Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mmm, Pi-hole

troyhunt.com

Post reply on HN
Print view View original

41–50 of 421 posts

Re: Mmm, Pi-hole

#41

Post by paulryanrogers »

floatboth wrote: post #39

I've been using Privoxy. Killing two birds with one stone here: proxying access through a VPS to hide the home IP address && blocking ads. Apart from it occasionally blocking legitimate sites that begin with the word "ad" (something like, say, "adrian.blog.thing"), it works great. Because it's an HTTP proxy, it offers an interface for bypassing these unintended blocks.

If it's a dumb string-start check then that could be a lot of false positives. How often has it been wrong?

I personally hate wondering why something's not working and having to go through every extension to debug my browsing session.

Re: Mmm, Pi-hole

#42

Post by robin_reala »

josefresco wrote: post #3

> And yes, I'll chat to her about the Fox News situation as well! Highlight of the article right here.

Highlight in terms of sketchiness. I maintain our home network, but I certainly don’t spy on the sites my partner chooses to visit. Or post them on a high traffic blog.

Re: Mmm, Pi-hole

#43

Post by simias »

WorkLifeBalance wrote: post #16

Someone on here recently recommended uMatrix for this purpose and I find that a nice trade-off between usability and request blocking. It's an extension but given it's less opaque than a generic ad-blocker I feel more in control and that it's less likely to go 'rogue' like adblockers do.

I consider myself a pretty savvy user, I'm not a web dev but I understand web technologies, javascript and all that and I simply can't use uMatrix decently. Am I supposed to audit every single external resource to whitelist it? For every website I may want to visit? I don't get it.

Ublock seems to do an okay job of blocking most ads and tracking stuff so I'll stick to that in the meantime but I would be really interested to see a uMatrix tutorial or something like that.

Re: Mmm, Pi-hole

#44

Post by move-on-by »

galadran wrote: post #7

> Do you use a popular browser extension? How confident are you that the creator wouldn’t accept a $10k offer to hand it over only to have it then go rogue on you? What makes the Pi-Hole organization any more trustworthy? (and the software stack it all depends on) Personally, I'm inclined to trust them both and hope that the long arm of the GDPR will be effective. Optimistic, I know.

I think a major difference is the update scheme. Browser extensions auto-update. If they switch hands there is no user visibility when getting the updated version. Pi-Hole is installed software and requires manual updates, which gives users more visibility and control.

Re: Mmm, Pi-hole

#45

Post by cremp »

travisp wrote: post #8
galadran wrote: post #7

> Do you use a popular browser extension? How confident are you that the creator wouldn’t accept a $10k offer to hand it over only to have it then go rogue on you? What makes the Pi-Hole organization any more trustworthy? (and the software stack it all depends on) Personally, I'm inclined to trust them both and hope that the long arm of the GDPR will be effective. Optimistic, I know.

In this case it just acts as a DNS resolver. That's potentially risky when resources don't use SSL, but far less than a browser extension that can change a page in place, inject JavaScript, and record keystrokes on all pages.

> resources don't use SSL

Huh? DNS is hit even if the site is SSL. Unless the site has HSTS, and you've got to the site before; DNS poisoning is very much doable.

Re: Mmm, Pi-hole

#46

Post by lousken »

bArray wrote: post #24
lousken wrote: post #5

With disabled js dailymail loads 603(6.8MB) files 590 of which are images.

I run uBlock Origin and noscript - even then I'm amazed with how much guff the UK Daily Mail website loads. From their perspective - you would think they would want to reduce the bandwidth to the servers as much as possible...?

I run ublock origin and umatrix. And actually they do kinda care - I've tested their site on Chromium with no addons or blocking and noticed they lazy load most of those images (it loads "only" ~130images) and about 400requests in total (I only opted out from advertising using their GDPR dialog). If I opt in, it constantly pulls data ~6requests/second.

Re: Mmm, Pi-hole

#47

Post by ryandrake »

windexh8er wrote: post #26

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the project has been around a number of years now, and it's not relegated to only a RPi I would have expected him to delve into things a bit more. Pi-hole will also break things. I think the common one I always heard from users on my network at home were that Google…

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

Re: Mmm, Pi-hole

#48

Post by move-on-by »

user812 wrote: post #38
Cthulhu_ wrote: post #31

Earlier quoted context omitted.

Why the "not too much"? IIRC Adblock was "compromised" in a way because it was more profitable for them to make deals with advertisers. If they made more money off of donations they wouldn't need to sell out.

Well, it was kind of humourous, based on the idea that ad-tech will switch to first-party proxies when too many people use Pi-Hole. But on a more serious note, it is simple products like AdGuard DNS which will probably make Ad-Tech sweat more, because it's so easy to use for average users. Adblock was compromised due to lack of integrity imho.

Pi-Hole is a bit different too in that they do not maintain any block lists. It does come pre-installed with several lists, but maintained by 3rd parties. Its also very easy to add items to the block lists or import new lists. I think having this separation of powers is wonderful and will aid in the protection of the project.

Re: Mmm, Pi-hole

#49

Post by gnufied »

So I have tried using pi-hole in past and I think one of the problems is - some websites refusing to function if ads are blocked. IIRC - British Airways website uses some javascript that requires ad to be disabled for finishing checking in. It may have changed now but there are other websites too which may or may not work as expected.

With browser extensions it is typically easy to disable the ad blocker one time and check if that fixes it. With pi-hole IIRC, it was much harder to do.

Re: Mmm, Pi-hole

#50

Post by ryandrake »

galadran wrote: post #12
msmith wrote: post #10

Earlier quoted context omitted.

Since Pi-Hole is a DNS server running on a separate machine, it just doesn’t have the same level of access as browser extension would. Even if it was rogue, the worst it could do is share the list of domains that you visit, and possibly hijack your HTTP (but not HTTPS) sessions.

You, and the other commentator, are forgetting that the DNS Server handles all connections, not just those from your browser. Are you confident all the self updating software you use has no vulnerabilities? How about the video games that you play? Even assuming the use of HTTPS, there are other threats. For example, PiHole redirecting you to a MiTM, who simply observes your connection and can learn sensitive informat…

This should just be dnsmasq, for which source code is readily available and inspectable. You can (and should) compile it yourself if you don’t trust someone else’s binary.

You can also inspect the block lists to ensure they all go to 0.0.0.0 if you’re worried about mitm attacks.

Post reply on HN