69 ms·

Pi-hole – A black hole for Internet advertisements

551 points by goblin89 10y ago

harryf 10y ago
Cache https://webcache.googleusercontent.com/search?q=cache:0qPVd8rUYXMJ:https://pi-hole.net/+&cd=1&hl=en&ct=clnk&gl=ch https://webcache.googleusercontent.com/search?q=cache:0qPVd8... Also github project explains https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole
gravypod 10y ago
What kind of minimum resources are required to run this? Can I run this on my 128MB VM?
- gr00 10y ago
  I'm running this on my chip. https://getchip.com/pages/chip https://getchip.com/pages/chip I don't see any reason why this wouldn't run well on a pi-zero. It doesn't do much beyond DNS.
- majewsky 10y ago
  Most definitely, although it of course depends on what else you're running on that VM. I have a home server running, among other things, a very similar setup [1] based on dnsmasq and a simple shell script cronjob, and the dnsmasq weighs in at ~12 MB memory usage (RSS). [1] https://github.com/majewsky/system-configuration/blob/bf0f2b7600ec13803cd0687a01828935ad0654da/holodeck-damogran.pkg.toml#L254-L385 https://github.com/majewsky/system-configuration/blob/bf0f2b...
philplckthun 10y ago
This is really neat! I'm wondering why the name is so Raspberry Pi-specific ;) Is there a docker container for it already, by any chance?
- pjc50 10y ago
  From Br. Eng. "shut your piehole" (slang), meaning "shut up".
  - Gaelan 10y ago
    American English as well, though I did miss the joke.
  - philplckthun 10y ago
    yep, the name does explain itself, but "pi" and the logo are hinting at raspberry pi
    - Zekio 10y ago
      It might just be it was initially made for Raspberry pi and then expanded over time
      - promofaux 10y ago
        Exactly that! The name has just kind of stuck, even though you can in fact run it on most linux distros (We officially support Ubuntu/Debian based distros, but there is limited support for Centos, and even forks for Arch, and Docker!), on a whole host of different hardware.
      - vocatus_gate 10y ago
        This is the correct answer.
- promofaux 10y ago
  https://github.com/diginc/docker-pi-hole https://github.com/diginc/docker-pi-hole
- chug 10y ago
  It's not officially part of the Pi Hole project, but I've been using https://hub.docker.com/r/diginc/pi-hole/ https://hub.docker.com/r/diginc/pi-hole/ for about six months on a Raspberry Pi (though they support other platforms) and had no issues. They also keep up to date with new releases within a day or two usually.
gcb0 10y ago
solution that doesn't require a dns server (or can be a dns server local cache) http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ I add this to my modem/wifi ap. and then just let every device use it to resolve. if the device allows to set a hostfile, I also add a local copy for when iam not in my network.
- dbg31415 10y ago
  * GitHub - StevenBlack/hosts: Extending and consolidating hosts files from a variety of sources like adaway.org, mvps.org, malwaredomainlist.com, someonewhocares.org, yoyo.org, and potentially others. You can optionally invoke extensions to block additional sites by category. || https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts Direct link: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/h... Also, I think OpenDNS blocks ads too. Haven't tried it in a few years though. * Home Internet Security | OpenDNS || https://www.opendns.com/home-internet-security/ https://www.opendns.com/home-internet-security/
- decasteve 10y ago
  I take the hosts file approach to blocking on my VPN/DNS/Proxy servers. I also add most Google/Facebook/etc domains to cut down on tracking and bandwidth from remote resources. Somehow the tentacles of Google (Analytics/Fonts/etc) and Facebook extend to most of the web. Their embedded javascript is everywhere. Blocking at the hosts file level seems to be the easiest and most convenient approach.
mirimir 10y ago
Porting this to FreeBSD/pfSense would be cool.
- Bedon292 10y ago
  I used pi-hole until I got pfSense set up. Then I migrated to pfBlockerNG, which has a lot of the same DNS blocking capabilities built in. You may want to check it out.
- time4tea 10y ago
  As I also mentioned in another comment above, you might find some value in py-hole, which is a pi-hole implemented in python. You can just apt-install it. Its pre-alpha, but it might work for you... https://github.com/time4tea-net/py-hole https://github.com/time4tea-net/py-hole
__oz 10y ago
+1 for pfSense port. Also, not sure how I feel about having this device as my primary DNS server for my entire internal network. What if the project gets compromised and injects a number of malicious DNS entries, now my entire network is toast?
- wtfishackernews 10y ago
  You can choose to only use it on the machine it is running on, or point other computers to it selectively.
  - __oz 10y ago
    To reliably run this DNS server I would have to have another host on the network that uses a separate DNS route that checks every entry on pi-hole against the secondary to confirm something fishy is not going on.
- promofaux 10y ago
  You can always review the code for yourself over on our github repo (https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole)! As well as the devs, there are so many pairs of eyes on the code that if anything fishy were to happen, everyone would know about it (not to mention it would completely undermine the hard work we've put into it over the past couple of years!) Updates are manual, too, so unless you intervene, there is no reason that a working system would suddenly become compromised, except if somebody had access to your network. But then you have a different issue...
- fuzzybeard 10y ago
  Not if you run it on an ARM system sadly.
- JustSomeNobody 10y ago
  But, can't this be said of any DNS provider?
ckastner 10y ago
The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
- cphoover 10y ago
  If you care to you can easily view the contents before executing them. `curl -sSL https://install.pi-hole.net` https://install.pi-hole.net` It's only 1400 lines of code. At least it has TLS to prevent a MITM
  - erelde 10y ago
    ಠ_ಠ Looking at brew.sh.
    - erelde 10y ago
      Correction: they corrected it.
- Gaelan 10y ago
  Unless you've audited the source, a manual install isn't any better.
  - ckastner 10y ago
    Hence why I merely opposed actively encouraging this pattern. I can't stop people from doing potentially dangerous things, but I don't have to promote those things, either.
    - mrstone 10y ago
      I don't think the other way is inherently any safer, because people don't tend to actually audit their sources to begin with.
  - 10y ago
toad_tyrrant 10y ago
I just set this up at home yesterday (using an Odroid C2). A very pleasant experience so far. I'm trying to find other services that are worth running in a similar fashion. Any ideas?
- wtfishackernews 10y ago
  Not strictly useful for yourself, but you could run a tor relay https://www.torproject.org/docs/tor-doc-relay.html.en https://www.torproject.org/docs/tor-doc-relay.html.en
  - toad_tyrrant 10y ago
    That is a decent idea. I have never used Tor though, and I can't say I know the consequences of running a relay. So I'd probably skip that.
    - wtfishackernews 10y ago
      As long as you don't run an exit relay, it should be completely safe and legal. The EFF has a good write-up about it https://www.eff.org/torchallenge/what-is-tor.html https://www.eff.org/torchallenge/what-is-tor.html
      - toad_tyrrant 10y ago
        Actually, that is quite interesting. Thank you for the link.
    - Operyl 10y ago
      You don't have to run an exit node. Just relaying to other nodes helps a ton!
  - agumonkey 10y ago
    any stats on the number of relays online ?
- 10y ago
deleted 10y ago
[deleted]
j_s 10y ago
You may have missed the precursor discussion this past weekend, a walkthrough of setting up pihole on VPS: Set up a cheap cloud hosted adblocker in an hour for $2.50 a month https://news.ycombinator.com/item?id=13852109 https://news.ycombinator.com/item?id=13852109 Of particular added value there was mention of Android apps that can be setup to self-host an ad-blocking VPN / hosts filtering without rooting: https://news.ycombinator.com/item?id=13853408 https://news.ycombinator.com/item?id=13853408 https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard NetGuard is the first free and open source no-root firewall for Android.
- ce4 10y ago
  Alas the plugin that does host-based blocking is not available in the play store version, it's/was a paid feature for the version on GH only. (edit: Don't know the current state though. remember from some time ago when I last checked it).
  - j_s 10y ago
    Sounds like this is still true. Optionally block ads using a hosts file (not available if installed from the Play store) I re-linked NetGuard as the most user-friendly, but https://github.com/julian-klode/dns66 https://github.com/julian-klode/dns66 was also mentioned.
no_wizard 10y ago
