Hacker News new | ask | show | jobs
by kojoru 4622 days ago
Why do people add github's ip-addresses to their hosts file? What are the practical gains?
4 comments

practical gains? None.

theroetical gains?

* They can try to pick a server near them (I don't think the servers are geo-dist)

* No external DNS lookup (silly, whats a one-time cached 150 ms between friends)

* Immune to DNS outage (lol, if your DNS is working other stuff is prob broke..)

* More resistant to someone pretending to be github (expect that github uses HTTPS..)

So really no point I can think of... but is sure makes you computer brittle to github changing anything!

One scenario: If you have a build server, say running jenkins, that consumes PRs from your private github repo and automatically runs them, someone from your team has to store an API key on it. Now imagine an attacker has gotten access to the network and is able to perform DNS cache poisoning.
Wouldn't the attacker also have to have github keys, cause it's all HTTPS or SSH?
Contrived example: a Puppet script that configures a VM with DNS servers, which are not otherwise provided in the image or by DHCP. You need to get that script itself somehow.
I know a couple of people who work on locked-down networks with firewalls that require permitted sites to be specified by IP address. If you're not confident that DNS will always return the same IP address (e.g. round-robin DNS servers) a common tactic is add a specific IP to the hosts file to make sure it always matches the rule in the firewall.
Sometimes, DNS will break for me (someone's DNS server will get hit by a DDOS, say), and I'll add the appropriate records to my /etc/hosts to work around it. I may not notice that I've done this until several years later when it stops working because their IP address changed.