Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole: A black hole for Internet advertisements

pi-hole.net

Post reply on HN
Print view View original

141–150 of 262 posts

Re: Pi-hole: A black hole for Internet advertisements

#141

Post by sbarre »

loudtieblahblah wrote: post #112
ChikkaChiChi wrote: post #17

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

I see it as an advantage for all the devices on your network. I mean, to block trackers from Windows computers, or Roku devices or android apps. But as an adblocker - I feel like I'm missing something. It acts as a DNS server for your local network and blocks what's essentially a host file. So how does it handle ads served through websockets? How does it handle ads that come from the same domain as legitimate content…

There are tradeoffs in all solutions of course.

The pi-hole asks you to choose security over convenience, and you must accept that not all apps and services will work.

That's a personal choice you can make for your own setup in your own home.

I've never seen anyone say this _replaces_ your browser's ad blocker though.

Re: Pi-hole: A black hole for Internet advertisements

#142

Post by Analemma_ »

dTal wrote: post #96
pjc50 wrote: post #83

Earlier quoted context omitted.

This is the dark side of DNS-over-HTTPs: it prevents the network operator from changing what is received by browsers. Sometimes this is legitimate, as in Pi-hole. Paul Vixie got very upset when he discovered that his chromecast bypasses local DNS settings to go directly to Google: https://news.ycombinator.com/item?id=19170671 I wouldn't be surprised if soon Chrome defaults to DNS-over-HTTPs direct to base, except for…

The problem is two mutually incompatible use cases: 1) trusted endpoint / untrusted network (laptop in a coffee shop) 2) untrusted endpoint / trusted network (chromecast/alexa/other corporate zombie on your home network) Which category a given scenario falls under depends on who you ask - to Google, Chromecast is in the first category. I don't know if it's possible to design a system that somehow always favors the ri…

Damn, this is a good point. Just because of network architecture, ultimately somebody-- either the client or the network-- has to have the Final Word on where DNS requests go, and either way opens people up to attacks depending on the scenario. If the client has the Final Word, you can't stop your Chromecast from talking to 8.8.8.8; if the network has the Final Word, you can't trust DNS on foreign networks or use your own resolver.

Re: Pi-hole: A black hole for Internet advertisements

#143

Post by craigsmansion »

kasey_junk wrote: post #95
Nux wrote: post #82

Earlier quoted context omitted.

DoH in itself is not sneaky, no more than ping is. The push to centralise DNS resolution in the hands of a few questionable actors is and this is what is happening. Cloudflare for example would absolutely love to know what you're up to all day; and because they can now correlate data from their "omnipresent" WAF with the data from 1.1.1.1 they could get some interesting information... And believe you me, they're not…

Cloudflare makes a pretty specific statement against what you are saying: "1.1.1.1 does not mine any user data. Logs are kept for 24 hours for debugging purposes, then they are purged." Are you claiming they are lying?

I'm all for assuming the people who work there are good eggs with the best intentions, but Cloudflare, Inc. is a U.S. company. As I understand the U.S. legal landscape with regards to data and privacy protection, they could be forced to lie at a moment's notice and not talk about it.

Re: Pi-hole: A black hole for Internet advertisements

#144

Post by jqueryin »

jamesog wrote: post #135
someexgamedev wrote: post #130

Why hasn't anyone, or pi-hole themselves, made a public DNS that does this? Pass everything not on the blocklist thru to 1.1.1.1. The fact that this requires special hardware, bash commands, etc is severely limiting the audience. The more people blocking ads the quicker the internet changes. Edit: thanks for the replies!

They have: nextdns.io There was discussion a few days ago: https://news.ycombinator.com/item?id=20012687

I'm slightly concerned about routing my traffic through a non-major player in Anycast when I don't control the routing or software. I'd be worried it's quite an easy target for someone to do some DNS hijacking or packet sniffing.

