Pi-hole: A black hole for Internet advertisements • Hacker News Board

Re: Pi-hole: A black hole for Internet advertisements

#111

Post by woofcat » Thu, May 30, 2019, 3:19 PM UTC

KirinDave wrote: post #100

segfaultbuserr wrote: post #62

Earlier quoted context omitted.

Due to the architecture of DNS, DNS is not end-to-end encrypted. There is a potential solution (djb's DNSCurve), but it will not be deployed. As a result, let's do an assessment. Using Google DNS, self-hosted resolver, or your ISP's DNS : NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Using CloudFlare's DNS w/ DNS-over-HTTPS : only NSA (via a NSL or s…

What threat model does concealing DNS but not indirecting traffic via Tor address, given that Tor can also tunnel DNS? Cloudflare's not wrong that the DNS requests are hidden, but many classes of observer who could read your DNS request could also see you connect to the resting host? Follow up question, do you trust CloudFlare not to manipulate the results of DNS more or less than Google?

Cloudflare has also rolled out ESNI (https://www.cloudflare.com/ssl/encrypted-sni/) which would mean someone reading your traffic would only be able to tell that you're connecting to a cloudflare IP address.

However be unable to determine which specific site you were accessing.

Re: Pi-hole: A black hole for Internet advertisements

#112

Post by loudtieblahblah » Thu, May 30, 2019, 3:20 PM UTC

ChikkaChiChi wrote: post #17

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

I see it as an advantage for all the devices on your network. I mean, to block trackers from Windows computers, or Roku devices or android apps.

But as an adblocker - I feel like I'm missing something. It acts as a DNS server for your local network and blocks what's essentially a host file.

So how does it handle ads served through websockets?

How does it handle ads that come from the same domain as legitimate content (which is increasingly common)?

The complexity of rulesets by addons like ublock origin or PrivacyBadger seem to far surpass what PiHole is capable of.

I think PiHole has it's place on a network - obviously, but people have been promoting this thing like you can just get rid of your adblocker on your browser now.

People also downplay that this can be a pain in a home with a handful a streaming devices, each with a handful of apps. You end up whitelisting so much for those devices, you might as well whitelist the whole device just so the apps can work.

Your wife downloads a game on her phone, and you get that look like "ok, why isn't this working.. what did you do now?"

It just seems like a lot of effort for fairly imperfect results.

Sure installation is easy, but long term maintenance (the OS, the app, constantly whitelisting or troubleshooting when a new service or app breaks for someone in the house).

Re: Pi-hole: A black hole for Internet advertisements

#113

Post by TrinaryWorksToo » Thu, May 30, 2019, 3:21 PM UTC

kasey_junk wrote: post #95

Nux wrote: post #82

Earlier quoted context omitted.

DoH in itself is not sneaky, no more than ping is. The push to centralise DNS resolution in the hands of a few questionable actors is and this is what is happening. Cloudflare for example would absolutely love to know what you're up to all day; and because they can now correlate data from their "omnipresent" WAF with the data from 1.1.1.1 they could get some interesting information... And believe you me, they're not…

Cloudflare makes a pretty specific statement against what you are saying: "1.1.1.1 does not mine any user data. Logs are kept for 24 hours for debugging purposes, then they are purged." Are you claiming they are lying?

I'm not claiming their lying or doing anything internally that is different. There is just nothing stopping the change from happening, now that the possibility exists

Re: Pi-hole: A black hole for Internet advertisements

#114

Post by yegle » Thu, May 30, 2019, 3:21 PM UTC

josteink wrote: post #110

segfaultbuserr wrote: post #62

Earlier quoted context omitted.

