Coverity Scan Static Analysis

Coverity Scan Static Analysis

Synopsys navbar logo

Scan Home
FAQ
OSS Success Stories
Projects Using Scan
About
Community

Coverity Scan
Static Analysis
Find and fix defects in your Java, C/C++, C#, JavaScript, Ruby, or Python open source project for free

Test every line of code and potential execution path.
The root cause of each defect is clearly explained, making it easy to fix bugs
Integrated with

Linux logo
Linux reduced time to fix new defects, found by Coverity Scan, from 120 days to 5 days. Read more >>
More than 6100 open source projects and 29000 developers use Coverity Scan

“The reports from Coverity are a valuable contribution to – among others – the LibreOffice development process. ”
LibreOffice
Announcements
SCAN has been upgraded to Coverity 2019.03
2019 June 21

Please download the new build tool and upgrade your builds to take advantage of new features
Coverity SCAN upgrade in progress
2019 June 17

Project creation and access to triage data is disabled during the upgrade process.
Coverity Upgrade to 2019.03
2019 June 7

Attention SCAN users! We will begin upgrading the Coverity tools in SCAN on Monday, 17 June at 0900 MDT to make this free service even better. The SCAN team has been hard at work stabilizing the service and getting ready for this upgrade.

SCAN will be switched to read-only during the upgrade, locking registration and triage, and halting builds. Defect data may be unavailable at times. The upgrade is expected to take three to five days.

After the upgrade, a new version of the Coverity build package will be available for download. The old 8.7 version some users are still using will no longer work after the upgrade. Be sure to download the new build package.

Full details of new features are available at the Community Site.
Please Reset Your Password
2018 March 16
Community

We’ve finally launched our new community site! If you have questions regarding SCAN or are looking for answers regarding our tools, feel free to post them here.
Events
Updates

Coverity 2019.03 has been released!

There are an number of checker additions and updated language support.

The following improvements have been made:

SCALA Language analysis?
Added macOS 10.13, 10.14 support
Added Java9, java10, openjdk11 support
Added .NET Core 2.0.2-1 support
Added TypeScript support
Added Swift 3.3 and 4.1.x support

All users who are experiencing build issues should upgrade to this version; a number of bugs have been fixed with this release.
Supported Versions

Versions 8.7.0.x and older are no longer supported.

The current supported versions are:

2017.07
2019.03

Users are encouraged to download the latest tools in Downloads.

Going forward, only the latest two releases will be supported. This means projects should be expected to update their tools approximately once a year (or more frequently if you want the latest features/support).
Build Limits

The number of weekly builds per project are as follows:

Up to 28 builds per week, with a maximum of 4 builds per day, for projects with fewer than 100K lines of code
Up to 21 builds per week, with a maximum of 3 builds per day, for projects with 100K to 500K lines of code
Up to 14 builds per week, with a maximum of 2 build per day, for projects with 500K to 1 million lines of code
Up to 7 builds per week, with a maximum of 1 build per day, for projects with more than 1 million lines of code

Once a project reaches the maximum builds per week, additional build requests will be rejected.
}

Interested in open source quality?

Check out what’s happening with your favorite open source projects.
Free Report
Agile Security Manifesto

Learn how adding four principles to your Agile process can help you integrate critical security measures in a natural, efficient way.

Get the eBook
Get Started in 3 Easy Steps

icon

1. Sign up and register your project

icon

2. Upload your build for analysis

icon

3. View and fix your defects
Follow Us

About Synopsys

Application Security Testing
Software Security Services
Program Development
Training

Communities and resources

StackOverflow
Resource Library
Community

Twitter

© Synopsys, Inc. | Policy Statement | Contact
Synopsys wht
© Synopsys, Inc.

Oracle Bitmap Indexes Limitations/Restrictions

Oracle Bitmap Indexes Limitations/Restrictions

It’s All About ORACLE

Oracle – The number one Database Management System. Hope this Blog will teach a lot about oracle.

Monday, March 30, 2015
Oracle Bitmap Indexes Limitations/Restrictions
Overview
Oracle’s two major index types are Bitmap indexes and B-Tree indexes. B-Tree indexes are the regular type that OLTP systems make much use of, and bitmap indexes are a highly compressed index type that tends to be used primarily for data warehouses.

