Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mmm, Pi-hole

troyhunt.com

Post reply on HN
Print view View original

271–280 of 421 posts

Re: Mmm, Pi-hole

#271

Post by mynameisvlad »

gruez wrote: post #57
move-on-by wrote: post #44

Earlier quoted context omitted.

I think a major difference is the update scheme. Browser extensions auto-update. If they switch hands there is no user visibility when getting the updated version. Pi-Hole is installed software and requires manual updates, which gives users more visibility and control.

you can turn auto-updates off. also, you can easily inspect the source for an extension (AMO doesn't allow minified js), you can't easily do that for the multitude of components that make up pi hole.

> you can't easily do that for the multitude of components that make up pi hole

What? The entirety of the project is open source. In fact it's easier to look at the source code that makes up PiHole because it's all in one spot in Github.

Re: Mmm, Pi-hole

#272

Post by tombrossman »

mistermann wrote: post #60
ryandrake wrote: post #47

Earlier quoted context omitted.

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

Can anyone recommend a "2018 good choice" for a consumer router that can run custom firmware (including dnsmasq), or a trustworthy recommendation website? Wirecutter for example doesn't note third party firmware: https://thewirecutter.com/reviews/best-wi-fi-router/

It may be more full-featured than you are looking for, but have a look at the Turris Omnia. It is extremely customisable and you can add an internal SSD to run LXC containers on (including one running Pi-hole, which is what I do).

Not cheap, and sometimes unforgiving if you don't know exactly what you are doing, but worth every penny in my opinion.

https://omnia.turris.cz/en/

Re: Mmm, Pi-hole

#273

Post by LynxInLA »

daxorid wrote: post #115
andreasvc wrote: post #83

Earlier quoted context omitted.

Yup, that's a downside. The advantage is that it's much simpler and will also work when you're not on your home network.

You can also run pi-hole on a tiny VPS and set your DNS statically on all devices.

do you have any links for doing this?

Re: Mmm, Pi-hole

#274

Post by chupasaurus »

ricketycricket wrote: post #86
chupasaurus wrote: post #53

Earlier quoted context omitted.

You can wind up a Linux VDS with dnsmasq and blacklist of domains, then use it on any device everywhere.

If you trust your ability to secure a publicly-accessible DNS server. Pretty attractive target. Also, you can't usually specify DNS servers on cellular connections. The VPN setup would address that.

As a subscriber to Debian Security mail list from 2013 I'd got 2 emails on vulnerabilities in dnsmasq.

I don't think anyone should trust cellular connections at all for many reasons. Especially because my country (Russia) is the only one in Europe which has an office of CEIEC (chinese surveillance gov company) which as of now makes Orwell's tales come true in Xinjang.

Re: Mmm, Pi-hole

#275

Post by user501254 »

Pi-Hole is great! Around 30% of the traffic is blocked on all my devices.

However, I would recommend adding a few more decent block lists to the default ones. Also updating these lists through a cron job on a more frequent basis is a good idea. Here's a script that you can use to setup pi-hole and additional block-lists: https://gist.github.com/user501254/1d4c8cb9f22fb51ae970f5fe0...

Also make sure you are using 1.1.1.1 as your secondary DNS service. So this way in case your Pi-hole running RaspberryPi is down, your devices would be still be able to access the internet with some privacy.

Re: Mmm, Pi-hole

#276

Post by Globz »

morley wrote: post #256
andersriutta wrote: post #249

Earlier quoted context omitted.

Initially, Brave was set up so a user could add bitcoins to an account and set a monthly spending target. Then Brave would split up that monthly amount and send it to sites based on how much time the user spent at each site. But as far as I can tell, they discontinued that model, and now they also sell ads.

I'm on the latest version of the browser, and there's a "Payments" tab in Settings where you can add funds with BTC / ETH / BAT / LTC, set monthly budgets, and see what your percentage is. So I'm not sure where you saw that they discontinued that feature or sell ads.

I am guessing they will replace it by the following feature :

Support your favorite sites with Brave’s blockchain-based tokens called Basic Attention Tokens. (coming soon to mobile)

https://brave.com/features/

Re: Mmm, Pi-hole

#277

Post by DavideNL »

ethagnawl wrote: post #267
DavideNL wrote: post #263

Earlier quoted context omitted.

You mean a public Dns server with ad blocking? https://adguard.com/en/adguard-dns/overview.html Note that obviously since you are sharing all your dns requests with them, it's terrible for privacy... :'(

> Not that obviously since you are sharing all your dns requests with them, it's terrible for privacy... :'( Right. I'm not defending this service in any way, but couldn't you say the same about Quad9 or Cloudflare?

True.

You could set up pi-hole as a recursive dns server: https://docs.pi-hole.net/guides/unbound/ That way you don't have to use a public dns server like Cloudflare. However, since (as far as i know) dns requests are not encrypted, this is not perfect either (security wise).

At least when using Cloudflare you can use DNS-Over-HTTPS: https://docs.pi-hole.net/guides/dns-over-https/

Re: Mmm, Pi-hole

#278

Post by clear_dg »

copperx wrote: post #126
ryandrake wrote: post #47

Earlier quoted context omitted.

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

Assuming I'm only interested in blocking ads in one computer, is there a software solution for this on Linux or Windows? (I know that Mac has Little Snitch).

Why not use a browser extension? uBlock Origin is pretty good from what I hear. I use uMatrix by the same dev, and it serves me well. Both work on major browsers (FF, Chrome, Opera, etc..).

Re: Mmm, Pi-hole

#279

Post by aphextron »

For anyone not interested in setting up pi-hole, having a blacklist host file is just as effective for your local machine [0]. I have that full list set as my /etc/hosts file on a Streisand server [1] and run all my devices through that with IPSEC VPN. It's a little more flexible than pi-hole since you can use your mobile devices over LTE with it.

[0] https://github.com/StevenBlack/hosts

[1] https://github.com/StreisandEffect/streisand

Re: Mmm, Pi-hole

#280

Post by floatboth »

paulryanrogers wrote: post #41
floatboth wrote: post #39

I've been using Privoxy. Killing two birds with one stone here: proxying access through a VPS to hide the home IP address && blocking ads. Apart from it occasionally blocking legitimate sites that begin with the word "ad" (something like, say, "adrian.blog.thing"), it works great. Because it's an HTTP proxy, it offers an interface for bypassing these unintended blocks.

If it's a dumb string-start check then that could be a lot of false positives. How often has it been wrong? I personally hate wondering why something's not working and having to go through every extension to debug my browsing session.

Quite rarely in practice.
Post reply on HN