Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mmm, Pi-hole

troyhunt.com

Post reply on HN
Print view View original

91–100 of 421 posts

Re: Mmm, Pi-hole

#91

Post by lvh »

galadran wrote: post #12
msmith wrote: post #10

Earlier quoted context omitted.

Since Pi-Hole is a DNS server running on a separate machine, it just doesn’t have the same level of access as browser extension would. Even if it was rogue, the worst it could do is share the list of domains that you visit, and possibly hijack your HTTP (but not HTTPS) sessions.

You, and the other commentator, are forgetting that the DNS Server handles all connections, not just those from your browser. Are you confident all the self updating software you use has no vulnerabilities? How about the video games that you play? Even assuming the use of HTTPS, there are other threats. For example, PiHole redirecting you to a MiTM, who simply observes your connection and can learn sensitive informat…

You don't have to be confident has "no vulnerabilities" (an absurd standard) to understand that the worst possible vuln in the DNS server (say CSRFable RCE in dnsmasq) still puts an attacker in a less privileged position than what they get if they control uBlock Origin: UXSS. Now that browsers are serious about mixed content, DNS poisoning just isn't as interesting as it used to be.

Also, odds are a lot of you are running dnsmasq on home routers already without knowing it, and those are worse from several perspectives, including patching (consider CVE-2017-14491), overall appsec vulns (CSRFable RCE: a thing in home routers!), and exploitability of network position (e.g. HTTPS stripping on any non-HSTS website).

Re: Mmm, Pi-hole

#92

Post by windexh8er »

mistermann wrote: post #60
ryandrake wrote: post #47

Earlier quoted context omitted.

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

Can anyone recommend a "2018 good choice" for a consumer router that can run custom firmware (including dnsmasq), or a trustworthy recommendation website? Wirecutter for example doesn't note third party firmware: https://thewirecutter.com/reviews/best-wi-fi-router/

https://openwrt.org/toh/views/toh_available_864

edit: link to OpenWRT with a list of supported hardware that is relevant to the parent's question

Re: Mmm, Pi-hole

#94

Post by kdot »

mistermann wrote: post #60
ryandrake wrote: post #47

Earlier quoted context omitted.

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

Can anyone recommend a "2018 good choice" for a consumer router that can run custom firmware (including dnsmasq), or a trustworthy recommendation website? Wirecutter for example doesn't note third party firmware: https://thewirecutter.com/reviews/best-wi-fi-router/

I’ve been also searching for recommendations, particularly on a custom firmware router that allows me to host a VPN server.

Re: Mmm, Pi-hole

#95

Post by lbriner »

theandrewbailey wrote: post #23
avenius wrote: post #4

It's about time this became a public discussion. Websites have become so horribly bloated, while most discussions seem to revolve around whether ads are acceptable or not.

To be fair, ads are the reason websites are bloated. I don't mind websites loading 50 MB if I'm in awe of the amazing multimedia presentation it's giving me. 50 MB of ads just... isn't.

That's not always true. Check out the new GMail, my new corporate account has no ads but it still weighs in at 25MB (well 28MB now - still asyncing stuff!) for the inbox.

In this case, the largest resources are Javascript and CSS (yes 1.2MB CSS files!). The weird thing is that it appears to be making requests with different cache-busting strings and getting resources that are the same size.

(32MB now, I haven't done anything on it since starting this post)

Re: Mmm, Pi-hole

#96

Post by JetSpiegel »

egeozcan wrote: post #34
AdmiralAsshat wrote: post #19

Earlier quoted context omitted.

Longtime uMatrix user here. The most frustrating thing about UM (which is the same problem I had with NoScript back in the day) is that some scripts call other scripts. So, particularly when I'm trying to play an embedded video served by another site served through a CDN, the process for getting the damn video to play is something like: Click video -> Open uMatrix -> whitelist some scripts -> reload -> whitelist more…

90% of the time, I just don't do that dance and not watch the video.

I copy the URL(CTRL-l CTRL-c), open a new terminal and try youtube-dl $URL

Re: Mmm, Pi-hole

#97

Post by windexh8er »

ryandrake wrote: post #47
windexh8er wrote: post #26

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the project has been around a number of years now, and it's not relegated to only a RPi I would have expected him to delve into things a bit more. Pi-hole will also break things. I think the common one I always heard from users on my network at home were that Google…

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

I'd argue Pi-hole is quite a bit more than dnsmasq (it's actually a fork of dnsmasq called ftldns) out of the box. It's also very much more approachable by the majority and the web interface gives people immediate feedback and configurability without having to understand configurations for the services directly.

https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ft...

https://docs.pi-hole.net/ftldns/

Re: Mmm, Pi-hole

#98

Post by bogomipz »

windexh8er wrote: post #26

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the project has been around a number of years now, and it's not relegated to only a RPi I would have expected him to delve into things a bit more. Pi-hole will also break things. I think the common one I always heard from users on my network at home were that Google…

Thanks for the link. I guessing this would handle the use case of being able to acess Pi-Hole while traveling or in a coffee shop correct? This seems to be a limitation of having this on a Pi.

Re: Mmm, Pi-hole

#99

Post by lvh »

Leace wrote: post #93

Are there similar projects but running on DNS-over-HTTPS(/TLS)? That way one could configure only the browser to use this and it would also work on phones that are using LTE (and not adblocking when using home Wi-Fi only) [0]. [0]: https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1...

You can run argo-tunnel/cloudflared on it and use that. You'd still be taking plain-old-DNS in, but the arguments in favor of DNS-over-HTTPS aren't as strong on a network you control.

I don't think anyone has written custom DoH stuff you can easily run yourself yet.

Re: Mmm, Pi-hole

#100

Post by givinguflac »

mistermann wrote: post #60
ryandrake wrote: post #47

Earlier quoted context omitted.

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

Can anyone recommend a "2018 good choice" for a consumer router that can run custom firmware (including dnsmasq), or a trustworthy recommendation website? Wirecutter for example doesn't note third party firmware: https://thewirecutter.com/reviews/best-wi-fi-router/

I’ve been running the mid to high end Asus routers for years now and am very happy with them. Running wrt-Merlin firmware and AB-Solution via entware is everything I need and doesn’t complicate things with additional devices like pi-hole.
Post reply on HN