KUAL Firewall with BBB filter

[knc1]

Originally Posted by zxczxc

how could i make this load at boot, so i would not have to worry about forgetting to restart it afterwards? surely there is a start up file that can be written to that could be easily implemented for everyone via a kual button?

It is part of the Kernel that is saved/restored during sleep/resume.

Which is the "normal" operation of the Kindle.

The only way it (other than by button) gets removed is by a "re-boot" of the entire system (holding the power button for 20 or more seconds).

Since I am working on an update to this add-in now - -
Please tell me why you are **re-booting** your Kindle to start it.

I really need to know your use-case to be able to account for what you need. Describe please.

- - - -

The KUAL launcher and its buttons follow the:
"Do not touch Amazon image files" rule wherever/whenever possible.

Modifying the start-up initialization files is very serious business on a Kindle system.
That is a "last resort" type of modification. Button add-ins now use various other methods to avoid any such image modification.

In the works:
Someday, RSN, the 'core' of the kual-system will be publicly introduced.
Those 'core' services will start life with a way to track and properly account for any needed changes to the Amazon image files.
And button configurations.
And inter-button communications.
And ... well, a lot of things that are in the 'core' of a real 'system'.

[twobob]

^-- This.

It's a fairly hardcore user who needs what the devs use.
Thus knc1's current solution is far more "in keeping" with the ethos of kual.

I outlined my setup to show "it can be done." As with everything I post caution required

[zxczxc]

Originally Posted by knc1

Since I am working on an update to this add-in now - -
Please tell me why you are **re-booting** your Kindle to start it.

I really need to know your use-case to be able to account for what you need. Describe please.

oh so only if you reboot the kindle that way will this hack need to be restarted? so if i install a new hack via the update menu, and the kindle starts up again, the filter will still be running? because that part of the kernel has been saved?

i'm not doing anything special, i just want to be sure that if i want to block the kindle calling home, or set up a firewall etc, that it is always in place without me having to worry about it. thank you

-edit. and thank you for the tips for how to load it on start up

[NiLuJe]

@zxczxc: Nope, FW 5.x actually *does* reboot the device after the update process (unlike previous iterations of the software).

[zxczxc]

Originally Posted by NiLuJe

@zxczxc: Nope, FW 5.x actually *does* reboot the device after the update process (unlike previous iterations of the software).

oh i never knew it didn't restart it in previous firmwares, thanks

[knc1]

Originally Posted by NiLuJe

@zxczxc: Nope, FW 5.x actually *does* reboot the device after the update process (unlike previous iterations of the software).

So for hack updates put the device in 'airplane' mode prior to the update.

For the full system image updates from Amazon, they come up with wireless enabled.
And for devices with 3G (at least the few models I have tried) the user GUI does not come up until after the 3G connection is made.

But if your quick, you can put it back into 'airplane' mode before it can finish the download.

[n3rd4i]

Hello
It is possible to incorporate Ad Block capability to this firewall application for the kindle webkit?

[knc1]

Originally Posted by n3rd4i

Hello
It is possible to incorporate Ad Block capability to this firewall application for the kindle webkit?

No.

But at least some of our browsers have Ad Block Plus built for them.

[brianinmaine]

not considered it before, but you could easily use a hosts file instead, like from here:http://pgl.yoyo.org/as/ (choose hosts file format). Then you would have to delete(backup) the original one and symlink to the one you have. Sound pretty simple? maybe append the new one to the original instead(better). Make it into a KUAL button, even doing updates... Good luck!

[knc1]

You might even be able to pull a list of domains to "block" (no-op) from the Ad Block sources.

Without that, you could just view Mobileread.com without signing in -
that should give you a pretty good list of ad providers in your browser.

[brianinmaine]

for the fun of it, I made a host file including this list:
http://pgl.yoyo.org/as/serverlist.ph...ate%5Byear%5D=

I symlinked it in, but I'm not able to test until later - no wifi here. I imagine it will be slow with >2500 ad servers listed, but then surfing on the kindle is slow anyway, so I'll see if it's work it or not.

Interesting note, you can also see the list in iptables format:
http://pgl.yoyo.org/as/iplist.php?ip...es&showintro=0
maybe thats the way to go here? just make a simple button to enable, then knc1 button to restore original firewall. sounds even easier.

EDIT: the list has REJECT, not DROP which we don't have, so it would have to run through a sed or something to change them all to DROP instead?

could still be done.

[knc1]

Originally Posted by brianinmaine

for the fun of it, I made a host file including this list:
http://pgl.yoyo.org/as/serverlist.ph...ate%5Byear%5D=

I symlinked it in, but I'm not able to test until later - no wifi here. I imagine it will be slow with >2500 ad servers listed, but then surfing on the kindle is slow anyway, so I'll see if it's work it or not.

Interesting note, you can also see the list in iptables format:
http://pgl.yoyo.org/as/iplist.php?ip...es&showintro=0
maybe thats the way to go here? just make a simple button to enable, then knc1 button to restore original firewall. sounds even easier.

EDIT: the list has REJECT, not DROP which we don't have, so it would have to run through a sed or something to change them all to DROP instead?

could still be done.

Thanks for the reminder - -
I never got back to testing and packaging up the "REJECT" target module.

Wanted to use it myself, but somehow it got lost on my to-do list.

I need to get myself organized: http://sourceforge.net/projects/dotproject/

[brianinmaine]

hosts file hack didn't work for the stock browser - will try the firewall way soon (with DROP)

edit: tried with a huge firewall file (14,000+ lines) and it just chokes. Probably a memory thing? maybe with a swap file or some more playing. I'm done, as I don't surf with this anyway - WAY TOOOO SLOWWWWW!
I used the iptables format from above, replaced all the eth0 with wlan0, all the REJECT with DROP, and all the /sbin/iptables with /usr/sbin/iptables, cut the junk out, then ran as a script. It tried to load then just keeps trying forever.

[knc1]

Ah - one note -
The Kindle DX browser is "ad proof" - even on Mobileread.

Ads almost always require Javascript support and the DX browser doesn't do JS.

[Ethereal]

I had to add an entry to allow SSH (over wifi specifically). Seems like that should be the default? I added the following to fw-base.txt:

-A wlan-in -p tcp --dport 22 -j ACCEPT