PiHole is pretty cool, very 'plug n play' which I like. A sufficiently advanced average user can set it up without too much trouble just following on a guide, even a relatively tech savvy 'lay' person can do this. If you like a more technical solution I prefer something like running a Unbound + NSD server Here's some great tutorials on that: (Kudos to the people who write Calomel, i really liked these tutorials, it was a great way for me to get started and look into these services deeper once understanding what was going on here) https://calomel.org/nsd_dns.html https://calomel.org/nsd_dns.html https://calomel.org/unbound_dns.html https://calomel.org/unbound_dns.html Pairing that with squid proxy can be the ultimate win: https://calomel.org/squid.html https://calomel.org/squid.html https://calomel.org/squid_adservers.html https://calomel.org/squid_adservers.html https://calomel.org/squid_ua_random.html https://calomel.org/squid_ua_random.html and don't forget dnscrypt people! https://dnscrypt.org/ https://dnscrypt.org/ I'm really big into having ones own DNS server on the network instead of completely using outside solutions. There is little overhead with a sufficiently modern implementation. Also, these solutions run on FreeBSD/OpenBSD for those who prefer. As a complete aside. Aren't most routers, esp. business class routers, running modified Unix/Linux anyway? Why on earth hasn't a reputable company made a guns ready router that lets you have access to the Linux/Unix underpinnings without flashing (albeit awesome) Open Source alternatives? I would think in the 'business/enterprise' class hardware side this would be more prevalent. Maybe I just don't know of any solutions like that available stateside. I found one in Europe: https://omnia.turris.cz/en/ https://omnia.turris.cz/en/ Can't get it stateside though :( I instead custom built most of my networking hardware...but still.
- grp 10y ago
  Check: https://www.pcengines.ch/ https://www.pcengines.ch/ Maybe you can get some alternatives based on those cards.
  - no_wizard 10y ago
    I'm actually wondering if they simply didn't repackage this hardware with a better then average design for a case, frankly. The specs are very similar. I think even though these are AMD embedded processors they're ARM, not sure though, it didn't say (or i missed it). Thanks for the link!
vxNsr 10y ago
How are people dealing with whitelisting when a website becomes broken because of an over zealous block. I find myself turning off ublock for some websites at least once a day, not because there are ads on the page but because they're issuing a dependency somewhere that has been blacklisted.
- wtfishackernews 10y ago
  Through the admin console, you can whitelist domains or disable all blocking for a given amount of time.
  - Bedon292 10y ago
    Yeah, first think I did after setting up pi-hole was go and visit all my primary sites, and see what was being blocked. Then white listed things I was OK with, or things that were breaking sites.
- deleted 10y ago
  [deleted]
nkkollaw 10y ago
With all the ad blocking technologies that are coming up, I wonder if Google is devising something to counteract these efforts. For instance, since browser-based ad blockers work from what I know by blocking known domain names, couldn't Google create random subdomains and serve the code from a different subdomain every day or even every few hours, as well as change the way their JavaScript and HTML looks? Even something very expensive to run would be justified with all the money that advertising brings in. If Google can create software that can tell what's in a picture, or if a person in a picture is happy or not, why can't they find a way to fool ad blockers..?
- fwn 10y ago
  Since all the popular filter lists are public, you could even scan them on the fly to evaluate your likelihood of being blocked. But in the end you probably won't win against someone who really hates ads. - and that's probably better for users as well as advertisers.
  - Bedon292 10y ago
    That's another good point. The people who are actively blocking ads are probably not the ones going to click them, even if they are not blocked. So not worth the money to invest in unblocking the ads going to people who aren't going to click them.
    - SamBam 10y ago
      People greatly overestimate their ability to completely ignore ads, and to make purchasing decisions free from influence. Sure, I believe that I am pretty much completely unaffected ads, but then so does almost everybody else.
      - stagbeetle 10y ago
        Be careful with "I believe that I am pretty much completely unaffected ads, but then so does almost everybody else." This is in the same vein of inductive reasoning as "just snap out of your [insert mental illness/addiction/etc.]." "People," in this context, isn't defined either. If however we were to say that by "people" you mean millennials, then you would be wrong. But if you meant "the population at large" you would be correct. Although, the second statement is tangential to the article at hand.
kuon 10y ago
I've been running a DNS based ad blocking for ages, but I realized that recently, youtube has been serving ads from the same domain as regular videos. I wonder if anybody has seen this.
- dingaling 10y ago
  The primary difference seems to be that the real videos have '/watch?' in the URL versus the ad videos.
noja 10y ago
> Error establishing a database connection Looks like someone has shut the Pi-hole.
SnaKeZ 10y ago
Link to the Android Client (unofficial): https://github.com/friimaind/pi-hole-droid https://github.com/friimaind/pi-hole-droid
nikon 10y ago
Using this at home. Really interesting to see the blocked domains on the dashboard. Realised my two Samsung Smart TV's were constantly calling home for example. You'll eventually whitelist some things that break like Spotify/Sonos IIRC. I may switch to an Odroid C2 if I go with a permanent VPN connection as the throughput of the RPi3 network port is not the best.
crorella 10y ago
When I tried pi-hole I often noted some urls were added 'automagically' to the whitelist, they will show up a few days after I removed them. All of them were weird domains.
- promofaux 10y ago
  Pi-hole Dev here. The only domains added to the whitelist are the domains on which the source lists are themselves hosted. It's probably complete over-kill, but the reasoning behind it is just in case one list tried to blacklist another. Compare the "automagical" whitelist entries (http://imgur.com/a/rxgsC http://imgur.com/a/rxgsC) to the Default whitelist here: https://github.com/pi-hole/pi-hole/blob/master/adlists.default https://github.com/pi-hole/pi-hole/blob/master/adlists.defau... Edit: The code that does it: https://github.com/pi-hole/pi-hole/blob/master/gravity.sh#L257-L266 https://github.com/pi-hole/pi-hole/blob/master/gravity.sh#L2...
  - dmix 10y ago
    Looks like your comments were getting killed with [dead] automatically. Maybe because of a new HN account combined with linking to the same site a couple times cause it to flag some spam detector? I vouched for your comments so they appear. Thanks for the project!
    - promofaux 10y ago
      Ah! I did wonder what was going on.. :) I've heard of HN before, but never actively participated, hence only signing up today! Thanks for vouching for me :)
      - dang 10y ago
        Sorry about that, and welcome to HN! (I'm a moderator here.) You got hit by a spam filter; they're tuned more aggressively for new accounts. We've marked this account legit so it won't affect you again.
- yunolisten 10y ago
chintanshah24 10y ago
Does this mean that I will have to setup an always running server at home?
24gttghh 10y ago
I went so far as to set up Dnscrypt with a pi-hole setup recently and it was almost as painless as advertised. And it finally gave me something productive to do with my RPi3! https://github.com/pi-hole/pi-hole/wiki/DNSCrypt https://github.com/pi-hole/pi-hole/wiki/DNSCrypt could use a little wordsmithing, but it wasn't too bad.
ThenAsNow 10y ago
I have to admit to doing as little as possible from web browsers on phones, but on the desktop I rely extensively on uMatrix + NoScript (don't know if adding PrivacyBadger on top would buy me anything). However, NoScript for Android seems to be moribund and I don't think there is a uMatrix for Android either. DNS-based ad-blocking seems very 90s (i.e., designed for an era that's less invasive than today), and there's a ton of javascript content that really needs to be filtered as well if you want to counter all the ads + tracking. Is there any equivalent to NoScript + uMatrix on Android?
- majewsky 10y ago
  I only have uBlock Origin on Firefox for Android, as opposed to uMatrix on desktop Firefox. It's better than nothing wrt tracking blocking, and it kills most of the ads.
seedifferently 10y ago
For anyone interested in a cross-platform single-binary alternative to Pi-hole, I've been hacking on this: https://github.com/seedifferently/nogo https://github.com/seedifferently/nogo (Disclaimer: I am the author of nogo)
- ComodoHacker 10y ago
  1. Add subscriptions to popular lists like in AdBlock/uBlock with autoupdating and people will start using it. 2. Prevent sites from manipulating the list via CSRF. 3. Packages/Installers with installation as a service/daemon would be a plus.
ryandrake 10y ago
I've been doing this at home for probably close to 10 years or so, set up manually using dnsmasq, and periodically fetching new blacklists. Nice to see it wrapped in a tidy package--great work.
geuis 10y ago
I haven't had time to look at the code yet. I have some questions though. As an experiment a while back I wrote a simple dns server that blocked ad-related domains. https://github.com/geuis/lead-dns https://github.com/geuis/lead-dns. While it technically worked, it made using the web almost non functional. Nearly every site was broken in some way. So blocking purely by domain isn't going to work. I wonder how pi-hole is dealing with it.
- promofaux 10y ago
  We have a web interface with a whole host of tools to easily identify and whitelist the domains that may or may not be causing issues with sites you browse. Everyone's mileage varies, but I have only had to whitelist 5 or 6 sites using the default blocklists.
WhizzoButter 10y ago
The Connectify Hotspot app added a similar feature recently. It'll block ads for all clients connected to the hotspot. It's Windows-only though: https://www.connectify.me/blog/block-annoying-ads-connectify-hotspot/ https://www.connectify.me/blog/block-annoying-ads-connectify...
