Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Beauty of Having a Pi-Hole (2024)

den.dev

Post reply on HN
Print view View original

131–140 of 211 posts

Re: The Beauty of Having a Pi-Hole (2024)

#131

Post by wkat4242 »

gosub100 wrote: post #125
wkat4242 wrote: post #112

I wouldn't bother buying a raspberry pi 5 to run this shit though, as the article suggests. It's way overkill. Just run the docker on another server you're running anyway, or run it on a raspberry pi zero 2W for $15. A pihole does so little work, it doesn't benefit from a pi 5. I just run it on a VPS that costs me 3€ per month and runs lots of other stuff too like an IRC bouncer. That way I can access it from everywh…

Why don't people run their own public DNS and sell you very cheap access to it? $9 a year to Johnny's No-Ad DNS. If it worked I'd pay for it

It's not worth the support trouble for the little it would make. Adblockers often break legit things too. Often people still want to use links that go through tradedoubler and the like. One support call and your yearly profit is wasted.

And how do you block access to non paying customers? DNS isn't autenticated.

It's also not really a great method for adblocking anymore (which would make the support problem worse, "why am I still seeing ads?")

Re: The Beauty of Having a Pi-Hole (2024)

#132

Post by Larrikin »

hnuser123456 wrote: post #90
int0x29 wrote: post #62

Earlier quoted context omitted.

Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.

Except, now you don't really control your web browser either, and ad blockers are getting crippled. It is an uphill battle.

AdBlockers are not crippled on Firefox

Re: The Beauty of Having a Pi-Hole (2024)

#133

Post by fortran77 »

jamesgeck0 wrote: post #24
mikestew wrote: post #7

Earlier quoted context omitted.

I was shocked that TFA’s recommended kit was $155! When did Raspberry Pi’s get so pricey?

I don't _think_ you need a whole Raspberry Pi 5 kit. It seems like an older Raspberry Pi 3b+ would get the job done for $35 or so. Maybe even a Raspberry Pi Zero ($5) with an micro usb ethernet adapter.

If you want a machine to run 24/7 for a long time, running it of an SD card is a bad idea. The NVMe support on a Pi 5 is important for somthing like a PiHole

Re: The Beauty of Having a Pi-Hole (2024)

#135

Post by imgabe »

I had been meaning to do this for the longest time. I even had a couple spare raspberry Pis laying around, but didn't want to set it up. Finally, I realized you don't need a raspberry pi at all. It's running in docker on my plex server. Much less friction. Don't get hung up on needing to run it on a raspberry pi.

Re: The Beauty of Having a Pi-Hole (2024)

#136

Post by TacticalCoder »

elashri wrote: post #5
mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

An increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1]) [1] https://github.com/dibdot/DoH-IP-blocklists

Browsers allows corporations to prevent DoH and force DNS through company-owned DNS servers:

https://support.mozilla.org/en-US/kb/dns-over-https

I use these settings on all my browsers to prevent DoH and make sure traffic goes through my Pi (I run unbound directly on the Pi though, not Pi-Hole: in my experience unbound is a bit harder to set up initially but it's also more powerful than Pi-Hole... For example unbound accepts wildcards in blocklists).

It's not incompatible with also blocking, at the firewall level, all known DoH servers of course.

Nor is it incompatible with forcing your router to also use your Pi as a DNS.

Re: The Beauty of Having a Pi-Hole (2024)

#137

Post by diogocp »

wkat4242 wrote: post #113
wang_li wrote: post #12

Earlier quoted context omitted.

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.

Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway. In this model, DoH is only a bad thing because it evades local DNS control. I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour e…

Your comment makes no sense. The DoH providers can still log requests and sell them.

DoH protects against intermediaries spying on your requests and potentially forging responses. Exactly the same as HTTPS.

Sending anything in clear text over the internet in 2025 is criminally negligent.

Re: The Beauty of Having a Pi-Hole (2024)

#138

Post by glial »

itchyouch wrote: post #29

For the cost and simplicity, NextDNS is way easier IMO. Nice quality of life apps that install on your phone and computer to toggle it on/off while on-the-go, while also being able to be setup on the router. Makes it nice and easy for the non-technical members of the fam.

I tried a Pi Hole a few years ago. I just discovered NextDNS and configured my home router to use it as a DNS and wow, it's SO much easier.

Re: The Beauty of Having a Pi-Hole (2024)

#139

Post by koito17 »

diogocp wrote: post #137
wkat4242 wrote: post #113

Earlier quoted context omitted.

Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway. In this model, DoH is only a bad thing because it evades local DNS control. I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour e…

Your comment makes no sense. The DoH providers can still log requests and sell them. DoH protects against intermediaries spying on your requests and potentially forging responses. Exactly the same as HTTPS. Sending anything in clear text over the internet in 2025 is criminally negligent.

HTTPS is not necessary to encrypt DNS traffic. DNS-over-TLS exists, but it has much less traction compared to DNS-over-HTTPS. I am guessing the reason is that HTTPS traffic all goes through port 443, so "censorship" of DNS becomes tricky, since DNS traffic becomes a bit harder to distinguish from ordinary web traffic.

Encapsulating DNS packets in HTTP payloads still feels a bit strange to me. Reminds me a bit of DOCSIS, which encapsulates ethernet frames in MPEG-2 Transport Stream packets (this is not a joke).

Re: The Beauty of Having a Pi-Hole (2024)

#140

Post by DrillShopper »

gosub100 wrote: post #122
wang_li wrote: post #12

Earlier quoted context omitted.

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.

The arms race will continue. I think the next gen will be a self hosted archive.ph style host that lets all the garbage load and distills it into a PDF or Web 1.0 style file ready for consumption. I would be fine with a browser extension that learns what I watch the most and preloads it for me, and/or an on demand service that shares prerendered sites bundled into torrents that group together common interests. Edit:…

That's what The Internet Junkbusters Proxy / Privoxy excelled so good at.
Post reply on HN