Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Beauty of Having a Pi-Hole (2024)

den.dev

Post reply on HN
Print view View original

171–180 of 211 posts

Re: The Beauty of Having a Pi-Hole (2024)

#171

Post by akimbostrawman »

dividedcomet wrote: post #78
jstanley wrote: post #74

Earlier quoted context omitted.

I watch YouTube on my TV. Using Firefox, with uBlock Origin. We have a laptop plugged into the TV, with a bluetooth keyboard. It is a vastly superior experience to any smart TV I have ever seen.

And also more than most people want to have setup in the living room. My wife would rather have ads on YouTube occasionally than an ugly computer plugged in all the time. It’s also more difficult to deal with than a remote you can work one handed.

Small PCs and drawers exist and i would rather have a whole damn server rack than 30 seconds to 3 minute ads every 5-10 minutes / video. It's worse than TV...and no im not gonna give google money for a continually worse experience despite paying.

Re: The Beauty of Having a Pi-Hole (2024)

#173

Post by wkat4242 »

baq wrote: post #156
koito17 wrote: post #139

Earlier quoted context omitted.

HTTPS is not necessary to encrypt DNS traffic. DNS-over-TLS exists, but it has much less traction compared to DNS-over-HTTPS. I am guessing the reason is that HTTPS traffic all goes through port 443, so "censorship" of DNS becomes tricky, since DNS traffic becomes a bit harder to distinguish from ordinary web traffic. Encapsulating DNS packets in HTTP payloads still feels a bit strange to me. Reminds me a bit of DOCS…

Everything other than 80 and 443 is blocked by default, anything-over-https is just a matter of time. With a properly configured TLS MITM proxy only certificate pinning will prevent snooping, but it’ll also prevent connectivity, so you might call it a win for security/privacy, or a loss for the open internet if it’s you who needs to VPN to a safe network from within such an environment…

A port number does not force a certain protocol. You can run everything you want over port 443.

And yeah I also think it's a really bad idea to run everything over https. But I don't think it'll happen.

Re: The Beauty of Having a Pi-Hole (2024)

#176

Post by jstanley »

Mashimo wrote: post #168
jstanley wrote: post #74

Earlier quoted context omitted.

I watch YouTube on my TV. Using Firefox, with uBlock Origin. We have a laptop plugged into the TV, with a bluetooth keyboard. It is a vastly superior experience to any smart TV I have ever seen.

Do you honestly not understand why some people don't want that setup?

No, the objections are stupid. Not only is the Firefox experience vastly superior to any smart TV app, but you can have easy and effective ad blocking on top.

My best guess at why people don't want to do this is that we're conditioned not to do anything that isn't advertised to us, and nobody is running adverts telling you to hook a laptop up to your TV for a superior smart TV experience.

Re: The Beauty of Having a Pi-Hole (2024)

#177

Post by lmm »

FredPret wrote: post #67
swiftcoder wrote: post #52

Earlier quoted context omitted.

> When you go to install an ad blocker, there's an extremely ominous warning about how it can read everything shown on my browser I'm not sure how a blocker would work if it couldn't see the content of the page...

Exactly, that's why I do it on the DNS level

Anything that can mess with you DNS can mess with approximately everything you do on your computer, if only by MiTMing you.

Re: The Beauty of Having a Pi-Hole (2024)

#178

Post by Mashimo »

jstanley wrote: post #176
Mashimo wrote: post #168

Earlier quoted context omitted.

Do you honestly not understand why some people don't want that setup?

No, the objections are stupid. Not only is the Firefox experience vastly superior to any smart TV app, but you can have easy and effective ad blocking on top. My best guess at why people don't want to do this is that we're conditioned not to do anything that isn't advertised to us, and nobody is running adverts telling you to hook a laptop up to your TV for a superior smart TV experience.

No need to tell me the advantages, I get it.

But I also get why people just want to sit on the couch, find a nice video on the phone and with the press of a button want to see it on the TV. No computer boot time, no updates, no writing on the keyboard while laying down.

I get that you can buy a fanless pc, install linux with unattended-upgrades and you have something more powerful. But most people don't know how or don't want to go through that hassle.

Re: The Beauty of Having a Pi-Hole (2024)

#179

Post by silon42 »

h4kunamata wrote: post #162
vladvasiliu wrote: post #158

Earlier quoted context omitted.

> Devices trying to use DoT or DoH??? Blocked, PiHoles take over. How? I can see you only allowing some ports through the firewall, but presumably TCP 443 is one of those. According to Cloudflare [0] DoH uses that. What if Samsung uses that, or figures DoT on port 443 works better? Do you only allow specific destinations for these devices? I actually use a similar setup, only I removed pihole and just use some lists…

I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 f…

Good stuff.

As an alternative, has someone tried running http/s proxy on the firewall and blocking the rest of client HTTPS (except maybe for whitelist devices)?

Re: The Beauty of Having a Pi-Hole (2024)

#180

Post by baq »

wkat4242 wrote: post #173
baq wrote: post #156

Earlier quoted context omitted.

Everything other than 80 and 443 is blocked by default, anything-over-https is just a matter of time. With a properly configured TLS MITM proxy only certificate pinning will prevent snooping, but it’ll also prevent connectivity, so you might call it a win for security/privacy, or a loss for the open internet if it’s you who needs to VPN to a safe network from within such an environment…

A port number does not force a certain protocol. You can run everything you want over port 443. And yeah I also think it's a really bad idea to run everything over https. But I don't think it'll happen.

You can. The client side enterprise proxy/firewall really doesn’t want you to, though. Just a fact of life.
Post reply on HN