vanekjar 10y ago
Cool project! Great idea and nice UI. I have tried recently and it works fine with HTTP. The problem is with ads served via HTTPS and since today most of the pages are using HTTPS protocol pi-hole is kinda useless. For reference on this topic https://discourse.pi-hole.net/t/websites-hanging-timing-out-with-pi-hole-enabled/1530/13 https://discourse.pi-hole.net/t/websites-hanging-timing-out-...
- wlll 10y ago
  DNS happens before HTTP and HTTPS. If you block at the DNS level it will work for both HTTP and HTTPS URLs. That page you linked seems to confirm this, and that Pi-Hole works just fine blocking HTTPS.
  - vanekjar 10y ago
    That's true, but instead of empty ad being server (as in case HTTP), HTTPS request timeouts and increases loading time for many pages, because the page waits until all JS loads. Another problem is that some browsers will retry failed request several times (Chromium) effectively prolonging the time before final error is confirmed. More about HTTP retry can be found here https://tools.ietf.org/id/draft-nottingham-httpbis-retry-00.html https://tools.ietf.org/id/draft-nottingham-httpbis-retry-00.... To sum it up. Using pi-hole had a negative impact on my browsing experience because HTTPS pages were more less buggy/slow.
    - detaro 10y ago
      HTTPS requests only timeout if your setup doesn't reject them (also described in your first link).
  - corford 10y ago
    True but only if the add is served off a different domain.
zakk 10y ago
Stupid question: how does it work when the majority of traffic is through SSL, making a request to an ad and a request to actual content indistinguishable? I don't think all websites serve ads from a different host. Do they?
- neoeldex 10y ago
  No such thing as stupid questions, but ads are usually served through a specific domain, which can be blocked, even with SSL
  - kirubakaran 10y ago
    How about this? https://twitter.com/officialjaden/status/329768040235413504?lang=en https://twitter.com/officialjaden/status/329768040235413504?...
- mrstone 10y ago
  As far as I can tell, it doesn't; they don't support blocking SSL traffic. Makes it kind of useless, I think.
  - promofaux 10y ago
    Of course it can! If it has a domain name, it can be blocked. What you may see is the browser grumbling about it. Essentially all that is happening is a client asks for a domain (e.g ssl.google.com) and if it is on the blacklist, then it returns it's own local IP address for that domain instead of the real one. Which is where you will find the browser complaining. All we return is a blank page/blocking information page, but not via https. Of course, we could probably get around that by generating self-signed certificates on install, but the user would then need to install that certificate on all of their client machines (I think, I'm not massively proficient in this area!) which makes it an extra, and not vital, step that may scare off the more novice users.
vanekjar 10y ago
Cool project! Great idea and nice UI. I have tried recently and it works fine with HTTP. The problem is with ads served via HTTPS and since today most of the pages are using HTTPS protocol pi-hole is kinda useless. For reference on this topic https://discourse.pi-hole.net/t/websites-hanging-timing-out-with-pi-hole-enabled/1530/13 https://discourse.pi-hole.net/t/websites-hanging-timing-out-...
a3n 10y ago
This could be in response to any number of comments on this page: I use uBO and a few other blockers. I almost never see an ad. A few days ago I saw an ad, and I was surprised. It was for Cadillac cars. I hovered over the ad, and it seemed to go directly to cadillac.com. And I was sort of OK with that. The page, and the ad, seemed to be designed like any other legitimate link to another page or site. I don't know how the image made its way on to the page and in to my browser, but it appeared much less intrusive than a totally ad network-served ad. Certainly the 1st party site could collect data about my visit and send it somewhere, but at least they appear to be more in the loop than just opening their site to all comers. And if I clicked through to cadillac.com, they could do the same. Anyway, that's more along the lines of what I've been wishing for as a consumer in web ads.
- nattaylor 10y ago
  Are you in-market for a car?
  - a3n 10y ago
    No, and I haven't been searching cars for any reason.
- ch 10y ago
  Would have been interesting to know who the domain was homed to. Might have just been an ad network with a CDN and cadillac.com CNAME'd to their servers. Looks like an origin served ad, but still flows through the tracker.
- SomeStupidPoint 10y ago
  If all ads were a picture with a link served as part of the page, I wouldn't use an adblocker. I read newspapers full of ads and don't really mind -- the ads make the local weekly free! But it wasn't me who started an arms race decades ago with pop-over/under chains and escalated with tracking scripts, auto-playing videos, and bidding platforms serving malware. Are advertisers really surprised people opt out of such toxic behavior?
Animats 10y ago
This is just a DNS filter. Why is it a big deal? DNS filters sort of work, but they're not new or magic. They trigger some ad-blocking detectors when the ads don't load.
- geekamongus 10y ago
  Easy to run at home with a web-based GUI for whitelisting, blacklisting and such. I like this tool a lot, personally, and it helps me feel better about keeping the family safe(r) online at home.
  - olyjohn 10y ago
    Agreed, it's been really nice to run at home. Took about an hour to set up from a diskless Pi I had sitting around, to a fully running system. Maintenance has been zero so far, and haven't had any downtime or anything. The best part was when I first fired up the web interface and saw that it had already blocked 14 requests after hardly being up for more than 5 minutes. Nobody was home at the time, so it was kind of a wake up call to see idle devices reaching out to potential ad servers.
    - geekamongus 10y ago
      I was amazed at how much it was blocking on my Roku device hooked up to my TV. I ended up having to whitelist a few things in order for it to work, but it's blocking ads there too.
- sccxy 10y ago
  Don't be such a dick It is good software which does simple things very well.
- huhtenberg 10y ago
  It's the only way to block ads and tracking on locked-down devices, i.e. pads, pods and smartphones.
- JustSomeNobody 10y ago
laumars 10y ago
For those of us - myself included - who run a hosts file list (either using dnsmasq like Pi-hole or directly), here are the sources that Pi-hole use so you can add to your own solution: https://github.com/pi-hole/pi-hole/blob/master/adlists.default https://github.com/pi-hole/pi-hole/blob/master/adlists.defau... There's a few on there I don't use and will look to implement. There's also a few they seem to have missed (perhaps intentionally?) so below I have included the lists I use in case it's useful for anyone else: http://someonewhocares.org/hosts/hosts http://winhelp2002.mvps.org/hosts.txt http://adaway.org/hosts.txt http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext&useip=127.0.0.1 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/StevenBlack/hosts http://www.malwaredomainlist.com/hostslist/hosts.txt http://www.montanamenagerie.org/hostsfile/hosts.txt
- nigifabio 10y ago
  Sound like an amazing setup, what about sharing all these scripts? How and why you build your browser?
  - laumars 10y ago
    It's just a shell script to manage dnsmasq running on my FreeBSD home server. It's not sophicated but equally it's written specifically for my server so no very portable either. I did think about writing something to share but projects like Pi-hole have done a better job serving the community than i could have. So i just share the sources i use instead incase any like-minded sysadmins find it useful.
    - time4tea 10y ago
      You could also use py-hole which is a simple apt install of a bit of python that does the dnsmasq file creation and update. Its pre alpha but may work for you https://github.com/time4tea-net/py-hole https://github.com/time4tea-net/py-hole
      - laumars 10y ago
allendoerfer 10y ago
I love how they recommend curl-bash-piping, but then put a disclaimer beneath it, even with a detailed post about it. As if people would not just copy paste it anyway. I think they were just trying to dodge the usual curl-pipe-bash-is-evil comment thread – unsuccessfully, since I started it anyway.
- JustSomeNobody 10y ago
  Yes, this is evil. Installing software off of <insert platform store here> can be evil too. Buyer beware.
gwu78 10y ago
Default settings use remote, shared DNS caches run by an advertising company. Regardless, this is a step in the right direction. DNS is highly effective for this filtering out advertising. Personally I just run my own authoritative nameserver(s) with all the IP addresses I need. No recursive cache. When I browse to websites where I have never been and may not return, I am never using graphical browser that loads "resources" automatically from any random domain. I am using a browser I compiled myself. I am only reading text. Binary resources, e.g., video, can be downloaded non-interactively with an ftp/http client. If it is an important website that I use repeatedly, then I have all the IP addresses for the resources the website's pages will need stored in a zone files. Then it is "safe" to use a browser written by an organization company that makes money from ads. All DNS requests are answered by my server(s). I can retrieve (refresh) the IP addresses for my zone files very quickly with custom software I wrote to do this. My lookups are faster than a cold recursive cache and send out fewer requests. IMO, the way to think about "ad-blocking" is not to try to imagine how to block every possible ad server. Instead, just focus on what web content you want and figure out what addresses you need to get it. At one point a certain browser written by an advertising company had its own DNS resolver. Imagine your /etc/resolv.conf being completely ignored. Food for thought.