Characteristic of Bitmap Indexes

For columns with very few unique values (low cardinality)

Columns that have low cardinality are good candidates (if the cardinality of a column is 5 THEN ‘M’ ELSE ‘F’ END
FROM USER_OBJECTS;

CREATE BITMAP INDEX BTMP_EMP_IND ON BITMAP_DEMO(SEX);

Test case 1:
Update Sex on EmpID 6 ( Previous Value: M, New Value: M) and check update of sex on another M employee

Session 1:
UPDATE Bitmap_Demo SET SEX = ‘M’ where EmpId = 6;

Session 2:
SQL> UPDATE Bitmap_Demo SET Sex = ‘M’ WHERE EmpId = 7;

1 row updated.

SQL> UPDATE Bitmap_Demo SET Sex = ‘F’ WHERE EmpId = 7;

1 row updated.

SQL> INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘F’);

1 row created.

SQL> INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘M’);

1 row created.

It allowed all operations.

Test case 2:
Update Sex on EmpID 6 ( Previous Value: M; New Value: F)

Session 1:
UPDATE Bitmap_Demo SET Sex = ‘F’ WHERE EmpId = 6;

Session 2:
UPDATE Bitmap_Demo SET Sex = ‘M’ WHERE EmpId = 7;
This statement got executed.

INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘F’);
This statement hanged and waited for ROLLBACK, COMMIT operation on Session1.

UPDATE Bitmap_Demo SET Sex = ‘F’ WHERE EmpId = 7;
This statement hanged and waited for ROLLBACK, COMMIT operation on Session1.

INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘M’);
This statement hanged and waited for ROLLBACK, COMMIT operation on Session1.

Test case 3:
Insert new employee with Sex M

Session 1:
INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘M’);

Session 2:
INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘F’);
It is allowed to execute.

INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘M’);
New data insert with same Sex as in session 1. It hanged and waited for ROLLBACK, COMMIT operation on Session1.

UPDATE Bitmap_Demo SET Sex = ‘F’ WHERE EmpId = 7;
Previous Sex of EmpId 7 was also M, when tried to change it to F, it hanged. It hanged and waited for ROLLBACK, COMMIT operation on Session1.

UPDATE Bitmap_Demo SET Sex = ‘M’ WHERE EmpId = 11;
Previous Sex of EmpId 11 was also F, when tried to change it to M, it hanged. It hanged and waited for ROLLBACK, COMMIT operation on Session1.

Test Case 4:
Insert both sex in both sessions: DEADLOCK
INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘M’);
1 row created.

Session 2:
INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘F’);
1 row created.

Session 1:
INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘F’);
…… waiting ……

Session 2:
INSERT INTO Bitmap_Demo VALUES(emp_btmp.NEXTVAL, ‘M’);
…… waiting ……

Session 1: Immediately after execution of insert M in session 2, error prompt on Session 1
ERROR at line 1:
ORA-00060: deadlock detected while waiting for resource

This clarified that we should never create BITMAP index on table/columns which are updated frequently like in OLTP applications with multi-user environment.
HIMANSHU KARKI at 10:08 PM
3 comments:

BloggerOctober 10, 2016 at 7:26 PM

Did you know that you can earn cash by locking premium areas of your blog or website?
Simply open an account with Mgcash and use their Content Locking tool.
Reply
BloggerMay 2, 2017 at 7:41 PM

eToro is the ultimate forex broker for beginning and professional traders.
Reply
BloggerAugust 10, 2017 at 4:58 PM

If you need your ex-girlfriend or ex-boyfriend to come crawling back to you on their knees (even if they’re dating somebody else now) you must watch this video
right away…

(VIDEO) Why your ex will NEVER get back…
Reply



Home
View web version
About me

HIMANSHU KARKI

Welcome to the ODES scikit documentation!

Welcome to the ODES scikit documentation!

Odes
latest
Search docs
Installation
Structure of odes and User’s Guide
Choosing a Solver
Reporting Bugs, Contributing and Releasing
Citing ODES

New: DigitalOcean Marketplace Self-host Gitlab, Grafana, 1-Click Apps.
Sponsored · Ads served ethically
Odes
Docs » Welcome to the ODES scikit documentation!
Welcome to the ODES scikit documentation!
The ODES scikit provides access to Ordinary Differential Equation (ODE) solvers and Differential Algebraic Equation (DAE) solvers not included in scipy. A convenience function scikits.odes.odeint.odeint() is available for fast and fire and forget integration. Object oriented class solvers scikits.odes.ode.ode and scikits.odes.dae.dae are available for fine control. Finally, the low levels solvers are also directly exposed for specialised needs.

