Literally 1/3 of my traffic is blocked by Pi-Hole as it's tracking/ad crap. That's impressive stuff!
Pi-hole 5.0
221–230 of 254 posts
Re: Pi-hole 5.0
#222Earlier quoted context omitted.
The result of this looks a bit mixed up. Are you sure that sedding 0.0.0.0 works? There are some spammers who include 0.0.0.0 in the domain name for example. I used positional splitting with awk to do the same. That worked very well.
The `sed` turns this address=/example.com/0.0.0.0 into address=/example.com/ ...which makes dnsmasq return NXDOMAIN instead of 0.0.0.0. I think that's more correct.
What about 0.0.0.0.nastydonain.com?
Re: Pi-hole 5.0
#223Earlier quoted context omitted.
It was really easy to set-up, but on first day it actually broke an Android TV-app on default settings (meaning it blocked some call that stopped the app from loading through). Ironically, after disabling it for a minute and then loading through the app, it didn't block the video ads (not rendered into the video). YMMV of course, but it wasn't usable for me since everyone in the household needs to understand/solve an…
Which to me is a good thing - smart TV's are garbage. Dumb TV + AppleTV will do just fine.
I guess, but Dumb TV + Roku can be quite terrible from a privacy perspective.
Re: Pi-hole 5.0
#224Earlier quoted context omitted.
Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if the…
Thanks! I hadn't heard of this method. One question though: What will prevent the ad providers from asking their customers to add an A/AAAA record to one of their IPs? That'll be much harder to combat for an adblocker especially because those IPs will usually be shared with actual content services. Of course this'll add overhead to the visited website manager because the IPs will probably change regularly as they're…
[deleted]
Re: Pi-hole 5.0
#225Earlier quoted context omitted.
Then you can have your client lookup blacklistedsite.com.yourdomain.com and have yourdomain.com return the record of blacklistedsite.com to bypass filtering.
Just like you could register your own domain and return the record of a blacklisted website?
Of course, but presumably the censoring dns server would never return a censored ip, regardless of domain. Whereas if you were to passthrough all non-blacklisted queries you wouldn't be able to block that, which is why no censor would ever implement it that way.
Re: Pi-hole 5.0
#226Earlier quoted context omitted.
Setting up automatic updates is probably a good idea.
Can you recommend a good way to make sure the Pi and Pi-hole are always up to date? I imagine a simple cron with pihole -up is not sufficient?
I've been using: https://www.reddit.com/r/pihole/comments/bgzvem/how_to_healt... for upgrading + healthchecks
However note that the developers of PiHole do not recommend automated upgrades, or at least be aware of the implications
Re: Pi-hole 5.0
#227Earlier quoted context omitted.
> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.
That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?
Yep, that combined with an orphaned DNS record
Re: Pi-hole 5.0
#228Earlier quoted context omitted.
The `sed` turns this address=/example.com/0.0.0.0 into address=/example.com/ ...which makes dnsmasq return NXDOMAIN instead of 0.0.0.0. I think that's more correct.
What about 0.0.0.0.nastydonain.com?
Yes, I should fix `sed` to only match end-of-line.
Re: Pi-hole 5.0
#229PSA: A RPi running Pi-hole is not a fire-and-forget item. The networked software on it, including pi-hole, sometimes has security holes discovered and exploited, and has to be kept up to date. See eg https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi... & https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491... & https://www.cvedetails.com/vulnerability-list.php?vendor_id=... (afaik Pi-hole is built…
I don’t see the issue with this? Anyone who’s able to install Pihole in the first place will be more than capable of keeping the system up to date. I’d generally trust the underlying software and the maintainers to address security issues in a timely manner, security vulnerabilities on home routers on the other hand...
Installing PiHole is copy pasting a shell script. Raspi is introducing a lot of new users to the linux community.
Re: Pi-hole 5.0
#230Is there any value in Pi-hole for people already running Unbound with a bunch of adblock blacklists ? With OPNsense, it is a three-click setup.
Found one feature: per-client blocking. Anything else ?