BebasID: reopening blocked sites by rewriting the hosts file

What the project is for: named domains, not whole networks

BebasID is an Indonesian project for reaching websites that are blocked. The mechanism it uses is the oldest one available to an ordinary user: the hosts file.

A hosts file maps hostnames to IP addresses before any DNS query leaves the machine. The operating system consults it first, so an entry there wins over whatever the configured resolver would return. If a domain is blocked because its DNS answer points somewhere unreachable, or because the resolver itself filters it, replacing that answer with a working one restores access to that domain. That is the whole idea, and it explains both the strength and the ceiling of the approach.

The strength is that it needs no VPN, no proxy, no root daemon and no client software. It works on a home router, on a phone, on a locked-down laptop. The ceiling is equally plain. The hosts file can only redirect names that someone has listed. It does not touch encrypted traffic, it does not help with an application that hardcodes an IP, and it does not help with a domain nobody has added.

The project also keeps a firm line on what goes in the list. The documentation states an explicit refusal: it will not help with illegal activity such as online gambling, it aims to protect internet neutrality rather than work against the law, and it will not act on requests to add gambling sites to its hosts list.

That self-restriction is not a technical detail. It is the difference between a censorship circumvention project and a gambling advertisement network, and it is stated at the top of the documentation rather than buried.

One file, several front ends: shell, PowerShell, GUI, Magisk module

The architecture is thin by design. The repository carries a `releases/` directory holding the artifacts a user actually needs, and the top-level entries include a `dev/` directory with the development resources. The core payload is the hosts list itself, fetched from the repository at install time, plus small wrappers that put it in the right place.

On Linux and macOS the wrapper is the same shell script, installed as a command called `bebasid`.

sudo wget https://raw.githubusercontent.com/bebasid/bebasid/master/releases/bebasid.sh -O /usr/local/bin/bebasid && sudo chmod +x /usr/local/bin/bebasid

Once that is in place the tool describes itself:

bebasid --help

The two platforms differ only in the downloader, curl on macOS and wget on Linux. On Windows the documented route is PowerShell, launched with elevated privileges so it can write the protected hosts file. There is also a portable Windows application called BebasHosts, a rewrite of the original GUI tool, which reduces to two batch files: one that modifies the hosts file with the BebasID list, and one that restores the hosts file to the Windows default.

Android is handled outside the script. The documentation points to the bindhosts Magisk module, which can be installed under Magisk, KernelSU or APatch, with the hosts list added to it and the action run through a WebUI.

For desktop users who prefer a GUI for managing and switching hosts files, the documentation lists SwitchHosts as a cross-platform option.

Installing only the hosts file, when you do not want the wrapper

The script is a convenience, not a requirement. Both Unix platforms document an install-only path that writes the list straight to /etc/hosts and nothing else.

On Linux:

sudo wget https://raw.githubusercontent.com/bebasid/bebasid/master/releases/hosts -O /etc/hosts

On macOS the same operation uses curl:

sudo curl https://raw.githubusercontent.com/bebasid/bebasid/master/releases/hosts -o /etc/hosts

Two things follow from this. First, the wrapper script is genuinely optional, so a user who wants to inspect the list before trusting it can fetch it and read it first. Second, the hosts file is replaced wholesale rather than appended to, which is the single most consequential fact about this project.

Overwriting /etc/hosts discards whatever was in it before: entries your organisation added, entries your own tooling relies on, a lookup table for a lab network. On Windows the equivalent risk is why the portable application ships a reset batch file that puts the file back to the Windows default. On Unix there is no equivalent in the documented commands, so the safe procedure is to keep a copy of the original yourself before the overwrite.

A second consideration is freshness. The list is fetched from the master branch of the repository at the moment you run the command, so the entries you get are whatever that branch currently contains, and there is no version pin in the URL.

When a hosts file is the wrong tool, and what to use instead

The project itself points at the alternative, which is useful because the case where the hosts file fails is easy to characterise.