Detailed API documentation can be found here

Contents:

Installation
Requirements before install
Installation
Installation of ODES from git checkout
Troubleshooting
Structure of odes and User’s Guide
Simple Function Interface (odeint)
Object Oriented Interface (ode and dae)
Lower-level interfaces
Choosing a Solver
Performance of the Solvers
Reporting Bugs, Contributing and Releasing
Reporting Bugs
Getting the code
Running the Tests
Adding Examples
Building the Docs
Creating a New Release
Citing ODES
Indices and tables
Index
Module Index
Search Page
© Copyright 2016, B. Malengier Revision 463c489b.

Built with Sphinx using a theme provided by Read the Docs.

Panopticlick: Is your browser safe against tracking?

Panopticlick: Is your browser safe against tracking?

EFF logo A RESEARCH PROJECT OF THE ELECTRONIC FRONTIER FOUNDATION
DONATE
Is your browser safe against tracking?

When you visit a website, online trackers and the site itself may be able to identify you – even if you’ve installed software to protect yourself. It’s possible to configure your browser to thwart tracking, but many people don’t know how.

Panopticlick will analyze how well your browser and add-ons protect you against online tracking techniques. We’ll also see if your system is uniquely configured—and thus identifiable—even if you are using privacy-protective software. However, we only do so with your explicit consent, through the TEST ME button below.
Test me
Test with a real tracking company what’s this?

Only anonymous data will be collected through this site.

Panopticlick is a research project of the Electronic Frontier Foundation. EFF operates Panopticlick in the United States, which may not provide as much privacy protection as your home country. Panopticlick is part of an effort to illustrate the problem with tracking techniques, and help get stronger privacy protections for everyone. Learn more.
Share on Facebook Share on Twitter Share on Google+
EFF logo
A research project of the Electronic Frontier Foundation
About Panopticlick Donate to EFF Contact Privacy CC-License Paper

Renée DiResta

Renée DiResta

Renée DiResta
Home
Book
Speaking + Writing
Press
Renée DiResta
@noUpside

Twitter
LinkedIn
WIRED Ideas
Pinterest

Currently

Renée DiResta is a 2019 Mozilla Fellow in Media, Misinformation, and Trust. She investigates the spread of malign narratives across social networks, and assists policymakers in understanding and responding to the problem. She has advised Congress, the State Department, and other academic, civic, and business organizations, and has studied disinformation and computational propaganda in the context of pseudoscience conspiracies, terrorism, and state-sponsored information warfare.

Renée regularly writes and speaks about the role that tech platforms and curatorial algorithms play in the proliferation of disinformation and conspiracy theories. She is an Ideas contributor at Wired. Her tech industry writing, analysis, talks, and data visualizations have been featured or covered by numerous media outlets including the New York Times, Washington Post, CNN, CNBC, Bloomberg, Fast Company, Politico, TechCrunch, Wired, Slate, Forbes, Buzzfeed, The Economist, Journal of Commerce, and more. She is a 2019 Truman National Security Project security fellow and a Council on Foreign Relations term member.

Renée is the author of The Hardware Startup: Building your Product, Business, and Brand, published by O’Reilly Media.
Background

Previously, Renée was the Director of Research at New Knowledge. She was part of the founding team and ran marketing and business development at Haven, the transportation management technology platform that’s transforming trade logistics for commodity, CPG, and food shippers. Before that, Renée was a Principal at seed-stage venture capital fund O’Reilly AlphaTech Ventures (OATV), where she invested in early technology startups with a focus on hardware, manufacturing, and logistics companies. She spent seven years on Wall Street as an equity derivatives trader and market maker at Jane Street, a top quantitative proprietary trading firm in New York City.

