Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mmm, Pi-hole

troyhunt.com

Post reply on HN
Print view View original

211–220 of 421 posts

Re: Mmm, Pi-hole

#211

Post by a_imho »

erikpukinskis wrote: post #205

I fundamentally believe we have the right to transform content that comes to our devices. The idea that we have a moral duty to sit passively and absorb “experiences” in their intended form... I just don’t see how that works long term. It will just mean we get abused more and more and we have to take it. No, if you want my business you have to find a way into my consciousness that is compatible with the way I arrange…

You don't have to sit passively, you don't even have to block passively, consider using / contributing to services like AdNauseam or Noiszy.

Re: Mmm, Pi-hole

#212

Post by moftz »

biktor_gj wrote: post #190
upofadown wrote: post #177

Earlier quoted context omitted.

You can edit the hosts file on Android apparently and the Pi-hole is just a shared hosts file.

It's a self-updating hosts file. If you only do it once in a month you'll start seeing ads again. Also you can edit the hosts file if you're rooted, but you definitely can't if you're running a stock unmodified ROM. If you're rooted and you only care about your Android phone, you can also install Adaway, which does pretty much the same thing without the whitelist capability (Get it on F-Droid), but if you have a numb…

Host file blocking on mobile devices produces some weird web browsing. I like using browser plugins because it gets rid of the whole chunk of html so it's like the ad was never there in the first place. On android, there are these huge blank spots you have to scroll past to keep reading. I still keep adaway on but I wish I could just use ublock origin with android's chrome.

Re: Mmm, Pi-hole

#213

Post by abraham_lincoln »

ObsoleteNerd wrote: post #202
abraham_lincoln wrote: post #193

Earlier quoted context omitted.

What about WS2811s with a pushbutton to temporarily disable, or a pushbutton on one of the GPIO pins, with the switch in a central location?

The included dashboard with the pi-hole is incredibly easy to use, so I just have it bookmarked on all our browsers in case someone in my family needs to pause it or whitelist/blacklist a site. We barely ever have to touch it though, mostly just to update the blocklists occasionally.

I was thinking use-cases for house guests or very non-technical folks (what is a bookmark?).

Re: Mmm, Pi-hole

#214

Post by moftz »

krylon wrote: post #32
WorkLifeBalance wrote: post #16

Someone on here recently recommended uMatrix for this purpose and I find that a nice trade-off between usability and request blocking. It's an extension but given it's less opaque than a generic ad-blocker I feel more in control and that it's less likely to go 'rogue' like adblockers do.

I am happy with uMatrix, too, but FWIW, I could not recommend it to non-technical or impatient people. For many pages, I require multiple iterations of stepwise refining of what is and is not allowed before a site works for me. I do not mind, but I can imagine it easily gets annoying for many people rather quickly. (OTOH, those people would not care to set up Pi-hole, either.)

I would rather spend some time setting up a solution with minimal maintenance than constantly be adjusting and tweaking my solution to get things to work just to browse the web. I use uBo because I rarely have to go in an tweak something and it's mostly just a temporary pause on blocking. A pi-hole might be nice but I like how plugins actually remove the spot where the ad once was so the site looks less like swiss cheese.

Re: Mmm, Pi-hole

#215

Post by jonnycoder »

jumbopapa wrote: post #37
josefresco wrote: post #3

> And yes, I'll chat to her about the Fox News situation as well! Highlight of the article right here.

I don't really see why he had to make mention of it.

Exactly, heaven forbid we read different new sources to view different biases and takes on stories.

Re: Mmm, Pi-hole

#217

Post by ethagnawl »

zacwest wrote: post #206
ethagnawl wrote: post #187

Earlier quoted context omitted.

Surprisingly, I've yet to see a service which fronts Pi-Hole or similar and allows you to point your DNS resolver(?) at it, so you can use it on the go -- without having to use a VPN. I tried to set this up on my own using a VPS and Pi-Hole and it did work for a while. However, bad actors eventually found the server and started using it to perform DNS amplification attacks against, of all things, cricket news website…

https://adfreetime.com does this, as well as proxying location checking (like MLB's video streaming).

Cool! Thanks for sharing this.

Out of curiosity, do you have any idea how they prevent the scenario I outlined (e.g. metadata, traffic analysis)?

Re: Mmm, Pi-hole

#218

Post by jancsika »

badbug wrote: post #161
move-on-by wrote: post #148

Earlier quoted context omitted.

A lot of these list maintainers put a lot of work into not breaking things, but their are just too many websites out their to know if a block breaks one of them or not. Send the list maintainer an email - or if they are on Github/Gitlab open a ticket and have a discussion. I think you'll find many of them are happy to remove breaking domains. Of course whitelist is always an option too if the list maintainer disagree…

I spoke directly with the pihole maintainers. They took a Hardline position that them blocking email from my city was the right thing to do because it used click tracking or some other metric gathering and was deemed a privacy risk. I understand the devotion to a cause but it was too myopic for me.

Don't they have some kind of whitelist you can use?

Re: Mmm, Pi-hole

#219

Post by cmurf »

Isn't this an admission the internet is not safe by default, and you need specialized knowledge and hardware to make the Internet safe(r)?

Xfinity/Comcast hardware (cable and WiFi integrated) works with the Pi-hole how? I can't change the DNS addresses on Xfinity hardware. Ok so I have to buy my own router, in which case Xfinity blames all problems on running by own hardware.

Another ISP with which I'm familiar, when running my own router and assigning DNS of my choosing (any, DNS Watch, Google, Cloudfare, OpenDNS, whatever), and the ISP actually redirects the DNS requests to their own DNS servers anyway. The only two ways I've found to get around this is: always on VPN, or DoH using Firefox+Cloudfare's test they're running. In this case, it's deceptive having a router that permits me to assign DNS addresses of my choosing.

In either case it means distrusting ISP hardware, getting your own cable modem, or getting your own network router, and also a Pi-hole. It's esoteric knowledge. This is a remarkable industry failure.

Re: Mmm, Pi-hole

#220

Post by galadran »

lvh wrote: post #194
galadran wrote: post #163

Earlier quoted context omitted.

I absolutely agree with you about users already running dnsmasq, but the context here is a malicious developer abusing their position. The actual quality of the software is orthogonal. I still think you are understating the risk of a malicious DNS server. As you note, many users will have unpatched IOT or network facing devices (e.g. cameras, baby monitors or other smart gadgets). With DNS spoofing they all become vu…

I did not say "a compromised DNS server is completely inconsequential", I said that a compromised WebExtension with :// / and tabs permissions has UXSS (obviously true) and UXSS is worse than compromising DNS resolution. Which one of these is worse: a) I might be able to convince a bad IOT device to connect to an IP I control which may or may not let me do something interesting, -- or -- b) I can just use your sessio…

> The crux of your argument seems to be "it is more valuable to be able to point an IOT device at the wrong IP than it is to get UXSS on a machine on that network". That seems obviously wrong to me for any user, technical or not.

If PiHole is malicious, there is already an attacker on your network, DNS Spoofing is just one example of the possible consequences. The PiHole can also port scan, connect to services etc. I don't think mounting an effective phishing attack on a user would be very hard.

My point is that both scenarios are catastrophic, and its hard to justify choosing one over the other on the grounds "the developer might be malicious". Telling people "don't worry a DNS server can't do much" is massively understating the problem, considering all the local network devices directly exposed to the PiHole device and the fact it is the DNS server.

As I said, I use both and cross my fingers that Mozilla / Open Source code review / the GDPR mitigates the risk of a bad developer

Post reply on HN