Due to the architecture of DNS, DNS is not end-to-end encrypted. There is a potential solution (djb's DNSCurve), but it will not be deployed. As a result, let's do an assessment. Using Google DNS, self-hosted resolver, or your ISP's DNS : NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Using CloudFlare's DNS w/ DNS-over-HTTPS : only NSA (via a NSL or s…

> Using ... your ISP's DNS: NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Technically speaking the NSA wouldn’t be seeing your DNS requests, they would be seeing your ISP’s, for all its users anonymised. If you use Cloudflare or Google DNS directly from home (or your own resolver), then yes, the NSA and anyone else can track your individual DNS reque…

*if you are using plaintext DNS query. Both Google DNS and Cloudflare DNS support encrypted DNS query over TLS and HTTPS.

Re: Pi-hole: A black hole for Internet advertisements

#115

Post by HugoDaniel » Thu, May 30, 2019, 3:22 PM UTC

IceWreck wrote: post #80

HugoDaniel wrote: post #63

The pages you use the most serve some ads from their own domain. E.g. Youtube et. al. Also beware as most ads in your phone apps come from ad intermediaries that are either dynamic or constantly change. Pi-Hole is a cool project but please take in consideration those two when using it. We are far from the 90's in ad-tech.

Yes, this isn't the ultimate solution, but what you said is an overstatement. The biggies like YouTube, Facebook, Instagram, etc serve ads from their own domains, but almost everything else uses an ad network which can be blocked. > most ads in your phone apps come from ad intermediaries I don't know about the intermediaries you are talking about, but all the ad-ridden proprietary mobile apps that I use (the ones tha…

It depends on the ad unit in question. Ad-tech is a very tricky world with a ton of meanders and intermediaries/mediators.

Anyway good luck with that if the app is using a mediator from a big known name as it will likely block all of their services as well.

Re: Pi-hole: A black hole for Internet advertisements

#116

Post by jackallis » Thu, May 30, 2019, 3:22 PM UTC

i am very much intrigued by this, atleast from consumer prespective. I am completed noob, is it "simple" enought to set up?

Re: Pi-hole: A black hole for Internet advertisements

#117

Post by isbjorn16 » Thu, May 30, 2019, 3:23 PM UTC

ChikkaChiChi wrote: post #17

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

Haven't you noticed any drastic reductions in speed?

My rpi 3b (not 3b+) just couldn't handle it. It had 2 users. Our DNS resolution times increased by about 200ms. It was awful. I stripped it back out and haven't bothered trying to set it up again.

(Other details: the RPI was hardwired, wireless disabled, and it was a fresh raspbian install with zero customization outside of adding pihole.)

Re: Pi-hole: A black hole for Internet advertisements

#118

Post by w_s_l » Thu, May 30, 2019, 3:24 PM UTC

ChikkaChiChi wrote: post #17

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

is there any security concerns with the pi itself? say your computer is infected with a really bad malware. it takes over your host, ignores your right to block out noise, and then the idea that pi-hole will be able to as a last resort block it out?

Re: Pi-hole: A black hole for Internet advertisements

#119

Post by TrinaryWorksToo » Thu, May 30, 2019, 3:24 PM UTC

mkl wrote: post #87

spaceribs wrote: post #46

Earlier quoted context omitted.

Couldn't I sign my own pi-hole and add the certificate to my phone/computer?

No use if e.g. Chrome hardcodes Google's servers and ignores the system ones.

Could you hardcode the ip addresses in your own NAT?

Re: Pi-hole: A black hole for Internet advertisements

#120

Post by misiti3780 » Thu, May 30, 2019, 3:25 PM UTC

Anyone else seeing:

  [] Root user check

        \e[1;32m.;;,.
        .ccccc:,.
         :cccclll:.      ..,,
          :ccccclll.   ;ooodc
           'ccll:;ll .oooodc
             .;cll.;;looo:.
                 \e[1;31m.. ','.
                .',,,,,,'.
              .',,,,,,,,,,.
            .',,,,,,,,,,,,....
          ....''',,,,,,,'.......
        .........  ....  .........
        ..........      ..........
        ..........      ..........
        .........  ....  .........
          ........,,,,,,,'......
            ....',,,,,,,,,,,,.
               .',,,,,,,,,'.
                .',,,,,,'.
                  ..'''.\e[0m

  [] OS distribution not supported