21–30 of 320 posts
The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
> Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.
The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
I doubt step-by-step instructions including a review of the script's content would improve the average user's security, in much the same way that click-through ToS dialogs always garner such much scrutiny.
Edit: another comment quoted the warning on the page, at this point it feels like complaining is tilting at windmills.
If you like a more technical solution I prefer something like running a Unbound + NSD server
Here's some great tutorials on that:
(Kudos to the people who write Calomel, i really liked these tutorials, it was a great way for me to get started and look into these services deeper once understanding what was going on here)
https://calomel.org/nsd_dns.html
https://calomel.org/unbound_dns.html
Pairing that with squid proxy can be the ultimate win:
https://calomel.org/squid.html
https://calomel.org/squid_adservers.html
https://calomel.org/squid_ua_random.html
and don't forget dnscrypt people!
I'm really big into having ones own DNS server on the network instead of completely using outside solutions. There is little overhead with a sufficiently modern implementation.
Also, these solutions run on FreeBSD/OpenBSD for those who prefer.
As a complete aside. Aren't most routers, esp. business class routers, running modified Unix/Linux anyway? Why on earth hasn't a reputable company made a guns ready router that lets you have access to the Linux/Unix underpinnings without flashing (albeit awesome) Open Source alternatives? I would think in the 'business/enterprise' class hardware side this would be more prevalent.
Maybe I just don't know of any solutions like that available stateside. I found one in Europe:
Can't get it stateside though :(
I instead custom built most of my networking hardware...but still.
This is really neat! I'm wondering why the name is so Raspberry Pi-specific ;) Is there a docker container for it already, by any chance?
From Br. Eng. "shut your piehole" (slang), meaning "shut up".
+1 for pfSense port. Also, not sure how I feel about having this device as my primary DNS server for my entire internal network. What if the project gets compromised and injects a number of malicious DNS entries, now my entire network is toast?
You can choose to only use it on the machine it is running on, or point other computers to it selectively.
The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
Why do you care so much about what people do or don't do?
Edit: We're talking about blocking ads, right? If people encouraged everyone to block ads what would happen to the economy?
The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
If you care to you can easily view the contents before executing them. `curl -sSL https://install.pi-hole.net` It's only 1400 lines of code. At least it has TLS to prevent a MITM
For instance, since browser-based ad blockers work from what I know by blocking known domain names, couldn't Google create random subdomains and serve the code from a different subdomain every day or even every few hours, as well as change the way their JavaScript and HTML looks?
Even something very expensive to run would be justified with all the money that advertising brings in.
If Google can create software that can tell what's in a picture, or if a person in a picture is happy or not, why can't they find a way to fool ad blockers..?