Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ad blocking with Raspberry Pi and Pi-hole

cri.dev

Post reply on HN
Print view View original

151–160 of 163 posts

Re: Ad blocking with Raspberry Pi and Pi-hole

#151

Post by frank2 »

BuckRogers wrote: post #31
bberrry wrote: post #10

I wish it were more effective in removing Youtube ads on my kids' iPads, but I understand it's a tall order. At least it gets rid of ads in most other apps.

Try Microsoft Edge. Its built in ad blocker works for me with Youtube on my iPhone. I block ads at the application layer, DNS based ad blocking doesn’t really do it anymore and can create another troubleshooting surface to consider when it breaks something.

In response to your comment, I tested Microsoft Edge on my iPad and can confirm that yes, indeed, it does block the ads on youtube.com

-- mostly: out of about 7 videos, an ad was shown to me at the start of one of them, but that is much better than mobile Safari, on which and ad is shown to me at the start of every video I start.

Thanks for the tip.

Re: Ad blocking with Raspberry Pi and Pi-hole

#152

Post by jedberg »

ljhsiung wrote: post #96
Blackadderz wrote: post #55

Pi-hole has been excellent. I was able to discover that my Samsung TV was reporting minute by minute updates on what I was watching to a local Australian company. Unplugged it faster than I could swear.

Ever thought about just buying a TV that has no network connectivity capability at all i.e. "dumb" TVs? Though rare to find a 4k/OLED TV that's "dumb", I managed to grab one. If I do want certain smart features e.g. chromecast I can always just buy it individually for like $30.

I just don't configure wifi on the TV. I can't use the smart features but I don't need to, I have other devices for that.

Re: Ad blocking with Raspberry Pi and Pi-hole

#153

Post by ptmcc »

close04 wrote: post #118
ptmcc wrote: post #74

Earlier quoted context omitted.

Same with my Sony Android TV. That thing trying to phone god knows what home made up almost a third of all DNS requests on my home network, even with 2 adults working from home. Since you can't buy dumb TVs anymore, you best leave the "smart" ones offline.

Worth mentioning that this is just the domain resolution, not necessarily the real volume of connections. The reason they try every second sometimes (I have devices that do exactly this, ~86000 attempts every day) is because they keep failing. Assuming they resolve once they stop flooding the Pi-hole and will bundle their connections in fewer, larger chunks. Couldn't say what's in those chunks since they're encrypted…

Fair point, but I'd still prefer my TV doesn't phone home at all, especially to pi-hole blocked domains.

Re: Ad blocking with Raspberry Pi and Pi-hole

#154

Post by 7786655 »

mulmen wrote: post #89
LeoPanthera wrote: post #86

The move of applications such as Firefox to start using DNS-over-https to hardcoded DNS servers will render such user-modified DNS services useless. Firefox can have this feature disabled, but more malicious applications will simply not give you the choice.

It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?

I know this is a crazy idea, but maybe we should stop buying locked-down IOT devices?

Re: Ad blocking with Raspberry Pi and Pi-hole

#155

Post by int_19h »

mulmen wrote: post #89
LeoPanthera wrote: post #86

The move of applications such as Firefox to start using DNS-over-https to hardcoded DNS servers will render such user-modified DNS services useless. Firefox can have this feature disabled, but more malicious applications will simply not give you the choice.

It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?

Why can't you run your own DNS-over-HTTP server, just as you run your own DNS server today? There's no particular reason why the server addresses have to be hardcoded...

Re: Ad blocking with Raspberry Pi and Pi-hole

#156

Post by mulmen »

int_19h wrote: post #155
mulmen wrote: post #89

Earlier quoted context omitted.

It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?

Why can't you run your own DNS-over-HTTP server, just as you run your own DNS server today? There's no particular reason why the server addresses have to be hardcoded...

I can and for well-behaved applications that's good. But how do I know my IoT device is using my DNS-over-HTTPS server and not a hard-coded one? There's no way to know and the only way to block DNS-over-HTTPS is to also block HTTPS.

It's much harder (or impossible) to block only some of the IoT device traffic (like ads). If I want it to function at all I have to let it spy on me and do other rude things.

My solution is to just not have IoT things but in the long run I think that will become impossible. Consumers seem to have made their choice and everything needs an IP address now.

I don't like how DNS-over-HTTPS smells and I wish there was less momentum behind it. This should be solved by OS vendors, not application developers. DNS doesn't belong at this part of the stack.

Re: Ad blocking with Raspberry Pi and Pi-hole

#157

Post by mulmen »

7786655 wrote: post #154
mulmen wrote: post #89

Earlier quoted context omitted.

It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?

I know this is a crazy idea, but maybe we should stop buying locked-down IOT devices?

Sure, I don't really have any right now. In the long run I think that will be impossible. When my TV dies I have to make a lot of compromises to get a dumb display with(out) all the other neat features.

Also, moving DNS to the application instead of the OS just makes managing my well behaved applications harder. It used to be possible to set this automatically through DHCP, now I have to audit every application and make sure it is using my preferred DNS and also manually configure those applications.

DNS-over-HTTPS in Firefox doesn't really benefit me. DNS-over-HTTPS with a DHCP configured server in my OS would be a beneficial option.

Really I would prefer something like DNS over TLS because that solves everything. DNS keeps working, intermediate parties can't read my DNS requests and I can reason about my network traffic, at least on devices I trust.

Re: Ad blocking with Raspberry Pi and Pi-hole

#158

Post by iso947 »

mulmen wrote: post #123
iso947 wrote: post #116

Earlier quoted context omitted.

You can set a canary domain which currently is used The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices won’t allow you to install a new certificate store.

I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config. Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?

https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

If your smart tv checks to see if it should disable DOH then it would work.

I wouldn’t bank on it doing so though. Best to block all iot devices.

Re: Ad blocking with Raspberry Pi and Pi-hole

#159

Post by mulmen »

iso947 wrote: post #158
mulmen wrote: post #123

Earlier quoted context omitted.

I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config. Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?

https://support.mozilla.org/en-US/kb/canary-domain-use-appli... If your smart tv checks to see if it should disable DOH then it would work. I wouldn’t bank on it doing so though. Best to block all iot devices.

Thanks for clarifying. This only helps for well-behaved applications and is apparently temporary.

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body.

More than anything I am disappointed in Mozilla for shipping such a half-baked anti-feature. I can't even trust Firefox to do the right thing anymore.

Re: Ad blocking with Raspberry Pi and Pi-hole

#160

Post by int_19h »

mulmen wrote: post #156
int_19h wrote: post #155

Earlier quoted context omitted.

Why can't you run your own DNS-over-HTTP server, just as you run your own DNS server today? There's no particular reason why the server addresses have to be hardcoded...

I can and for well-behaved applications that's good. But how do I know my IoT device is using my DNS-over-HTTPS server and not a hard-coded one? There's no way to know and the only way to block DNS-over-HTTPS is to also block HTTPS. It's much harder (or impossible) to block only some of the IoT device traffic (like ads). If I want it to function at all I have to let it spy on me and do other rude things. My solution…

I think this is rather orthogonal. A non-well-behaved app can use hardcoded DNS servers as well. And if the author is concerned with your ability to intercept and filter it on protocol level, they can always hack their own equivalent of DNS-over-HTTP with a basic REST service.

OTOH I expect non-malicious code to just use the platform/language/framework-standard mechanism to resolve hostnames, and I expect such mechanisms to provide all the necessary customization points, just as they did for DNS.

Post reply on HN