If the blocked domain is not on the list, nothing happens. The list covers named domains, so a new block on a service that was never added stays blocked. If the blocking happens inside TLS, on an encrypted connection, the hosts file cannot help because the filtering is applied after name resolution. And if the blocking is a routing block rather than a resolution block, a working IP address is still not enough.

For those cases the project points to BebasDNS, its DNS variant, which serves the same list as DNS or over DoH and DoT. That is a different mechanism with a different reach: it can be pointed at as a resolver, it can work for clients that do not let you edit a hosts file, and it can cover domains as they are added, since the server holds the list. The trade is that you now depend on the resolver being reachable and trusted by your client, and the documentation makes it the fallback for people for whom the hosts approach does not fit.

The other alternative is a general-purpose circumvention tool, which differs in kind. A VPN or proxy routes your traffic, so it handles encrypted blocking, applications with hardcoded addresses and any domain on the internet. It also costs bandwidth, adds latency and gives an operator visibility into all your traffic. The hosts approach touches nothing except name resolution, and its cost is that it only covers what is listed.

There is a third, mundane option for a specific case: the project says that requests to add sites are welcome, and the contribution path is documented, so a missing domain can be raised directly.

What the DPI notice tells providers and users

One section of the documentation is aimed not at users but at internet service providers that use deep packet inspection, and it is worth reading because it explains the limits of the whole approach.

Deep packet inspection looks inside packets rather than at names, so it can act on traffic whose destination has already been resolved correctly. A hosts file cannot defeat that, because by the time the packet carries a valid IP address there is nothing left for the hosts file to change. The list works against filtering that happens at resolution time, which is where a lot of domain-level blocking actually happens, and against the practice of pointing blocked domains at a sink address.

This is also why the hosts approach is cheap to run and cheap to block. There is no tunnel, no encryption and no server infrastructure beyond the repository itself, and an operator who wanted to defeat it would have to filter the traffic rather than the name.

The practical implication for a user is that this is a targeted repair rather than a general bypass. If a specific domain matters to you, the list is the fastest route. If you need broad uncensored browsing, the DNS project or a full tunnel is the honest answer, and the documentation sends you there.

One release in 2020, commits in 2026, and an MIT licence

The release history is thin. The repository has a single published release, v1.1, described as a build from 2022.10 and dated 2020-08-20 in the metadata. The repository itself is not archived, and the last push was on 2026-10-20, so the list and the tooling are being worked on even though no new version has been tagged in years.

That gap has a practical consequence. When you install, you are not choosing a version, you are taking whatever is in the master branch at that moment. The hosts file has no version marker of its own that the install command checks, and the Windows GUI is separately described as under repair, with a status link to the BebasID-src repository for the progress.

The licence is MIT, which is the permissive choice, and it covers the code and the list. That is worth noting for a censorship project, because it means anybody can fork the list, run their own mirror and host it under their own name, which is exactly the property a list used in a hostile network needs.

The project is also part of a family rather than a lone repository. The menu at the top of the documentation points to BebasDNS for the DNS and DoH version, BebasIDIT for the IT-oriented variant, and KominFudge, each in its own repository under the same organisation. Work on the list, the DNS service and the tooling is split across those repos, so an issue may belong to a different one than the one you are reading.

Community contact runs through a Telegram channel, a Discord server and a contribution guide, and the documentation asks for pull requests on the repository itself rather than only on the site.

Editorial conclusion

BebasID fits a user in Indonesia who needs specific blocked domains to resolve again today and is willing to replace the system hosts file with a list maintained by someone else. It does not fit anyone who needs to reach a blocked domain that is not in that list, who wants selective rather than wholesale blocking, or who cannot accept a file that rewrites a core system path. Before running the installer, read the DPI notice in the project documentation and check the version of the hosts file you are about to install, because the newest published release dates from 2020 and the repository itself was last pushed on 2026-10-20.

Frequently asked questions

Official sources

1. bebasid/bebasid on GitHub
2. License: MIT
3. Project website
4. README
5. Releases