Renée has degrees in Computer Science and Political Science from the Honors College at SUNY Stony Brook. She is a 2017 Presidential Leadership Scholar, a Council on Foreign Relations term member, and a Truman National Security Fellow. She is a Staff Associate at the Columbia University Data Science Institute, a Harvard Berkman-Klein Center affiliate, and is a Founding Advisor to the Center for Humane Technology. She is passionate about STEM education and childhood immunization advocacy, and is one of the co-founders of parent advocacy organization Vaccinate California. For fun, she explores data sets and loves cooking and making things. Renée and her husband, Justin Hileman, are the parents of two feisty little people.
The Disinformation Report

In late 2017, ahead of a series of Congressional hearings, Facebook, Twitter, and Alphabet each turned over a data set containing text, images, videos, and other content that they attributed to the Internet Research Agency. I led one of two teams that investigated that data set. This is the analysis, as provided to the United States Senate Select Committee on Intelligence.
Download report
The Hardware Startup
The authoritative guide for the aspiring hardware founder

This book is for entrepreneurs who want to create companies around physical products. It turns the complex process of building a hardware startup into a series of accessible steps, to guide founders from the earliest stage of an idea to a beautiful final product that sells.

Written by three experts with deep experience in hardware businesses, The Hardware Startup gives you practical strategies for funding, market research, branding, prototyping, manufacturing, and distribution. Two dozen case studies of real-world startups illustrate possible successes and failures at every stage of the process.
Learn more
Speaking + writing

I write and speak about influence operations, the algorithms that shape our society, and tech policy. Here are a few selections.
Featured talks

The Internet’s Original Sin MozFest keynote
The Lunatics are Running the Asylum: Conspiracy Theories and the Social Web Ignite @ Google I/O
Democracy: Fixing It is Up to Us Personal Democracy Forum 2018 keynote
Senate Intelligence Committee hearing on Foreign Influence and Social Media C-SPAN

Essays

“The Digital Maginot Line” Ribbonfarm
“There are bots. Look around.” Ribbonfarm
“Crowds and Technology” Ribbonfarm
“Computational Propaganda: If You Make It Trend, You Make It True” The Yale Review

Tech + policy

“Information Operations are a Cybersecurity Problem: Toward a New Strategic Paradigm to Combat Disinformation” Just Security
“The Facebook hearings remind us: information warfare is here to stay” The Guardian
“Why Facebook and Twitter Can’t Be Trusted to Police Themselves” POLITICO Magazine
“Free Speech Is Not the Same As Free Reach” WIRED
“Up Next: A Better Recommendation System” WIRED

Disinformation research

“What We Now Know About Russian Disinformation” The New York Times (op. ed.)
“Manipulating Consumption” Data for Democracy
“How Social Network Manipulation Tactics Are Impacting Amazon and Influencing Consumers” lecture at the Berkman Klein Center at Harvard University (video)
”Social Media and Public Health Misinformation” lecture at U.C. Berkeley School of Public Health (video)
“Social Network Algorithms Are Distorting Reality By Boosting Conspiracy Theories” Fast Company Co.Exist
“The Bots That Are Changing Politics” Motherboard
“Anti-Vaxxers Are Using Twitter to Manipulate a Vaccine Bill” WIRED
”The Complexity of Simply Searching for Medical Advice” WIRED

Hardware + business

“7 Crucial Ingredients for Your Investor Pitch to Fund a Hardware Startup” Line // Shape // Space, by Autodesk
Women 2.0 Contributions on venture investing, startups, and entrepreneurship
Fireside Chat on “The Hardware Startup” Solid Conference 2015 (video)
Hardware By The Numbers Solid Conference 2014 keynote (video)
Hardware Trends: Getting It Made Autodesk University Innovation Forum (video)

Tech + logistics

“Working on a More Well-Oiled Palm Oil Supply Chain” Supply & Demand Chain Executive
Disrupting 90% of Everything Startupfest keynote (video)
Logistics 101 Hardwired NYC (video)

Selected press
Profiles

“She Warned of ‘Peer-to-Peer Misinformation.’ Congress Listened.” The New York Times
“Renée DiResta: Putting ‘Numbers, Systems, And Efficiency’ To Work In A Classic Un-Career” Women@Forbes

Conversations

“The Information War — A Conversation with Renée DiResta” Waking Up with Sam Harris
“Joe Rogan Experience #1263 – Renée DiResta” The Joe Rogan Experience
“Voters were targeted by disinformation online in 2016. How screwed are we this year? — Data for Democracy policy head Renée DiResta answers disinformation questions” Recode’s “Too Embarrassed to Ask”
“Renee DiResta: Misinformation is a ‘chronic condition’” Reliable Sources, CNN
“Renee DiResta on The Open Mind: Ethical and Societal Implications of Technology” The Open Mind, PBS (video)
“Everything is a marketing campaign now, even policy ideas” – Renee DiResta Connecting Politics, Anti-Vaxxers & Social Media Hunter Walk
“Manipulating the YouTube Algorithm” Smarter Every Day
“Twitter Platform Manipulation” Smarter Every Day
“People are Manipulating You on Facebook” Smarter Every Day

