Pi-hole 5.0 • Hacker News Board

Re: Pi-hole 5.0

#251

Post by fulafel » Tue, May 12, 2020, 5:30 PM UTC

patrickdavey wrote: post #201

fulafel wrote: post #133

Earlier quoted context omitted.

Finding a years abandoned Linux server on your home network m ight be a good leasson to always treat your home network as if it was compromised.

Honestly curious: how would you exploit it? If the pi isn't exposed to the www by your router, what can you do?

There are lots of ways. A basic vector is CSRF (like eg https://tools.cisco.com/security/center/content/CiscoSecurit...), or the server side variant (SSRF). Then there's the DNS vector already mentioned. There are others too. Generally it's a bad idea to rely on home network boundary protections.

Re: Pi-hole 5.0

#252

Post by ThePowerOfFuet » Tue, May 12, 2020, 10:46 PM UTC

I have no connection to NextDNS other than as a very satisfied user, but my Pi-hole got decommissioned a few weeks ago as a result of my discovery of NextDNS.

I also run their DNS53-to-DoH proxy on a small VM and that VM's IP is the first DNS server in the DNS server list included with DHCP leases (with NextDNS's public IPs as the second and third, losing host-level granularity/logging if the VM is down for whatever reason).

Re: Pi-hole 5.0

#253

Post by askvictor » Mon, May 18, 2020, 10:34 AM UTC

slau wrote: post #205

askvictor wrote: post #127

Earlier quoted context omitted.

I had something working a while ago for YT ad blocking in chromecast; the underlying problem there is that the chromecast is hard-coded to use Google's DNS servers (8.8.8.8, etc) instead of your networks. So you need to set up your network to intercept DNS requests to 8.8.8.8 and 8.8.4.4 and instead send these to your own ad-blocked DNS server. My network setup no longer lets me do this, and I don't care enough to ma…

Just don’t allow outbound DNS except from your pihole, and the Chromecast will use whatever DNS server you give it. Also, make sure to block UDP and TCP on port 53, as well as UDP on port 443 (Chrome snitching).

I imagine at some point, Chromecast will start using DNS-over-HTTPS and move the goalposts elsewhere.

Re: Pi-hole 5.0

#254

Post by dastx » Thu, May 21, 2020, 11:23 PM UTC

MattSteelblade wrote: post #217

yjftsjthsd-h wrote: post #84

Earlier quoted context omitted.

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right? Yeah, uBlock Origin recently added a new permission request just to allow that.

From my understanding, it only works in Firefox and not Chrome though as an FYI.

Correct. Chrome doesn't have such mechanism and if I'm not mistaken, they've already shot down the idea of adding this API.