Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mmm, Pi-hole

troyhunt.com

Post reply on HN
Print view View original

161–170 of 421 posts

Re: Mmm, Pi-hole

#161

Post by badbug »

move-on-by wrote: post #148
badbug wrote: post #129

I tried pi-hole but my family couldn't make it work. Pihole blocks a lot of content they want to see, for example, email newsletters from our city gov. I understand why (privacy/tracking concerns) but it was just blocking too much and frustrating non-technical users in my house.

A lot of these list maintainers put a lot of work into not breaking things, but their are just too many websites out their to know if a block breaks one of them or not. Send the list maintainer an email - or if they are on Github/Gitlab open a ticket and have a discussion. I think you'll find many of them are happy to remove breaking domains. Of course whitelist is always an option too if the list maintainer disagree…

I spoke directly with the pihole maintainers. They took a Hardline position that them blocking email from my city was the right thing to do because it used click tracking or some other metric gathering and was deemed a privacy risk.

I understand the devotion to a cause but it was too myopic for me.

Re: Mmm, Pi-hole

#162

Post by badbug »

ObsoleteNerd wrote: post #147
badbug wrote: post #129

I tried pi-hole but my family couldn't make it work. Pihole blocks a lot of content they want to see, for example, email newsletters from our city gov. I understand why (privacy/tracking concerns) but it was just blocking too much and frustrating non-technical users in my house.

That's interesting. There's another comment further down saying it broke stuff too, but I've honestly never had that happen. The most I've ever seen it "break" anything was formatting issues when people didn't declare the ad div size. To be fair, we're very light/casual web users as most of my hobbies/entertainment are physical electronics and my wife/kids mostly watch Netflix/Stan or just browse reddit/news sites. I…

They may be suffering in silence. Ask them if any sites or emails seem broken.

Re: Mmm, Pi-hole

#163

Post by galadran »

lvh wrote: post #91
galadran wrote: post #12

Earlier quoted context omitted.

You, and the other commentator, are forgetting that the DNS Server handles all connections, not just those from your browser. Are you confident all the self updating software you use has no vulnerabilities? How about the video games that you play? Even assuming the use of HTTPS, there are other threats. For example, PiHole redirecting you to a MiTM, who simply observes your connection and can learn sensitive informat…

You don't have to be confident has "no vulnerabilities" (an absurd standard) to understand that the worst possible vuln in the DNS server (say CSRFable RCE in dnsmasq) still puts an attacker in a less privileged position than what they get if they control uBlock Origin: UXSS. Now that browsers are serious about mixed content, DNS poisoning just isn't as interesting as it used to be. Also, odds are a lot of you are ru…

I absolutely agree with you about users already running dnsmasq, but the context here is a malicious developer abusing their position. The actual quality of the software is orthogonal.

I still think you are understating the risk of a malicious DNS server. As you note, many users will have unpatched IOT or network facing devices (e.g. cameras, baby monitors or other smart gadgets). With DNS spoofing they all become vulnerable to a remote attacker...

Maybe we can agree if we consider different types of users? Technically skilled users are likely to stick to secure hardware and have an awareness of their general software vulnerability. They choose their passwords carefully and are concerned about compromise. Less saavy users are more likely to own insecure devices, use the same password everywhere and be less concerned by account compromise.

High skill users have more to fear from a Web Extension, its impact is undetectable and can siphon passwords. Low skill users have more to fear from a malicious DNS server, they won't notice the lack of HTTPS on none-HSTS sites and their hardware will get compromised remotely.

Re: Mmm, Pi-hole

#164

Post by thatcat »

windexh8er wrote: post #26

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the project has been around a number of years now, and it's not relegated to only a RPi I would have expected him to delve into things a bit more. Pi-hole will also break things. I think the common one I always heard from users on my network at home were that Google…

I assume DoH is dns over http, what is DoT?

Re: Mmm, Pi-hole

#165

Post by pbhjpbhj »

windexh8er wrote: post #26

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the project has been around a number of years now, and it's not relegated to only a RPi I would have expected him to delve into things a bit more. Pi-hole will also break things. I think the common one I always heard from users on my network at home were that Google…

On an RPi I can plug it in to the USB on my router for power and connect with ethernet. Otherwise I have to run a full powered server perpetually to manage DNS for the home network. Made sense to me.