Coverage

“How merchants use Facebook to flood Amazon with fake reviews” The Washington Post
“Inside the Two Years That Shook Facebook—and the World” WIRED
“These 8 Entrepreneurs Are Changing What It Looks Like To Be A Working Parent” Forbes
“The 55 Unknown Rock Stars In Tech, According To Marc Andreessen” A funny and random listicle of exceptional people I was pleased to meet as a result of being included

Twitter
LinkedIn
WIRED Ideas
Pinterest

Policy.
Hardware.
Technology.

Copyright © 2019 Renée DiResta.

RAMBleed Reading Bits in Memory Without Accessing Them

RAMBleed Reading Bits in Memory Without Accessing Them

RAMBleed
Reading Bits in Memory Without Accessing Them
RAMBleed is a side-channel attack that enables an attacker to read out physical memory belonging to other processes. The implications of violating arbitrary privilege boundaries are numerous, and vary in severity based on the other software running on the target machine. As an example, in our paper we demonstrate an attack against OpenSSH in which we use RAMBleed to leak a 2048 bit RSA key. However, RAMBleed can be used for reading other data as well.

RAMBleed is based on a previous side channel called Rowhammer, which enables an attacker to flip bits in the memory space of other processes. We show in our paper that an attacker, by observing Rowhammer-induced bit flips in her own memory, can deduce the values in nearby DRAM rows. Thus, RAMBleed shifts Rowhammer from being a threat not only to integrity, but confidentiality as well. Furthermore, unlike Rowhammer, RAMBleed does not require persistent bit flips, and is thus effective against ECC memory commonly used by server computers.

We will present our paper titled “RAMBleed: Reading Bits in Memory Without Accessing Them” at the 41st IEEE Symposium on Security and Privacy in May, 2020.

Read the Paper Cite
People
RAMBleed was discovered by the following joint team of academic researchers:

Andrew Kwong at University of Michigan
Daniel Genkin at University of Michigan
Daniel Gruss at Graz University of Technology
Yuval Yarom at University of Adelaide and Data 61.
University of Michigan logo
Gratz logo
The University of Adelaide logo
Data61 logo
Q&A
What is the Rowhammer bug?
The trend towards increasing DRAM cell density and decreasing capacitor size over the past decades has given rise to a reliability issue known as Rowhammer. Specifically, repeated accesses to rows in DRAM can lead to bit flips in neighboring rows (not only the direct neighbors), even if these neighboring rows are not accessed.

Attackers can exploit these cross process bit flips for a myriad of security breaches. Researchers have demonstrated how to abuse Rowhammer for privilege escalation, RSA modulus factorization, and more.

What is RAMBleed?
Previous attacks exploited the Rowhammer effect to write (or flip) bits in the victim’s memory. RAMBleed is different in that it uses Rowhammer for reading data stored inside the computer’s physical memory. As the physical memory is shared among all process in the system, this puts all processes at risk.

What data can be read by RAMBleed?
While the end-to-end attack we demonstrated read out OpenSSH 7.9’s RSA key, RAMBleed can potentially read any data stored in memory. In practice, what can be read depends on the victim program’s memory access patterns.

You extracted an OpenSSH key!? Does that mean that I should stop using SSH?
There is nothing particularly vulnerable about OpenSSH, it was simply a convenient target to demonstrate RAMBleed’s security implications. We don’t recommend that you stop using SSH any more than we recommend that you stop using the internet.

What technologies are affected by RAMBleed?
RAMBleed relies on Rowhammer-induced bit flips to read privileged memory. As such, any system that uses Rowhammer-susceptible DIMMs is vulnerable. Previous research has demonstrated bit flips on both DDR3 and DDR4 with TRR (targeted row refresh) enabled. While we demonstrated our attack on a desktop machine and an ECC enabled server machine, Rowhammer attacks have been demonstrated against both mobile devices and laptops. As such, we suspect that many classes of computers are susceptible to RAMBleed.

Does ECC (Error Correcting Code) memory prevent RAMBleed?
No! RAMBleed uses bit flips as a read side channel, and as such does not require bit flips to be persistent. Instead, the attacker merely needs to know that a bit flip occurred; the secret information leaks regardless of whether or not ECC corrects the flip.

