Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole 5.0

pi-hole.net

Post reply on HN
Print view View original

71–80 of 254 posts

Re: Pi-hole 5.0

#74

Post by aftbit »

gclawes wrote: post #71

Is the cert on pi-hole.net broken for anyone else? It's returning a cert for CN = *.sucuri.net

I get SSL_ERROR_BAD_CERT_DOMAIN -

Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for pi-hole.net. The certificate is only valid for the following names: *.sucuri.net, sucuri.net

Re: Pi-hole 5.0

#78

Post by thecureforzits »

dogma1138 wrote: post #52
ciarannolan wrote: post #33

Earlier quoted context omitted.

Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole? Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option? [0] https://nextdns.io/privacy

No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi-hole in the cloud yourself unless. Pricing wise it’s over 2 years worth of service for the price of an original Pi, a good SD card and a case. The only circumstances where Pi Hole is unquestio…

FWIW, pihole is not tied to any particular hardware. For example:

https://github.com/pi-hole/docker-pi-hole

Re: Pi-hole 5.0

#79

Post by riquito »

ciarannolan wrote: post #61
dastx wrote: post #42

Earlier quoted context omitted.

Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if the…

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Right

Re: Pi-hole 5.0

#80

Post by totetsu »

xwdv wrote: post #55
dastx wrote: post #42

Earlier quoted context omitted.

Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if the…

> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)
Post reply on HN