I stopped using it as mine was seemingly hacked (100,000 lookups or so in a short time, presumably some sort of page-impression generation?) and I hadn't the time to trace if it was a problem with the project or not.

Re: Mmm, Pi-hole

#166

Post by NeedMoreTea »

ObsoleteNerd wrote: post #81

My Pi-hole with updated block lists (blocking trackers as well as ads) sits at around 87.7% requests blocked, which is absolutely mind-blowingly ridiculous. I see absolutely no negative effects browsing like this. Everything I've come across still works fine. Even sites that detect uBlock Origin and tell me to disable it, will work with that disabled and Pi-hole still blocking the ads instead. I heavily believe we sh…

> I heavily believe we should be supporting creators

As do I. There's two significant issues I have supporting most sites:

1. They provide only a subscription that is comparable cost to an old-media full subscription. Like most people in the Internet age I have a small number of main sources that I visit daily, and a much larger secondary tier where I may average one or two stories a week. Or they're the sites linked from here that I only visit when something interesting is waved under my nose.

There's no low user or micro transaction options for these, so I get a choice of pay say £10 a month or nothing, for a site I might be getting £1 or 10p a month "value" from.

2. I'm yet to find a site that takes my subscription and turns off ads and invasive tracking. Just ads. Still not an equitable deal.

Leaves things a bit stuck, and me paying out a smaller amount than I'm willing to.

Re: Mmm, Pi-hole

#167

Post by admax88q »

Why are our devices so far outside our own control that we need to run an additional device on our networks to help prevent them from making unwanted network requests?

The whole approach of Pi-hole feels misguided. Blacklisting domains and hosts should be something easily done on my device locally. Then it comes with me when I visit friends or coffee shops, and it's easy to temporarily disable when it breaks something I'm trying to use.

The fact that I can't do this on things like my phone really illustrates how little control we really have over our own computing devices.

Re: Mmm, Pi-hole

#168

Post by eximius »

1. Use Wireguard.

2. It has a DNS option[1]. Set it to your Wireguard server.

3. Setup unbound with a public ad domain list. (No link for this, Google is your friend and there are several different options with minor tradeoffs.)

You're done. Now unless wireguard, a soon to be kernel project, or unbound injects malicious code, you're safe.

Edit: oh and this also works on mobile

[1] wg-quick man page - https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick...

Re: Mmm, Pi-hole

#169

Post by reitanqild »

NeedMoreTea wrote: post #166
ObsoleteNerd wrote: post #81

My Pi-hole with updated block lists (blocking trackers as well as ads) sits at around 87.7% requests blocked, which is absolutely mind-blowingly ridiculous. I see absolutely no negative effects browsing like this. Everything I've come across still works fine. Even sites that detect uBlock Origin and tell me to disable it, will work with that disabled and Pi-hole still blocking the ads instead. I heavily believe we sh…

> I heavily believe we should be supporting creators As do I. There's two significant issues I have supporting most sites: 1. They provide only a subscription that is comparable cost to an old-media full subscription. Like most people in the Internet age I have a small number of main sources that I visit daily, and a much larger secondary tier where I may average one or two stories a week. Or they're the sites linked…

> 2. I'm yet to find a site that takes my subscription and turns off ads and invasive tracking. Just ads. Still not an equitable deal.

Ars technica. (Subscriptions are tiered but I think this is included in a low tier.)

Re: Mmm, Pi-hole

#170

Post by Spivak »

ryandrake wrote: post #155
windexh8er wrote: post #97

Earlier quoted context omitted.

I'd argue Pi-hole is quite a bit more than dnsmasq (it's actually a fork of dnsmasq called ftldns) out of the box. It's also very much more approachable by the majority and the web interface gives people immediate feedback and configurability without having to understand configurations for the services directly. https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ft... https://docs.pi-hole.net/ftldns/

Interesting, didnt realize the “pi-hole” branded package was more than vanilla dnsmasq glued together with shell scripts.

Go back in the project history and you'll see that it originally was! It's matured a lot since then.
Post reply on HN