If ECC corrects the flip, how can the attacker determine whether or not a bit has flipped in her memory? The attacker can read her memory and use the ECC timing side channel to determine if the bit flipped. As described by Cocojar et al., when the hardware corrects the bit flip, a large delay is induced on that particular memory access. On our setup, we found an even stronger signal than previously reported, with a 1,000,000 X slowdown over the common case.

How can I mitigate this issue?
Users can mitigate their risk by upgrading their memory to DDR4 with targeted row refresh (TRR) enabled. While Rowhammer-induced bit flips have been demonstrated on TRR, it is harder to accomplish in practice.

Memory manufacturers can help mitigate this issue by more rigorously testing for faulty DIMMs. Furthermore, publicly documenting vendor specific TRR implementations will facilitate a stronger development process as security researchers probe such implementations for weaknesses.

Can RAMBleed be detected by antivirus?
We believe that it is very unlikely that any antivirus software on the market currently detects RAMBleed.

Was RAMBleed ever exploited in the wild?
It is not possible for us to say definitively, but we believe it to be unlikely.

How does RAMBleed work?
Rowhammer induced bit flips are data dependent, i.e. a bit is more likely to flip when the bits above and below it have the opposite charge. This creates a data-dependent side channel, wherein an attacker can deduce the values of bits in nearby rows by observing bit flips in her own memory rows. Finally, as the data in nearby rows might belong to a different process, this leakage breaks the isolation boundaries enforced by the operating system.

To exploit this effect, we developed novel memory massaging techniques to carefully place the victim’s secret data in the rows above and below the attacker’s memory row. This causes the bit flips in the attacker’s rows to depend on the values of the victim’s secret data. The attacker can then use Rowhammer to induce bit flips in her own memory, thereby leaking the victim’s secret data.

Is there a CVE number?
Yes, see CVE-2019-0174.

Why is it called RAMBleed?
Due to deficiencies in the memory modules, the RAM bleeds its contents, which we then recover through a side-channel.

Can I use the logo?
All rights to the logo have been waived through CC0. Marina Minkin designed the logo.

Acknowledgments
This research was partially supported by Intel.

The Big Blocklist Collection

The Big Blocklist Collection

The Firebog
The Big Blocklist Collection
The Internet is full of unsavoury content: advertisers wanting to sell you stuff you don’t need, trackers extracting and selling your data as if it were oil, and malicious content vying to hijack your favourite device. This collection hopes to help you minimise these issues, and to maintain a more enjoyable online presence, using the wonderful, free and open source utility known as Pi-hole.