- pgrote 10y ago
  Do you find a setup like this takes more time to gather the information you're looking for? What is your primary reason for doing it this way? Privacy? Avoiding malware?
  - gwu78 10y ago
    "Privacy? Avoiding malware?" Neither. Those benefits are only side effects.
- corney91 10y ago
  For graphical browsers uMatrix is a good way to do this sort of thing. For every website you visit, you can tell it what resources from which domains to load and it'll block everything else.
- 10y ago
JustSomeNobody 10y ago
Wow, somebody here hates the author. Every one of their comments is down voted to death. What gives? Did they do something to make people mad? I'm really confused.
libeclipse 10y ago
I used this for a while but I found that it was unbearably slow. Perhaps it's too much to ask from a RaspberryPi3.
- devopsproject 10y ago
  Something was wrong. It barely touches the processor even with 10-20 clients running.
- promofaux 10y ago
  When you say unbearably slow, do you mean the actual DNS resolution, or the Admin interface? An Rpi3, even a Rpi B or zero is plenty good enough for DNS queries! The Admin interface has been a bit of a bugbear for a while, but we are working on some massive improvements for the 3.0 release (coming soon™)
  - libeclipse 10y ago
    The DNS resolution itself was really slow for me, slowed down web browsing severely. Also I was really concerned by the fact that anyone on the network could access history for everyone else. It's not a nice feature. It's a good project otherwise, props to you guys.
QuadrupleA 10y ago
I definitely hate ads like anyone, but it should be acknowledged that ads serve a purpose too, of creating an economy for free content and giving people an avenue to get some income in exchange for their efforts, and possibly be able to devote their full attention to a free project and not have to support themselves with other income. Ads give creators some incentive to create stuff - although the income generally isn't great unless your audience is massive. That said, the ad networks out there seem pretty awful in terms of privacy, slow-running javascript code mess, huge images or videos adding megabytes to the size of what should be a simple text page, etc. So if it's not doing it already perhaps this project can filter and put some pressure on the ad networks to clean up their mess a bit and not harm the user experience so much, and if an ad network is playing nicely, allow it through as a way to support free projects and their creators.
- zeta0134 10y ago
  I've maintained for a long time that the ad networks themselves are the problem, not advertising as a whole. There is a place for video advertising (around content that is also video), there is a place for audio advertising (on the radio, around podcasts, on music services), and there is even a place for animated, interactive advertisements, on sites that are expected to dance and move anyway, like online games. The trouble is, most third party networks are so laser focused on getting people to "interact" with their advertising that they've skewed the game in favor of distracting users from the content they arrived to consume. They're so focused on targeted advertising that they regularly invade users privacy, utilize questionable data collection practices, and break down security barriers when browsers try to shut down their violations of user trust. It's no wonder ad blockers are on the rise, because the existing ad networks are all untrustworthy. There will always be a place for advertising when it's done properly. Watch an NFL broadcast and observe the product placement, the logos and sponsors everywhere. It's organic, integrated into the very fiber of the broadcast in a way that couldn't be blocked with even the most sophisticated blocking software. And it's also usually quite tasteful, there to promote the product, but not distracting enough to detract from the game the viewers came to the channel to watch. This kind of advertising, organic product placement and sponsorships, where the content creator and the advertiser have a real partnership and coordinate their efforts, this is the kind of advertising I want to see more of. For all the drama they tend to draw, I commend the Gawker sites (Gizmodo is particularly good about this) for their Sponsored posts and their frequent "Deal of the Day" posts, which are first-party advertising that my blocker regularly fails to block. And you know what? Some of the deals are genuinely interesting to me, because Gizmodo clearly knows their audience, and selects advertising partners that make sense on their blogs. More of that please!
jerrac 10y ago
I wonder if there's any way to integrate this with OPNSense firewall. I already have that set up as my LAN's dns server so I can name my internal computers.
- majewsky 10y ago
  Can you set the pi-hole as the firewall's upstream DNS?
  - jerrac 10y ago
    That's the direction I was thinking of going. My main concern is that I spent quite a while figuring out the fastest dns servers to use, and I have them set in OPNSense. I wonder how adding pi-hole to the mix will effect speed... (As in, finding the dns servers that select the best servers for my streaming video apps...) Guess the best thing to do is to try it. I would hope pi-hole would let me select it's upstream servers as well. :)
pix64 10y ago
I feel like this is a bit dangerous because it doesn't allow the end user to disable it if it breaks a website which is quite common.
- majewsky 10y ago
  Is it? I'm sitting behind a similar DNS-level adblocker and the only thing that I've noticed broken from time to time is analytics.twitter.com (some external links in the Twitter app route through there, but not enough to annoy me). Or maybe I'm just avoiding all those blocker-blocking sites effectively.
- promofaux 10y ago
  There is a disable button on the web interface[1] which allows you to either disable it permanently, or for a specific amount of time. Of course, client devices need to clear their DNS cache, too, in order for this to work properly, but at the moment there is no way of automating that. There are also other tools to help with blacklisted domains that cause issues/site breakages, such as a query log to identify them, and the ability to whitelist with ease! [1] http://imgur.com/a/DlIeq http://imgur.com/a/DlIeq
- JustSomeNobody 10y ago
  Then they let the admin know. The admin then whitelists the site and no more problem. There can't be that many of these situations.
staunch 10y ago
One thing is for certain, ad blocking is going to become more and more prevalent and never less. The end game for ad blocking is to all but eliminate advertising. An ad blocking client could, ultimately, just block any domain that has aggressive anti-ad block features. With enough users doing this, new sites that are ad free would quickly replace the old ad driven sites. Some of the ad driven sites would modernize. Ads are a failed path. By eliminating ads we open the door to novel solutions. Only a cynical fool could believe technology isn't up to solving this minor problem. There are already a dozen potential solutions waiting for the incentives to change.
- Kaedon 10y ago
  How do you imagine sites that are ad free would appear? What's their business model? I don't think that's a given, especially since most users won't pay (see the rise of freemium style apps vs paid ones in the app store).
  - finid 10y ago
    Proponents of adblockers are not thinking this thing through. It takes time (that's money) to create quality content that anybody would love reading. Heck, even content that's crappy takes time to create.
    - colmvp 10y ago
      I block ads, yet I financially support content creators by voluntarily subscribing to them via Patreon or tip them money (e.g. Twitch streamers). I also subscribe to publications to support journalism. I'm also fine with ads in podcasts since the creators will sometimes at least use the product and it's implemented in a way that's largely expected, e.g. (plug in the beginning, plug in the middle, maybe a plug in the end...)
    - nradov 10y ago
      No actually I've thought it through and it wouldn't bother me at all if that content disappears or moves behind a paywall.
jedisct1 10y ago
dnscrypt-proxy can do filtering as well: https://github.com/jedisct1/dnscrypt-proxy/wiki/Filtering https://github.com/jedisct1/dnscrypt-proxy/wiki/Filtering
verdverm 10y ago
https://github.com/looterz/grimd https://github.com/looterz/grimd Is a golang ad-hole. I've found it to be more performant in both the DNS/server and UI
Walf 10y ago
Network-level means no easy opt-out on a per-site basis. You cannot choose to support certain sites or view occasional sites that, understandably detect ad-blocking.
shade23 10y ago
Considering this happens at the DNS level. Any idea how the websites which do not let you view content till you disable the adblocker will react?
known 10y ago
How do I test if it's up and running after curl -sSL https://install.pi-hole.net https://install.pi-hole.net | bash
- known 10y ago
  dig news.ycombinator.com
KiDD 10y ago
I tried using Pi-Hole but I have so many trouble with IPv6 DNS not working that I just gave up...
Vanayad 10y ago
what about windows ? :(

