMS.txt --strict

The output will print OK if the check was successful. Be sure to run the command in the same directory as the lists!

🐙 Fetching GitHub Releases

Provided below are some examples to fetch release artifacts leveraging the GitHub API.

Get all build artifacts

curl --proto '=https' --tlsv1.3 -H 'Accept: application/vnd.github.v3+json' -sSf https://api.github.com/repos/T145/black-mirror/releases/latest | jq -r '.assets[].browser_download_url'

Get a build artifact & its checksum

curl --proto '=https' --tlsv1.3 -H 'Accept: application/vnd.github.v3+json' -sSf https://api.github.com/repos/T145/black-mirror/releases/latest | jq -r '.assets[] | select(.name | startswith("BLOCK_DOMAIN")).browser_download_url'

Get a single build artifact

curl --proto '=https' --tlsv1.3 -H 'Accept: application/vnd.github.v3+json' -sSf https://api.github.com/repos/T145/black-mirror/releases/latest | jq -r '.assets[] | select(.name | startswith("BLOCK_DOMAIN")) | select(.name | endswith(".txt")).browser_download_url'

🐋 Docker Usage

To provide a temporary container to experiment with Black Mirror scripts and the CLI utilities it uses, run the following:

docker container run -it --rm -h black-mirror ghcr.io/t145/black-mirror

For a persistant container, use something like what's given below:

docker container run -it --name black-mirror -h black-mirror ghcr.io/t145/black-mirror

Then to access the container at a later date, run:

docker start black-mirror
docker exec -it black-mirror /bin/bash

To use the root user just append -u 0.

NOTE: Before using rkhunter, be sure to run:

rkhunter --update

🛠️ List Usage

Hosts File

mawk '{print "0.0.0.0 " $0}' BLOCK_DOMAIN.txt >>hosts
# mawk '{print ":: " $0}' BLOCK_DOMAIN.txt >>hosts
mawk '{print "0.0.0.0 " $0}' BLOCK_IPV4.txt >>hosts
mawk '{print ":: " $0}' BLOCK_IPV6.txt >>hosts

Dnsmasq

Many popular platforms such as OpenWRT, DDWRT, and Pi-hole use Dnsmasq as their choice TCP powerhouse. After inspecting many domain blocklists you'll inevitably run across a list in the dnsmasq.conf format. This list doesn't support it because you can use the addn-hosts parameter to add hosts in the list. Target a file that has the hosts in a format similar to the Hosts File format.

If you're using the RADVD daemon, prepend any listed hosts with ::. Otherwise, even if you have IPv6 support set up, prepend hosts with 0.0.0.0.

This has been tested across all the mentioned platforms using dig{6} on a small sample size and had each host null-routed successfully. DNSmasq's man page discusses configuration further, and DDWRT's ad blocking wiki page provides some examples.

Amazon EC2 DNS Resolver

Follow this guide to create a DNS server on an Amazon EC2 instance.

Pi-hole

If you'd like to update when some sources do or not extract a production build, just use the single-line list sources.pihole. Note that this list only contains Pihole-compatible sources, and not every handled source. Some manual configuration may also be required.

unbound

Similar to dnsmasq, but requires more manual configuration. Name any products as a *.conf file. Then follow Steffinstanly's instructions on how to apply blocklists.

personalDNSfilter

Use the domain list.

Adguard

Leverage the sources.adguard list or the domain list.

👨‍💻 Development

Workspace Setup

Install Docker, PNPM, and NodeJS. These can usually be installed with a popular package manager. The specific Node version used in this project is provided in .node-version, but any version over 16 should work. With Docker running in the background, execute pnpm lint to debug any changes.

🎉 Special Thanks

Stargazers

Forkers

🎶 Notes

Need for speed

• https://fossies.org/linux/parallel/src/parsort
• https://unix.stackexchange.com/questions/579251/how-to-use-parallel-to-speed-up-sort-for-big-files-fitting-in-ram#579252
• https://askubuntu.com/questions/1006377/check-the-max-allowed-threads-count-for-sure#1006384
• https://stackoverflow.com/questions/9066609/fastest-possible-grep

Some List References

• https://www.covert.io/threat-intelligence/
• https://filterlists.com/
• https://firebog.net/
• https://grimore.org/assets/databases/blocklist-ipsets
• https://users.cs.northwestern.edu/~jesse/course/cs214-fa19/lec/21-bloom/bloom.txt
• https://gist.github.com/jedisct1/c7548d814de2dd661f033d9cb18a0006

Lamers Unwelcome

• cybercrime-tracker
  • EMV
• MalwareBazaar
• virusbay
• malpedia
• manalyzer
• malshare
• Metasploit CVEs
• malarchive

Interesting Oddities

• https://www.chaosreigns.com/
• https://vpn.hidemyass.com/vpn-config/
• http://www.textfiles.com/programming/
• https://www.rhyolite.com//anti-spam/you-might-be.html

Big Data Lists

Typically used by other blacklist projects as whitelists.

IP Block Providers

Simply provide IP blocks for entire geographic regions.

• openportstats
• ipdeny
• IPverse