Short Answer
Is it safe to use the /etc/hosts file as a website blocking "null" address?
I would argue the answer should be: No.
If for no other reason than the requests are not actually "nulled". They are still active requests. And as the OP indicates, since the requests are for legitimate Internet hosts, this sort of short cut method of redirecting requests to localhost may interfere with testing networking code in a development environment.
Perhaps a better method of blocking traffic to and from certain Internet hosts, is to utilize iptables which is the interface to the Linux kernel's firewall. iptables is the default networking rule table for most GNU/Linux systems. Some distros use ufw as a front-end to iptables.
If you want to use iptables, here's a simple script which will DROP all incoming and outgoing packets for a list of IP addresses or hostnames with one address or hostname per line contained in a plain text file called ~/blocking.txt
## Block every IP address in ~/blocking.txt
## DROP incoming packets to avoid information leak about your hosts firewall
## (HT to Conor Mancone) REJECT outgoing packets to avoid browser wait
for i in $(cat ~/blocking.txt); do
echo "Blocking all traffic to and from $i"
/sbin/iptables -I INPUT -s $i -j DROP
/sbin/iptables -I OUTPUT -d $i -j REJECT
done
Sample ~/blocking.txt
websiteiwanttoblock.com
anotherone.com
ip.add.of.net/mask
Do not place your localhost IP addresses in this file.
Longer Answer
While reassigning Internet hosts to localhost in the /etc/hosts file is a common short cut technique to block unwanted Internet hosts, this method has some serious security drawbacks.
Incoming requests
Incoming requests which were not purposefully initiated via a specific user request. The most common example is ads on webpages. Let's follow the incoming packets...
First, I start up wireshark. Then I place the biggest Internet ad company in my /etc/hosts file with this line:
127.0.0.1 google.com
And then disable all ad blockers in my browser, navigate to youtube and play any random video.
If I filter my packets, broadly including Google's IP address space:
ip.addr==172.217.0.0/16
I am still receiving packets from Google.
What does this mean?
It means that there is a possibility of a malicious server inserting malware which may be able to attack my computing platform via packets that are still arriving and sent to localhost. The use of /etc/hosts rather than dropping or rejecting the packets via the firewall rules, is a poor security measure. It does not block incoming packets from possible malicious hosts, nor does it provide effective feedback for trouble shooting purposes.
Outgoing requests
Outgoing requests which are sent to localhost rather than being rejected or dropped by the firwall rules are still being processed by the kernel. There are a few undesirable actions that occur when /etc/hosts is used rather than the firewall:
Extra processing is occurring when the outgoing packet hits localhost. For example, if a webserver is running on the host, the packet sent to localhost may be processed by the webserver.
The feedback from outgoing requests may become confusing if the /etc/hosts is populated with certain domains.
iptables can handle lots of rules
According to some:
ServerFault: How many rules can iptables support
A possible theoretical limit on a 32-bit machine is 38 million rules. However, as noted in the referenced post, as the iptables rule list expands so does the needed kernel memory.
\WINDOWS\system32\drivers\etc\hoststo block Reddit, Facebook, YouTube and a bunch of others! Everyone should! In order to perform a XSS attack, someone would have to hack a public site they know you do visit, create a link to a site they know you block, and exploit a vulnerability in your development software. They would have to access your system in the first place to know the last two bits of info. The odds are so astronomical it would be easier to hack your OS directly. I never worry because my dev software is always secure :).ssh 0.0.0.0, then callnetstat, you'll see a connection from 127.0.0.1 to 127.0.0.1. It's kind of hard to tell your webserver to serve requests from localhost, but refuse these 0.0.0.0 requests.