Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All-in-One DNS block list

github.com

Post reply on HN
Print view View original

31–40 of 56 posts

Re: All-in-One DNS block list

#31

Post by rsyring »

Etheryte wrote: post #13
praveenweb wrote: post #4

I have been using NextDNS with a few block lists configured at the router level and device level. The internet experience has improved a lot since ads and trackers are blocked system wide. A few block lists that I would recommend: 1. Steven Hosts - https://github.com/StevenBlack/hosts 2. Adguard DNS - https://github.com/AdguardTeam/AdguardSDNSFilter 3. disconnect.me The amount of DNS requests made silently in the bac…

I'm also using NextDNS and one thing that's a huge boon for me is that the default free tier covers my use case insanely well. Given the statistics for the last 3 months I seem to consistently fly under the free tier limit but if I ever do hit it, it will just default back to a regular DNS. A very user-friendly approach and I hope they keep it as they grow.

The other option would be to pay them. :) It's great service and pretty inexpensive, why not support them?

Re: All-in-One DNS block list

#33

Post by jedisct1 »

stblack wrote: post #17

This repo has a 3-week track record, by one contributor. Disclosure: Some of us have been actively curating such amalgamated lists for a long time. https://github.com/StevenBlack/hosts

It has been around for a while, and is quite popular, especially in the Android community.

On April 23, GitHub disabled the repository. Exact reasons are unknown.

The repository was then deleted and recreated.

Re: All-in-One DNS block list

#34

Post by Mathnerd314 »

aroch wrote: post #12
cptskippy wrote: post #11

Earlier quoted context omitted.

I abandoned NoScript because I felt like I spent more time whitelisting JS than browsing the web and other people just couldn't borrow my browser. NoScript really needs the ability to whitelist a TLD for providers like cloudflare.

They do? You can globally whitelist urls

The issue for Cloudflare is whitelisting the DDoS protection script included on each page. It's under a lot of URLs so it would have to be content-based.

Re: All-in-One DNS block list

#36

Post by vsskanth »

stblack wrote: post #17

This repo has a 3-week track record, by one contributor. Disclosure: Some of us have been actively curating such amalgamated lists for a long time. https://github.com/StevenBlack/hosts

Thank you! I use your blacklist on all my devices.

Re: All-in-One DNS block list

#37

Post by ciarannolan »

willis936 wrote: post #19
ciarannolan wrote: post #18

Earlier quoted context omitted.

What are the dangers of using a sketchy blocklist?

I'm no expert, but the most obvious answer is "you MITM yourself". If there is a userbase for a list, they have to trust the list to not filter out domains that shouldn't be filtered. I have a hard time thinking how this could lead to hidden repercussions, other than some security flaw that is only exploitable when some subset of requests go through.

Perhaps they can point a particular host to a malicious IP rather than "0.0.0.0". In a list of several hundred thousand domains, you wouldn't be able to notice this manually.

ex., make Bank of America resolve to a phishing site rather than the real BoA IP.

Pi-Hole and others might check for this though, I don't know.

Re: All-in-One DNS block list

#38

Post by pizzazzaro »

rsyring wrote: post #31
Etheryte wrote: post #13

Earlier quoted context omitted.

I'm also using NextDNS and one thing that's a huge boon for me is that the default free tier covers my use case insanely well. Given the statistics for the last 3 months I seem to consistently fly under the free tier limit but if I ever do hit it, it will just default back to a regular DNS. A very user-friendly approach and I hope they keep it as they grow.

The other option would be to pay them. :) It's great service and pretty inexpensive, why not support them?

Not gonna claim to know the situation of the folks you're replying to. And Im not gonna pretend these organizations operate for free - if you can reasonably afford it? Supporting them is a great patriotism / praxis / etc for internet denizens.

But I will say this - advertising and tracking has a long, storied history of being a malware infection route. The great boon for all of us from a free-tier DNS-filter service is the additional layer of virus and information protection.

Protecting each other, even inexperienced, or low-budget users? Is the best thing we can do to slow the propagation of malware and institutional information leeches. This in turn protects even the servers of potentially ill-informed or budget-constricted server admins.

We are dealing with internet epidemiology. Free-tier "covid masks" / DNS filters preserve more health than simply for the users actively participating. We have to be in this together, or we will watch each other sink.

Thank you for your time, and sorry for the longwinded Lefty- "Dwight Schrute"-ing. But this entire disclaimer felt necessary to me.

Re: All-in-One DNS block list

#39

Post by MattieTK »

t212 wrote: post #21
wjnc wrote: post #6

Earlier quoted context omitted.

Me too! It's blocking a whopping 25%-30% of all requests without a single negative change in my browsing comfort.

I really want to use it but it blocks Spotify playlist links when I try to open them from Reddit.

They added a new setting recently to allow affiliate links like those used for tracking which might include this, try it out.

Re: All-in-One DNS block list

#40

Post by willis936 »

ciarannolan wrote: post #37
willis936 wrote: post #19

Earlier quoted context omitted.

I'm no expert, but the most obvious answer is "you MITM yourself". If there is a userbase for a list, they have to trust the list to not filter out domains that shouldn't be filtered. I have a hard time thinking how this could lead to hidden repercussions, other than some security flaw that is only exploitable when some subset of requests go through.

Perhaps they can point a particular host to a malicious IP rather than "0.0.0.0". In a list of several hundred thousand domains, you wouldn't be able to notice this manually. ex., make Bank of America resolve to a phishing site rather than the real BoA IP. Pi-Hole and others might check for this though, I don't know.

I am under the impression that the blocklist programs (such as ublock origin or pi-hole) do not have an option to redirect to anything other than the void. I can only see downsides to allowing this.
Post reply on HN