There's a certain level of trust when I use 1.1.1.1 or 8.8.8.8. I'm unwilling to take the risk for this solution. I'm not sure what would help in the trust department to legitimize a solution like this.

Re: Pi-hole: A black hole for Internet advertisements

#146

Post by sbarre »

programbreeding wrote: post #108
ChikkaChiChi wrote: post #17

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

Over 50% of my DNS queries get blocked by the pihole [0]; and I've seen it much higher. Like you said, it's one of the most prized devices on my network. [0] https://i.imgur.com/dPZzYjL.png

That's fascinating.. I would love to know what the averages are across a wider range of users..

In contrast, For my home network, it's just under 15% of queries that get blocked. I've got 3 Macs, a Windows 10 machine, an Apple TV (all connected 24/7) and a handful of iOS devices that hop on and off the network.

My blocklist contains ~114k domains I believe.

Re: Pi-hole: A black hole for Internet advertisements

#147

Post by creeble »

ronjouch wrote: post #42

Also, owners or routers able to run OpenWRT (which is actively maintained and in great shape since the merge with LEDE), you have access to several packages providing the same technical solution (DNS-based blocking). As far as I know, the most common and maintained is https://github.com/openwrt/packages/tree/master/net/adblock/... . Super easy to install, full-featured, lots of lists to pick from, auto-updates lists,…

Curious about anyone's experience with adblock for OpenWRT.

I use Pi-hole now, and it works great. The one feature that I use quite a lot is the ability to disable it for a short period of time -- when I'm shopping for something, Google ads are sometimes actually useful!

I'd say I use that feature about once a month. That's the sum value of advertising for me.

Re: Pi-hole: A black hole for Internet advertisements

#149

Post by ApolloFortyNine »

RegW wrote: post #88
derefr wrote: post #60

Earlier quoted context omitted.

One big problem with entirely static ads is that websites are global but the ads running on them are for brands that are likely local (at least to a specific country.) If I visit the NYT website in e.g. Norway, should I still see ads for an American brand of paper towel that doesn’t exist here; or should I see ads for Norway paper towel brands? The flip-side of this is that I’ve noticed that YouTube shows me PSAs fro…

This not necessarily a problem. There's nothing to stop the website operator calling out to an ad provider, with the ip/location of the user, and getting an ad to embed. The upside for the user is that location and whatever the one site is able to determine about the user is all that can be shared. If the user hasn't logged in with their real name - that probably isn't much.

The issue is that you can make considerably more money using ads that 'track' you.

So instead of one ad being enough to pay for your content, you have to fill your website with banner ads, embedded ads, scroll over ads, animated ads, etc etc.

It's a slippery slope, more people use adblockers causing content creators to add more advertisements to generate the same amount of income. More people are bothered by the increase in ads, and download adblockers themselves. Rinse and repeat until ad supported content is unrealistic for all but the biggest of websites.

And I'm pretty sure even checking location is controversial. I've at least seen it included as part of tracking in the past.

Re: Pi-hole: A black hole for Internet advertisements

#150

Post by everdrive »

pjc50 wrote: post #83
Piskvorrr wrote: post #2

[tinfoilhat] Given that Chrome now became Google's weapon against adblocking, how long until it starts refusing to use Pi-hole specifically? https://news.ycombinator.com/item?id=20044430 [/tinfoilhat]

This is the dark side of DNS-over-HTTPs: it prevents the network operator from changing what is received by browsers. Sometimes this is legitimate, as in Pi-hole. Paul Vixie got very upset when he discovered that his chromecast bypasses local DNS settings to go directly to Google: https://news.ycombinator.com/item?id=19170671 I wouldn't be surprised if soon Chrome defaults to DNS-over-HTTPs direct to base, except for…

It's a big concern. I can block DNS on my network (except for pihole), but I can't block QUIC, and certainly not HTTPS or TLS. If I know about an IP ahead of time, I can block those, but who's to guarantee that Google or any other nefarious service would always use a well known IP for DoH?
Post reply on HN