I like the idea, but also it wouldn't feel fair for some services that I use like Twitch, or some cooking websites. I get that they sometimes really abuse all that stuff, but also I feel like they deserve some kind of compensation.
The Beauty of Having a Pi-Hole (2024)
121–130 of 211 posts
Re: The Beauty of Having a Pi-Hole (2024)
#122In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…
> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.
The arms race will continue. I think the next gen will be a self hosted archive.ph style host that lets all the garbage load and distills it into a PDF or Web 1.0 style file ready for consumption. I would be fine with a browser extension that learns what I watch the most and preloads it for me, and/or an on demand service that shares prerendered sites bundled into torrents that group together common interests.
Edit: as much as I dislike AI, I concede it would be lovely to tell it to replace all ads with pictures of flowers.
Re: The Beauty of Having a Pi-Hole (2024)
#123I like the idea, but also it wouldn't feel fair for some services that I use like Twitch, or some cooking websites. I get that they sometimes really abuse all that stuff, but also I feel like they deserve some kind of compensation.
Poor Mr Bezos, I don't know what he would do without your $3 in ad views.
Re: The Beauty of Having a Pi-Hole (2024)
#124Re: The Beauty of Having a Pi-Hole (2024)
#125I wouldn't bother buying a raspberry pi 5 to run this shit though, as the article suggests. It's way overkill. Just run the docker on another server you're running anyway, or run it on a raspberry pi zero 2W for $15. A pihole does so little work, it doesn't benefit from a pi 5. I just run it on a VPS that costs me 3€ per month and runs lots of other stuff too like an IRC bouncer. That way I can access it from everywh…
Why don't people run their own public DNS and sell you very cheap access to it? $9 a year to Johnny's No-Ad DNS. If it worked I'd pay for it
Re: The Beauty of Having a Pi-Hole (2024)
#126Disclaimer: The below is not a complaint about the pi-hole itself, but the ways in which companies integrate ads into their online presence. I've found my complaint about having a pi-hole is there are a number of services I use that expect/depend on ads existing in order to function. Things like, some shows on paramount+ (as an example) will fail to play (hang indefinitely) if an ad hasn't run before one of their sho…
Edge browser + uBlock Origin, and YouTube works perfectly without ads.
Firefox works well too. 10.2M blocked requests on my uBlock, and YouTube - and every other site - works perfectly fine.
Re: The Beauty of Having a Pi-Hole (2024)
#127Earlier quoted context omitted.
In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH…
If you're really serious about DNS interception, you'd setup something where a) you stop accepting A lookups, because it's 2025 and IPv4 only is dead (let's pretend anyway) b) for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts). Then only let clients connect to these IPv6 addresses you setup. If someone smugg…
> for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts)
We employ exactly this technique for our Android firewall app. It can do IPv4 (by mapping hash(domain) name onto RFC6598 reserved subnet [0]) as number of unique AAAA/A requests on a client seldom exceeds 35k/mo!
Another (simpler) control we offer users is, to drop all connections made to IPs that the user-set resolver did not do name resolution for.
> (this is going to be a big PITA, but that's how these things go)
You don't say.
[0] https://github.com/celzero/firestack/blob/2191381f/intra/dns...
Re: The Beauty of Having a Pi-Hole (2024)
#128Earlier quoted context omitted.
I started like you, but slowly with more debugging and customized use-cases I started understanding more and more. That's the way for people with limited free time. That said, now with LLMs, honestly anything is easily learnable.
It still shouldnt break all the time. You shouldnt havr to get good at debugging a tool like this. I use but it dors destroy my network once a month and have had to build cleanup/reinstall scripts for this scenerio. I would not recommend to most people.
What do you mean 'destroys your network'? It's just a DNS server - maybe something else is wrong and the presence of the pihole is a coincidence?
Re: The Beauty of Having a Pi-Hole (2024)
#129I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time.
I used to have PiHole running in a docker container, which sounds almost exactly like what you're describing.
Re: The Beauty of Having a Pi-Hole (2024)
#130i'd love a pihole, but networking has always been a bit of a blindspot for me. i never really understand what i'm doing, and when things break it's a game of guess'n'check which stackoverflow/gpt answer will fix it. these walkthroughs always make it look easy, but no matter how easy the set up is you can't escape the fact that you're adding a layer of complexity to the network and i just don't want to maintain it. i…
It's very straightforward. You set the IP of the pinhole for DNS in the settings of whatever is doing DHCP on your network. That's it.
Yeah, and set the IP of the PiHole as DNS for any device you've set static network settings on as well, but yes, it is indeed "very straightforward" for anyone that's able to set up their local network (or able to ask a "nerdy" friend or family member to do it for 'em).