551 points by goblin89 10y ago

Cache https://webcache.googleusercontent.com/search?q=cache:0qPVd8rUYXMJ:https://pi-hole.net/+&cd=1&hl=en&ct=clnk&gl=ch https://webcache.googleusercontent.com/search?q=cache:0qPVd8... Also github project explains https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole

gravypod 10y ago

What kind of minimum resources are required to run this? Can I run this on my 128MB VM?

gr00 10y ago
I'm running this on my chip. https://getchip.com/pages/chip https://getchip.com/pages/chip I don't see any reason why this wouldn't run well on a pi-zero. It doesn't do much beyond DNS.
majewsky 10y ago
Most definitely, although it of course depends on what else you're running on that VM. I have a home server running, among other things, a very similar setup [1] based on dnsmasq and a simple shell script cronjob, and the dnsmasq weighs in at ~12 MB memory usage (RSS). [1] https://github.com/majewsky/system-configuration/blob/bf0f2b7600ec13803cd0687a01828935ad0654da/holodeck-damogran.pkg.toml#L254-L385 https://github.com/majewsky/system-configuration/blob/bf0f2b...

philplckthun 10y ago

This is really neat! I'm wondering why the name is so Raspberry Pi-specific ;) Is there a docker container for it already, by any chance?

pjc50 10y ago
From Br. Eng. "shut your piehole" (slang), meaning "shut up".
- Gaelan 10y ago
  American English as well, though I did miss the joke.
- philplckthun 10y ago
  yep, the name does explain itself, but "pi" and the logo are hinting at raspberry pi
  - Zekio 10y ago
    It might just be it was initially made for Raspberry pi and then expanded over time
    - promofaux 10y ago
      Exactly that! The name has just kind of stuck, even though you can in fact run it on most linux distros (We officially support Ubuntu/Debian based distros, but there is limited support for Centos, and even forks for Arch, and Docker!), on a whole host of different hardware.
    - vocatus_gate 10y ago
      This is the correct answer.
promofaux 10y ago
https://github.com/diginc/docker-pi-hole https://github.com/diginc/docker-pi-hole
chug 10y ago
It's not officially part of the Pi Hole project, but I've been using https://hub.docker.com/r/diginc/pi-hole/ https://hub.docker.com/r/diginc/pi-hole/ for about six months on a Raspberry Pi (though they support other platforms) and had no issues. They also keep up to date with new releases within a day or two usually.

gcb0 10y ago

solution that doesn't require a dns server (or can be a dns server local cache) http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ I add this to my modem/wifi ap. and then just let every device use it to resolve. if the device allows to set a hostfile, I also add a local copy for when iam not in my network.

dbg31415 10y ago
* GitHub - StevenBlack/hosts: Extending and consolidating hosts files from a variety of sources like adaway.org, mvps.org, malwaredomainlist.com, someonewhocares.org, yoyo.org, and potentially others. You can optionally invoke extensions to block additional sites by category. || https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts Direct link: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/h... Also, I think OpenDNS blocks ads too. Haven't tried it in a few years though. * Home Internet Security | OpenDNS || https://www.opendns.com/home-internet-security/ https://www.opendns.com/home-internet-security/
decasteve 10y ago
I take the hosts file approach to blocking on my VPN/DNS/Proxy servers. I also add most Google/Facebook/etc domains to cut down on tracking and bandwidth from remote resources. Somehow the tentacles of Google (Analytics/Fonts/etc) and Facebook extend to most of the web. Their embedded javascript is everywhere. Blocking at the hosts file level seems to be the easiest and most convenient approach.

mirimir 10y ago

Porting this to FreeBSD/pfSense would be cool.

Bedon292 10y ago
I used pi-hole until I got pfSense set up. Then I migrated to pfBlockerNG, which has a lot of the same DNS blocking capabilities built in. You may want to check it out.
time4tea 10y ago
As I also mentioned in another comment above, you might find some value in py-hole, which is a pi-hole implemented in python. You can just apt-install it. Its pre-alpha, but it might work for you... https://github.com/time4tea-net/py-hole https://github.com/time4tea-net/py-hole

__oz 10y ago

+1 for pfSense port. Also, not sure how I feel about having this device as my primary DNS server for my entire internal network. What if the project gets compromised and injects a number of malicious DNS entries, now my entire network is toast?

wtfishackernews 10y ago
You can choose to only use it on the machine it is running on, or point other computers to it selectively.
- __oz 10y ago
  To reliably run this DNS server I would have to have another host on the network that uses a separate DNS route that checks every entry on pi-hole against the secondary to confirm something fishy is not going on.
promofaux 10y ago
You can always review the code for yourself over on our github repo (https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole)! As well as the devs, there are so many pairs of eyes on the code that if anything fishy were to happen, everyone would know about it (not to mention it would completely undermine the hard work we've put into it over the past couple of years!) Updates are manual, too, so unless you intervene, there is no reason that a working system would suddenly become compromised, except if somebody had access to your network. But then you have a different issue...
fuzzybeard 10y ago
Not if you run it on an ARM system sadly.
JustSomeNobody 10y ago
But, can't this be said of any DNS provider?

ckastner 10y ago

The installation shortcut given is curl -sSL https://install.pi-hole.net | bash and one is expected to execute this as root. Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.

cphoover 10y ago
If you care to you can easily view the contents before executing them. `curl -sSL https://install.pi-hole.net` https://install.pi-hole.net` It's only 1400 lines of code. At least it has TLS to prevent a MITM
- erelde 10y ago
  ಠ_ಠ Looking at brew.sh.
  - erelde 10y ago
    Correction: they corrected it.
Gaelan 10y ago
Unless you've audited the source, a manual install isn't any better.
- ckastner 10y ago
  Hence why I merely opposed actively encouraging this pattern. I can't stop people from doing potentially dangerous things, but I don't have to promote those things, either.
  - mrstone 10y ago
    I don't think the other way is inherently any safer, because people don't tend to actually audit their sources to begin with.
- 10y ago

toad_tyrrant 10y ago

I just set this up at home yesterday (using an Odroid C2). A very pleasant experience so far. I'm trying to find other services that are worth running in a similar fashion. Any ideas?

wtfishackernews 10y ago
Not strictly useful for yourself, but you could run a tor relay https://www.torproject.org/docs/tor-doc-relay.html.en https://www.torproject.org/docs/tor-doc-relay.html.en
- toad_tyrrant 10y ago
  That is a decent idea. I have never used Tor though, and I can't say I know the consequences of running a relay. So I'd probably skip that.
  - wtfishackernews 10y ago
    As long as you don't run an exit relay, it should be completely safe and legal. The EFF has a good write-up about it https://www.eff.org/torchallenge/what-is-tor.html https://www.eff.org/torchallenge/what-is-tor.html
    - toad_tyrrant 10y ago
      Actually, that is quite interesting. Thank you for the link.
  - Operyl 10y ago
    You don't have to run an exit node. Just relaying to other nodes helps a ton!
- agumonkey 10y ago
  any stats on the number of relays online ?
10y ago

deleted 10y ago

[deleted]

j_s 10y ago

You may have missed the precursor discussion this past weekend, a walkthrough of setting up pihole on VPS: Set up a cheap cloud hosted adblocker in an hour for $2.50 a month https://news.ycombinator.com/item?id=13852109 https://news.ycombinator.com/item?id=13852109 Of particular added value there was mention of Android apps that can be setup to self-host an ad-blocking VPN / hosts filtering without rooting: https://news.ycombinator.com/item?id=13853408 https://news.ycombinator.com/item?id=13853408 https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard NetGuard is the first free and open source no-root firewall for Android.

ce4 10y ago
Alas the plugin that does host-based blocking is not available in the play store version, it's/was a paid feature for the version on GH only. (edit: Don't know the current state though. remember from some time ago when I last checked it).
- j_s 10y ago
  Sounds like this is still true. Optionally block ads using a hosts file (not available if installed from the Play store) I re-linked NetGuard as the most user-friendly, but https://github.com/julian-klode/dns66 https://github.com/julian-klode/dns66 was also mentioned.