On arrival, like a growing number of websites, Forbes asked readers to turn off ad blockers in order to view the article. After doing so, visitors were immediately served with pop-under malware, primed to infect their computers, and likely silently steal passwords, personal data and banking information. Or, as is popular worldwide with these malware “exploit kits,” lock up their hard drives in exchange for Bitcoin ransom.
‘Forbes Site, After Begging You To Turn Off Adblocker, Serves Up A Steaming Pile Of Malware ‘Ads” – Techdirt, 2016
Before starting, here are some reading points:
Lists bulleted with a tick are least likely to interfere with browsing
Lists bulleted with a cross block multiple useful sites (e.g: Pi-hole updates, Amazon, Netflix)
A guide on how to add these lists is found here
If you wish to automate the update of your adlists.list, a text-only version is found here
Using lists hosted at v.firebog.net allows me to view very basic ongoing aggregated statistics via CloudFlare
These lists are painstakingly curated by their respective maintainers. Please contact them first if you find false positives
Avoid using mirrored consolidated lists, if possible; it deprives the original list maintainer of visits (meaning they may be less inclined to keep it up to date!)
Suspicious Lists
https://hosts-file.net/grm.txt
https://reddestdream.github.io/Projects/MinimalHosts/etc/MinimalHostsBlocker/minimalhosts
https://raw.githubusercontent.com/StevenBlack/hosts/master/data/KADhosts/hosts
https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Spam/hosts
https://v.firebog.net/hosts/static/w3kbl.txt
https://v.firebog.net/hosts/BillStearns.txt
http://sysctl.org/cameleon/hosts
https://www.dshield.org/feeds/suspiciousdomains_Low.txt
https://www.dshield.org/feeds/suspiciousdomains_Medium.txt
https://www.dshield.org/feeds/suspiciousdomains_High.txt
https://www.joewein.net/dl/bl/dom-bl-base.txt
https://raw.githubusercontent.com/matomo-org/referrer-spam-blacklist/master/spammers.txt
https://hostsfile.org/Downloads/hosts.txt
https://someonewhocares.org/hosts/zero/hosts
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt
https://raw.githubusercontent.com/vokins/yhosts/master/hosts
http://winhelp2002.mvps.org/hosts.txt
https://hostsfile.mine.nu/hosts0.txt
https://v.firebog.net/hosts/Kowabit.txt
https://adblock.mahakala.is
Advertising Lists
https://adaway.org/hosts.txt
https://v.firebog.net/hosts/AdguardDNS.txt
https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://hosts-file.net/ad_servers.txt
https://v.firebog.net/hosts/Easylist.txt
https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts;showintro=0
https://raw.githubusercontent.com/StevenBlack/hosts/master/data/UncheckyAds/hosts
https://www.squidblacklist.org/downloads/dg-ads.acl
Tracking & Telemetry Lists
https://v.firebog.net/hosts/Easyprivacy.txt
https://v.firebog.net/hosts/Prigent-Ads.txt
https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.2o7Net/hosts
https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/android-tracking.txt
https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt
https://v.firebog.net/hosts/Airelle-trc.txt
Malicious Lists
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
https://mirror1.malwaredomains.com/files/justdomains
https://hosts-file.net/exp.txt
https://hosts-file.net/emd.txt
https://hosts-file.net/psh.txt
https://mirror.cedia.org.ec/malwaredomains/immortal_domains.txt
https://www.malwaredomainlist.com/hostslist/hosts.txt
https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt
https://v.firebog.net/hosts/Prigent-Malware.txt
https://v.firebog.net/hosts/Prigent-Phishing.txt
https://phishing.army/download/phishing_army_blocklist_extended.txt
https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/CW_C2_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/LY_C2_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/TC_C2_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/TL_C2_DOMBL.txt
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist
https://v.firebog.net/hosts/Shalla-mal.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Risk/hosts
https://www.squidblacklist.org/downloads/dg-malicious.acl
https://raw.githubusercontent.com/HorusTeknoloji/TR-PhishingList/master/url-lists.txt
https://v.firebog.net/hosts/Airelle-hrsk.txt
Other Lists
https://github.com/chadmayfield/pihole-blocklists/raw/master/lists/pi_blocklist_porn_all.list
https://raw.githubusercontent.com/chadmayfield/pihole-blocklists/master/lists/pi_blocklist_porn_top1m.list
https://zerodot1.gitlab.io/CoinBlockerLists/hosts
https://raw.githubusercontent.com/anudeepND/blacklist/master/facebook.txt
Whitelisting Suggestions
The more blocklists you add, the more likely you’ll come across a false positive. First, you’ll want to check out Commonly Whitelisted Domains over at the Pi-hole forum, followed up by anudeepND’s curated whitelist, and then you can see if anything below is relevant to your interests.

Tip: Whitelisting and Blacklisting can be performed on multiple sites seperated by a space; e.g: pihole -w foo.bar.com baz.com
Amazon Web Services (Kowabit)
s3.amazonaws.com
Google Content (Andy Short)
clients2.google.com
clients3.google.com
clients4.google.com
clients5.google.com
Link Shortners (Openphish, Hostsfile.org)
http://www.bit.ly
bit.ly
ow.ly
j.mp
goo.gl
tinyurl.com
Microsoft Connectivity Checker (Mahakala)
msftncsi.com
http://www.msftncsi.com
EA / Origin (Mahakala, Andy Short, Cameleon & others)
ea.com
cdn.optimizely.com (Used by Origin for content delivery)
Blocked by Mahakala
res.cloudinary.com (Used by Facebook for image uploads)
gravatar.com
rover.ebay.com
imgs.xkcd.com
Blocked by Andy Short
netflix.com
alluremedia.com.au (Used by Gizmodo sites)
tomshardware.com
Blocked by Reddestdream
ocsp.apple.com (Used by Apple devices for certificate validation)
Blocked by various lists
s.shopify.com
keystone.mwbsys.com (Malwarebytes server)
dl.dropbox.com
api.ipify.org
This site’s content created & maintained by WaLLy3K