no_wizard 10y ago

PiHole is pretty cool, very 'plug n play' which I like. A sufficiently advanced average user can set it up without too much trouble just following on a guide, even a relatively tech savvy 'lay' person can do this. If you like a more technical solution I prefer something like running a Unbound + NSD server Here's some great tutorials on that: (Kudos to the people who write Calomel, i really liked these tutorials, it was a great way for me to get started and look into these services deeper once understanding what was going on here) https://calomel.org/nsd_dns.html https://calomel.org/nsd_dns.html https://calomel.org/unbound_dns.html https://calomel.org/unbound_dns.html Pairing that with squid proxy can be the ultimate win: https://calomel.org/squid.html https://calomel.org/squid.html https://calomel.org/squid_adservers.html https://calomel.org/squid_adservers.html https://calomel.org/squid_ua_random.html https://calomel.org/squid_ua_random.html and don't forget dnscrypt people! https://dnscrypt.org/ https://dnscrypt.org/ I'm really big into having ones own DNS server on the network instead of completely using outside solutions. There is little overhead with a sufficiently modern implementation. Also, these solutions run on FreeBSD/OpenBSD for those who prefer. As a complete aside. Aren't most routers, esp. business class routers, running modified Unix/Linux anyway? Why on earth hasn't a reputable company made a guns ready router that lets you have access to the Linux/Unix underpinnings without flashing (albeit awesome) Open Source alternatives? I would think in the 'business/enterprise' class hardware side this would be more prevalent. Maybe I just don't know of any solutions like that available stateside. I found one in Europe: https://omnia.turris.cz/en/ https://omnia.turris.cz/en/ Can't get it stateside though :( I instead custom built most of my networking hardware...but still.

grp 10y ago
Check: https://www.pcengines.ch/ https://www.pcengines.ch/ Maybe you can get some alternatives based on those cards.
- no_wizard 10y ago
  I'm actually wondering if they simply didn't repackage this hardware with a better then average design for a case, frankly. The specs are very similar. I think even though these are AMD embedded processors they're ARM, not sure though, it didn't say (or i missed it). Thanks for the link!

vxNsr 10y ago

How are people dealing with whitelisting when a website becomes broken because of an over zealous block. I find myself turning off ublock for some websites at least once a day, not because there are ads on the page but because they're issuing a dependency somewhere that has been blacklisted.

wtfishackernews 10y ago
Through the admin console, you can whitelist domains or disable all blocking for a given amount of time.
- Bedon292 10y ago
  Yeah, first think I did after setting up pi-hole was go and visit all my primary sites, and see what was being blocked. Then white listed things I was OK with, or things that were breaking sites.
deleted 10y ago
[deleted]

nkkollaw 10y ago

With all the ad blocking technologies that are coming up, I wonder if Google is devising something to counteract these efforts. For instance, since browser-based ad blockers work from what I know by blocking known domain names, couldn't Google create random subdomains and serve the code from a different subdomain every day or even every few hours, as well as change the way their JavaScript and HTML looks? Even something very expensive to run would be justified with all the money that advertising brings in. If Google can create software that can tell what's in a picture, or if a person in a picture is happy or not, why can't they find a way to fool ad blockers..?

fwn 10y ago
Since all the popular filter lists are public, you could even scan them on the fly to evaluate your likelihood of being blocked. But in the end you probably won't win against someone who really hates ads. - and that's probably better for users as well as advertisers.
- Bedon292 10y ago
  That's another good point. The people who are actively blocking ads are probably not the ones going to click them, even if they are not blocked. So not worth the money to invest in unblocking the ads going to people who aren't going to click them.
  - SamBam 10y ago
    People greatly overestimate their ability to completely ignore ads, and to make purchasing decisions free from influence. Sure, I believe that I am pretty much completely unaffected ads, but then so does almost everybody else.
    - stagbeetle 10y ago
      Be careful with "I believe that I am pretty much completely unaffected ads, but then so does almost everybody else." This is in the same vein of inductive reasoning as "just snap out of your [insert mental illness/addiction/etc.]." "People," in this context, isn't defined either. If however we were to say that by "people" you mean millennials, then you would be wrong. But if you meant "the population at large" you would be correct. Although, the second statement is tangential to the article at hand.

kuon 10y ago

I've been running a DNS based ad blocking for ages, but I realized that recently, youtube has been serving ads from the same domain as regular videos. I wonder if anybody has seen this.

dingaling 10y ago
The primary difference seems to be that the real videos have '/watch?' in the URL versus the ad videos.

noja 10y ago

> Error establishing a database connection Looks like someone has shut the Pi-hole.

SnaKeZ 10y ago

Link to the Android Client (unofficial): https://github.com/friimaind/pi-hole-droid https://github.com/friimaind/pi-hole-droid

nikon 10y ago

Using this at home. Really interesting to see the blocked domains on the dashboard. Realised my two Samsung Smart TV's were constantly calling home for example. You'll eventually whitelist some things that break like Spotify/Sonos IIRC. I may switch to an Odroid C2 if I go with a permanent VPN connection as the throughput of the RPi3 network port is not the best.

crorella 10y ago

When I tried pi-hole I often noted some urls were added 'automagically' to the whitelist, they will show up a few days after I removed them. All of them were weird domains.

promofaux 10y ago
Pi-hole Dev here. The only domains added to the whitelist are the domains on which the source lists are themselves hosted. It's probably complete over-kill, but the reasoning behind it is just in case one list tried to blacklist another. Compare the "automagical" whitelist entries (http://imgur.com/a/rxgsC http://imgur.com/a/rxgsC) to the Default whitelist here: https://github.com/pi-hole/pi-hole/blob/master/adlists.default https://github.com/pi-hole/pi-hole/blob/master/adlists.defau... Edit: The code that does it: https://github.com/pi-hole/pi-hole/blob/master/gravity.sh#L257-L266 https://github.com/pi-hole/pi-hole/blob/master/gravity.sh#L2...
- dmix 10y ago
  Looks like your comments were getting killed with [dead] automatically. Maybe because of a new HN account combined with linking to the same site a couple times cause it to flag some spam detector? I vouched for your comments so they appear. Thanks for the project!
  - promofaux 10y ago
    Ah! I did wonder what was going on.. :) I've heard of HN before, but never actively participated, hence only signing up today! Thanks for vouching for me :)
    - dang 10y ago
      Sorry about that, and welcome to HN! (I'm a moderator here.) You got hit by a spam filter; they're tuned more aggressively for new accounts. We've marked this account legit so it won't affect you again.
yunolisten 10y ago

chintanshah24 10y ago

Does this mean that I will have to setup an always running server at home?

24gttghh 10y ago

I went so far as to set up Dnscrypt with a pi-hole setup recently and it was almost as painless as advertised. And it finally gave me something productive to do with my RPi3! https://github.com/pi-hole/pi-hole/wiki/DNSCrypt https://github.com/pi-hole/pi-hole/wiki/DNSCrypt could use a little wordsmithing, but it wasn't too bad.

ThenAsNow 10y ago

I have to admit to doing as little as possible from web browsers on phones, but on the desktop I rely extensively on uMatrix + NoScript (don't know if adding PrivacyBadger on top would buy me anything). However, NoScript for Android seems to be moribund and I don't think there is a uMatrix for Android either. DNS-based ad-blocking seems very 90s (i.e., designed for an era that's less invasive than today), and there's a ton of javascript content that really needs to be filtered as well if you want to counter all the ads + tracking. Is there any equivalent to NoScript + uMatrix on Android?

majewsky 10y ago
I only have uBlock Origin on Firefox for Android, as opposed to uMatrix on desktop Firefox. It's better than nothing wrt tracking blocking, and it kills most of the ads.

seedifferently 10y ago

For anyone interested in a cross-platform single-binary alternative to Pi-hole, I've been hacking on this: https://github.com/seedifferently/nogo https://github.com/seedifferently/nogo (Disclaimer: I am the author of nogo)

ComodoHacker 10y ago
1. Add subscriptions to popular lists like in AdBlock/uBlock with autoupdating and people will start using it. 2. Prevent sites from manipulating the list via CSRF. 3. Packages/Installers with installation as a service/daemon would be a plus.

ryandrake 10y ago

I've been doing this at home for probably close to 10 years or so, set up manually using dnsmasq, and periodically fetching new blacklists. Nice to see it wrapped in a tidy package--great work.

geuis 10y ago

I haven't had time to look at the code yet. I have some questions though. As an experiment a while back I wrote a simple dns server that blocked ad-related domains. https://github.com/geuis/lead-dns https://github.com/geuis/lead-dns. While it technically worked, it made using the web almost non functional. Nearly every site was broken in some way. So blocking purely by domain isn't going to work. I wonder how pi-hole is dealing with it.

promofaux 10y ago
We have a web interface with a whole host of tools to easily identify and whitelist the domains that may or may not be causing issues with sites you browse. Everyone's mileage varies, but I have only had to whitelist 5 or 6 sites using the default blocklists.

WhizzoButter 10y ago

The Connectify Hotspot app added a similar feature recently. It'll block ads for all clients connected to the hotspot. It's Windows-only though: https://www.connectify.me/blog/block-annoying-ads-connectify-hotspot/ https://www.connectify.me/blog/block-annoying-ads-connectify...

vanekjar 10y ago

Cool project! Great idea and nice UI. I have tried recently and it works fine with HTTP. The problem is with ads served via HTTPS and since today most of the pages are using HTTPS protocol pi-hole is kinda useless. For reference on this topic https://discourse.pi-hole.net/t/websites-hanging-timing-out-with-pi-hole-enabled/1530/13 https://discourse.pi-hole.net/t/websites-hanging-timing-out-...

wlll 10y ago
DNS happens before HTTP and HTTPS. If you block at the DNS level it will work for both HTTP and HTTPS URLs. That page you linked seems to confirm this, and that Pi-Hole works just fine blocking HTTPS.
- vanekjar 10y ago
  That's true, but instead of empty ad being server (as in case HTTP), HTTPS request timeouts and increases loading time for many pages, because the page waits until all JS loads. Another problem is that some browsers will retry failed request several times (Chromium) effectively prolonging the time before final error is confirmed. More about HTTP retry can be found here https://tools.ietf.org/id/draft-nottingham-httpbis-retry-00.html https://tools.ietf.org/id/draft-nottingham-httpbis-retry-00.... To sum it up. Using pi-hole had a negative impact on my browsing experience because HTTPS pages were more less buggy/slow.
  - detaro 10y ago
    HTTPS requests only timeout if your setup doesn't reject them (also described in your first link).
- corford 10y ago
  True but only if the add is served off a different domain.

zakk 10y ago

Stupid question: how does it work when the majority of traffic is through SSL, making a request to an ad and a request to actual content indistinguishable? I don't think all websites serve ads from a different host. Do they?

neoeldex 10y ago
No such thing as stupid questions, but ads are usually served through a specific domain, which can be blocked, even with SSL
- kirubakaran 10y ago
  How about this? https://twitter.com/officialjaden/status/329768040235413504?lang=en https://twitter.com/officialjaden/status/329768040235413504?...
mrstone 10y ago
As far as I can tell, it doesn't; they don't support blocking SSL traffic. Makes it kind of useless, I think.
- promofaux 10y ago
  Of course it can! If it has a domain name, it can be blocked. What you may see is the browser grumbling about it. Essentially all that is happening is a client asks for a domain (e.g ssl.google.com) and if it is on the blacklist, then it returns it's own local IP address for that domain instead of the real one. Which is where you will find the browser complaining. All we return is a blank page/blocking information page, but not via https. Of course, we could probably get around that by generating self-signed certificates on install, but the user would then need to install that certificate on all of their client machines (I think, I'm not massively proficient in this area!) which makes it an extra, and not vital, step that may scare off the more novice users.

vanekjar 10y ago

a3n 10y ago

This could be in response to any number of comments on this page: I use uBO and a few other blockers. I almost never see an ad. A few days ago I saw an ad, and I was surprised. It was for Cadillac cars. I hovered over the ad, and it seemed to go directly to cadillac.com. And I was sort of OK with that. The page, and the ad, seemed to be designed like any other legitimate link to another page or site. I don't know how the image made its way on to the page and in to my browser, but it appeared much less intrusive than a totally ad network-served ad. Certainly the 1st party site could collect data about my visit and send it somewhere, but at least they appear to be more in the loop than just opening their site to all comers. And if I clicked through to cadillac.com, they could do the same. Anyway, that's more along the lines of what I've been wishing for as a consumer in web ads.

nattaylor 10y ago
Are you in-market for a car?
- a3n 10y ago
  No, and I haven't been searching cars for any reason.
ch 10y ago
Would have been interesting to know who the domain was homed to. Might have just been an ad network with a CDN and cadillac.com CNAME'd to their servers. Looks like an origin served ad, but still flows through the tracker.
SomeStupidPoint 10y ago
If all ads were a picture with a link served as part of the page, I wouldn't use an adblocker. I read newspapers full of ads and don't really mind -- the ads make the local weekly free! But it wasn't me who started an arms race decades ago with pop-over/under chains and escalated with tracking scripts, auto-playing videos, and bidding platforms serving malware. Are advertisers really surprised people opt out of such toxic behavior?

Animats 10y ago

This is just a DNS filter. Why is it a big deal? DNS filters sort of work, but they're not new or magic. They trigger some ad-blocking detectors when the ads don't load.

geekamongus 10y ago
Easy to run at home with a web-based GUI for whitelisting, blacklisting and such. I like this tool a lot, personally, and it helps me feel better about keeping the family safe(r) online at home.
- olyjohn 10y ago
  Agreed, it's been really nice to run at home. Took about an hour to set up from a diskless Pi I had sitting around, to a fully running system. Maintenance has been zero so far, and haven't had any downtime or anything. The best part was when I first fired up the web interface and saw that it had already blocked 14 requests after hardly being up for more than 5 minutes. Nobody was home at the time, so it was kind of a wake up call to see idle devices reaching out to potential ad servers.
  - geekamongus 10y ago
    I was amazed at how much it was blocking on my Roku device hooked up to my TV. I ended up having to whitelist a few things in order for it to work, but it's blocking ads there too.
sccxy 10y ago
Don't be such a dick It is good software which does simple things very well.
huhtenberg 10y ago
It's the only way to block ads and tracking on locked-down devices, i.e. pads, pods and smartphones.
JustSomeNobody 10y ago

laumars 10y ago

For those of us - myself included - who run a hosts file list (either using dnsmasq like Pi-hole or directly), here are the sources that Pi-hole use so you can add to your own solution: https://github.com/pi-hole/pi-hole/blob/master/adlists.default https://github.com/pi-hole/pi-hole/blob/master/adlists.defau... There's a few on there I don't use and will look to implement. There's also a few they seem to have missed (perhaps intentionally?) so below I have included the lists I use in case it's useful for anyone else: http://someonewhocares.org/hosts/hosts http://winhelp2002.mvps.org/hosts.txt http://adaway.org/hosts.txt http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext&useip=127.0.0.1 https://raw.githubusercontent.com/StevenBlack/hosts/master/data/StevenBlack/hosts http://www.malwaredomainlist.com/hostslist/hosts.txt http://www.montanamenagerie.org/hostsfile/hosts.txt

nigifabio 10y ago
Sound like an amazing setup, what about sharing all these scripts? How and why you build your browser?
- laumars 10y ago
  It's just a shell script to manage dnsmasq running on my FreeBSD home server. It's not sophicated but equally it's written specifically for my server so no very portable either. I did think about writing something to share but projects like Pi-hole have done a better job serving the community than i could have. So i just share the sources i use instead incase any like-minded sysadmins find it useful.
  - time4tea 10y ago
    You could also use py-hole which is a simple apt install of a bit of python that does the dnsmasq file creation and update. Its pre alpha but may work for you https://github.com/time4tea-net/py-hole https://github.com/time4tea-net/py-hole
    - laumars 10y ago

allendoerfer 10y ago

I love how they recommend curl-bash-piping, but then put a disclaimer beneath it, even with a detailed post about it. As if people would not just copy paste it anyway. I think they were just trying to dodge the usual curl-pipe-bash-is-evil comment thread – unsuccessfully, since I started it anyway.

JustSomeNobody 10y ago
Yes, this is evil. Installing software off of <insert platform store here> can be evil too. Buyer beware.

gwu78 10y ago

Default settings use remote, shared DNS caches run by an advertising company. Regardless, this is a step in the right direction. DNS is highly effective for this filtering out advertising. Personally I just run my own authoritative nameserver(s) with all the IP addresses I need. No recursive cache. When I browse to websites where I have never been and may not return, I am never using graphical browser that loads "resources" automatically from any random domain. I am using a browser I compiled myself. I am only reading text. Binary resources, e.g., video, can be downloaded non-interactively with an ftp/http client. If it is an important website that I use repeatedly, then I have all the IP addresses for the resources the website's pages will need stored in a zone files. Then it is "safe" to use a browser written by an organization company that makes money from ads. All DNS requests are answered by my server(s). I can retrieve (refresh) the IP addresses for my zone files very quickly with custom software I wrote to do this. My lookups are faster than a cold recursive cache and send out fewer requests. IMO, the way to think about "ad-blocking" is not to try to imagine how to block every possible ad server. Instead, just focus on what web content you want and figure out what addresses you need to get it. At one point a certain browser written by an advertising company had its own DNS resolver. Imagine your /etc/resolv.conf being completely ignored. Food for thought.

pgrote 10y ago
Do you find a setup like this takes more time to gather the information you're looking for? What is your primary reason for doing it this way? Privacy? Avoiding malware?
- gwu78 10y ago
  "Privacy? Avoiding malware?" Neither. Those benefits are only side effects.
corney91 10y ago
For graphical browsers uMatrix is a good way to do this sort of thing. For every website you visit, you can tell it what resources from which domains to load and it'll block everything else.
10y ago

JustSomeNobody 10y ago

Wow, somebody here hates the author. Every one of their comments is down voted to death. What gives? Did they do something to make people mad? I'm really confused.

libeclipse 10y ago

I used this for a while but I found that it was unbearably slow. Perhaps it's too much to ask from a RaspberryPi3.

devopsproject 10y ago
Something was wrong. It barely touches the processor even with 10-20 clients running.
promofaux 10y ago
When you say unbearably slow, do you mean the actual DNS resolution, or the Admin interface? An Rpi3, even a Rpi B or zero is plenty good enough for DNS queries! The Admin interface has been a bit of a bugbear for a while, but we are working on some massive improvements for the 3.0 release (coming soon™)
- libeclipse 10y ago
  The DNS resolution itself was really slow for me, slowed down web browsing severely. Also I was really concerned by the fact that anyone on the network could access history for everyone else. It's not a nice feature. It's a good project otherwise, props to you guys.

QuadrupleA 10y ago

I definitely hate ads like anyone, but it should be acknowledged that ads serve a purpose too, of creating an economy for free content and giving people an avenue to get some income in exchange for their efforts, and possibly be able to devote their full attention to a free project and not have to support themselves with other income. Ads give creators some incentive to create stuff - although the income generally isn't great unless your audience is massive. That said, the ad networks out there seem pretty awful in terms of privacy, slow-running javascript code mess, huge images or videos adding megabytes to the size of what should be a simple text page, etc. So if it's not doing it already perhaps this project can filter and put some pressure on the ad networks to clean up their mess a bit and not harm the user experience so much, and if an ad network is playing nicely, allow it through as a way to support free projects and their creators.

zeta0134 10y ago
I've maintained for a long time that the ad networks themselves are the problem, not advertising as a whole. There is a place for video advertising (around content that is also video), there is a place for audio advertising (on the radio, around podcasts, on music services), and there is even a place for animated, interactive advertisements, on sites that are expected to dance and move anyway, like online games. The trouble is, most third party networks are so laser focused on getting people to "interact" with their advertising that they've skewed the game in favor of distracting users from the content they arrived to consume. They're so focused on targeted advertising that they regularly invade users privacy, utilize questionable data collection practices, and break down security barriers when browsers try to shut down their violations of user trust. It's no wonder ad blockers are on the rise, because the existing ad networks are all untrustworthy. There will always be a place for advertising when it's done properly. Watch an NFL broadcast and observe the product placement, the logos and sponsors everywhere. It's organic, integrated into the very fiber of the broadcast in a way that couldn't be blocked with even the most sophisticated blocking software. And it's also usually quite tasteful, there to promote the product, but not distracting enough to detract from the game the viewers came to the channel to watch. This kind of advertising, organic product placement and sponsorships, where the content creator and the advertiser have a real partnership and coordinate their efforts, this is the kind of advertising I want to see more of. For all the drama they tend to draw, I commend the Gawker sites (Gizmodo is particularly good about this) for their Sponsored posts and their frequent "Deal of the Day" posts, which are first-party advertising that my blocker regularly fails to block. And you know what? Some of the deals are genuinely interesting to me, because Gizmodo clearly knows their audience, and selects advertising partners that make sense on their blogs. More of that please!

jerrac 10y ago

I wonder if there's any way to integrate this with OPNSense firewall. I already have that set up as my LAN's dns server so I can name my internal computers.

majewsky 10y ago
Can you set the pi-hole as the firewall's upstream DNS?
- jerrac 10y ago
  That's the direction I was thinking of going. My main concern is that I spent quite a while figuring out the fastest dns servers to use, and I have them set in OPNSense. I wonder how adding pi-hole to the mix will effect speed... (As in, finding the dns servers that select the best servers for my streaming video apps...) Guess the best thing to do is to try it. I would hope pi-hole would let me select it's upstream servers as well. :)

pix64 10y ago

I feel like this is a bit dangerous because it doesn't allow the end user to disable it if it breaks a website which is quite common.

majewsky 10y ago
Is it? I'm sitting behind a similar DNS-level adblocker and the only thing that I've noticed broken from time to time is analytics.twitter.com (some external links in the Twitter app route through there, but not enough to annoy me). Or maybe I'm just avoiding all those blocker-blocking sites effectively.
promofaux 10y ago
There is a disable button on the web interface[1] which allows you to either disable it permanently, or for a specific amount of time. Of course, client devices need to clear their DNS cache, too, in order for this to work properly, but at the moment there is no way of automating that. There are also other tools to help with blacklisted domains that cause issues/site breakages, such as a query log to identify them, and the ability to whitelist with ease! [1] http://imgur.com/a/DlIeq http://imgur.com/a/DlIeq
JustSomeNobody 10y ago
Then they let the admin know. The admin then whitelists the site and no more problem. There can't be that many of these situations.

staunch 10y ago

One thing is for certain, ad blocking is going to become more and more prevalent and never less. The end game for ad blocking is to all but eliminate advertising. An ad blocking client could, ultimately, just block any domain that has aggressive anti-ad block features. With enough users doing this, new sites that are ad free would quickly replace the old ad driven sites. Some of the ad driven sites would modernize. Ads are a failed path. By eliminating ads we open the door to novel solutions. Only a cynical fool could believe technology isn't up to solving this minor problem. There are already a dozen potential solutions waiting for the incentives to change.

Kaedon 10y ago
How do you imagine sites that are ad free would appear? What's their business model? I don't think that's a given, especially since most users won't pay (see the rise of freemium style apps vs paid ones in the app store).
- finid 10y ago
  Proponents of adblockers are not thinking this thing through. It takes time (that's money) to create quality content that anybody would love reading. Heck, even content that's crappy takes time to create.
  - colmvp 10y ago
    I block ads, yet I financially support content creators by voluntarily subscribing to them via Patreon or tip them money (e.g. Twitch streamers). I also subscribe to publications to support journalism. I'm also fine with ads in podcasts since the creators will sometimes at least use the product and it's implemented in a way that's largely expected, e.g. (plug in the beginning, plug in the middle, maybe a plug in the end...)
  - nradov 10y ago
    No actually I've thought it through and it wouldn't bother me at all if that content disappears or moves behind a paywall.

jedisct1 10y ago

dnscrypt-proxy can do filtering as well: https://github.com/jedisct1/dnscrypt-proxy/wiki/Filtering https://github.com/jedisct1/dnscrypt-proxy/wiki/Filtering

verdverm 10y ago

https://github.com/looterz/grimd https://github.com/looterz/grimd Is a golang ad-hole. I've found it to be more performant in both the DNS/server and UI

Walf 10y ago

Network-level means no easy opt-out on a per-site basis. You cannot choose to support certain sites or view occasional sites that, understandably detect ad-blocking.

shade23 10y ago

Considering this happens at the DNS level. Any idea how the websites which do not let you view content till you disable the adblocker will react?

known 10y ago

How do I test if it's up and running after curl -sSL https://install.pi-hole.net https://install.pi-hole.net | bash

known 10y ago
dig news.ycombinator.com

KiDD 10y ago

I tried using Pi-Hole but I have so many trouble with IPv6 DNS not working that I just gave up...

Vanayad 10y ago

what about windows ? :(