7 ms·

> Do you use a popular browser extension? How confident are you that the creator wouldn’t accept a $10k offer to hand it over only to have it then go rogue on y

> Do you use a popular browser extension? How confident are you that the creator wouldn’t accept a $10k offer to hand it over only to have it then go rogue on you? What makes the Pi-Hole organization any more trustworthy? (and the software stack it all depends on) Personally, I'm inclined to trust them both and hope that the long arm of the GDPR will be effective. Optimistic, I know.

travisp 8y ago
In this case it just acts as a DNS resolver. That's potentially risky when resources don't use SSL, but far less than a browser extension that can change a page in place, inject JavaScript, and record keystrokes on all pages.
- cremp 8y ago
  > resources don't use SSL Huh? DNS is hit even if the site is SSL. Unless the site has HSTS, and you've got to the site before; DNS poisoning is very much doable.
  - filleokus 8y ago
    How would the attacker do anything useful with a SSL connection attempt? They can either send the real certificate, and then not be able to decrypt the data, or send a self-signed cert which the OS/browser wouldn't trust? Are you thinking of some downgrade attack vector?
  - emilecantin 8y ago
    Yes, but the hijacker will still need to present a valid cert for that domain, which is much harder.
msmith 8y ago
Since Pi-Hole is a DNS server running on a separate machine, it just doesn’t have the same level of access as browser extension would. Even if it was rogue, the worst it could do is share the list of domains that you visit, and possibly hijack your HTTP (but not HTTPS) sessions.
- galadran 8y ago
  You, and the other commentator, are forgetting that the DNS Server handles all connections, not just those from your browser. Are you confident all the self updating software you use has no vulnerabilities? How about the video games that you play? Even assuming the use of HTTPS, there are other threats. For example, PiHole redirecting you to a MiTM, who simply observes your connection and can learn sensitive information from the timing and length of your sessions. I am not arguing browser extensions have strictly less access, just that both PiHole and your extensions have a fairly catastrophic level of access...
  - craftyguy 8y ago
    Exactly. This thing is in the best possible location for poisoning DNS for every system on your network. That should be a HUGE concern.
    - helper 8y ago
      It is an order of magnitude safer than a browser plugin.
      - craftyguy 8y ago
        Right, neither one of them are great ideas unless you can trust the source. To argue otherwise is a relative privation fallacy.
      - craftyguy 8y ago
        and then this happened: https://news.ycombinator.com/item?id=18086418 https://news.ycombinator.com/item?id=18086418
  - fibers 8y ago
    Then don't do it and wait for taboola or google ads serve you a drive by rootkit?
  - ryandrake 8y ago
move-on-by 8y ago
I think a major difference is the update scheme. Browser extensions auto-update. If they switch hands there is no user visibility when getting the updated version. Pi-Hole is installed software and requires manual updates, which gives users more visibility and control.
- gruez 8y ago
  you can turn auto-updates off. also, you can easily inspect the source for an extension (AMO doesn't allow minified js), you can't easily do that for the multitude of components that make up pi hole.
  - mynameisvlad 8y ago
    > you can't easily do that for the multitude of components that make up pi hole What? The entirety of the project is open source. In fact it's easier to look at the source code that makes up PiHole because it's all in one spot in Github.
giarc 8y ago
https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole Pi Hole is open source, so if someone did try to sneak in some malicious code, it would be seen.
- Dragonai 8y ago
  Just as a note, a project being open-source doesn't necessarily provide a 100% guarantee that it doesn't contain any (possibly obfuscated) malicious code. Our community likes to think that someone else would catch it, but enough people thinking that way can (and likely often does) lead to the bystander effect. So it's always good to be wary :) Edit: Heartbleed was a good example of this - https://www.csoonline.com/article/3223203/vulnerabilities/what-is-the-heartbleed-bug-how-does-it-work-and-how-was-it-fixed.html https://www.csoonline.com/article/3223203/vulnerabilities/wh... > The most ironic thing here is that OpenSSL is open source software. Anyone could look at the code, and presumably hundreds did, but nobody noticed the fairly elementary coding error.
- FroshKiller 8y ago
  Seen by what percentage of users who just download the binaries?
karrotwaltz 8y ago
Someone very concerned about ads whitelists can also use multiple ad blocking extensions. It would take every creator to accept the bribe for the ads to go through. Well, if the extension starts injecting ads it's another story...
1943820037 8y ago
Considering that over 20% of https://pi-hole.net https://pi-hole.net is blocked as malicious ads by my browser, I don't really understand why you would trust them to block not only the crap across the wider internet but even against their own self-interest. Remember the warning signs of craziness with NoScript? It's like you guys never learn!
- dang 8y ago
  Could you please not create new accounts for every few comments you post? We ban accounts that do this, and it's in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. HN is a community. Users needn't use their real name, but do need to have some consistent identity for others to relate to. Otherwise we may as well have no usernames and no community at all. That would be a different kind of forum. Anonymity is fine, and throwaways for a specific purpose are ok, just not routinely. https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0&query=by:dang%20community%20identity https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

travisp 8y ago

In this case it just acts as a DNS resolver. That's potentially risky when resources don't use SSL, but far less than a browser extension that can change a page in place, inject JavaScript, and record keystrokes on all pages.

cremp 8y ago
> resources don't use SSL Huh? DNS is hit even if the site is SSL. Unless the site has HSTS, and you've got to the site before; DNS poisoning is very much doable.
- filleokus 8y ago
  How would the attacker do anything useful with a SSL connection attempt? They can either send the real certificate, and then not be able to decrypt the data, or send a self-signed cert which the OS/browser wouldn't trust? Are you thinking of some downgrade attack vector?
- emilecantin 8y ago
  Yes, but the hijacker will still need to present a valid cert for that domain, which is much harder.

msmith 8y ago

Since Pi-Hole is a DNS server running on a separate machine, it just doesn’t have the same level of access as browser extension would. Even if it was rogue, the worst it could do is share the list of domains that you visit, and possibly hijack your HTTP (but not HTTPS) sessions.

galadran 8y ago
You, and the other commentator, are forgetting that the DNS Server handles all connections, not just those from your browser. Are you confident all the self updating software you use has no vulnerabilities? How about the video games that you play? Even assuming the use of HTTPS, there are other threats. For example, PiHole redirecting you to a MiTM, who simply observes your connection and can learn sensitive information from the timing and length of your sessions. I am not arguing browser extensions have strictly less access, just that both PiHole and your extensions have a fairly catastrophic level of access...
- craftyguy 8y ago
  Exactly. This thing is in the best possible location for poisoning DNS for every system on your network. That should be a HUGE concern.
  - helper 8y ago
    It is an order of magnitude safer than a browser plugin.
    - craftyguy 8y ago
      Right, neither one of them are great ideas unless you can trust the source. To argue otherwise is a relative privation fallacy.
    - craftyguy 8y ago
      and then this happened: https://news.ycombinator.com/item?id=18086418 https://news.ycombinator.com/item?id=18086418
- fibers 8y ago
  Then don't do it and wait for taboola or google ads serve you a drive by rootkit?
- ryandrake 8y ago

move-on-by 8y ago

I think a major difference is the update scheme. Browser extensions auto-update. If they switch hands there is no user visibility when getting the updated version. Pi-Hole is installed software and requires manual updates, which gives users more visibility and control.

gruez 8y ago
you can turn auto-updates off. also, you can easily inspect the source for an extension (AMO doesn't allow minified js), you can't easily do that for the multitude of components that make up pi hole.
- mynameisvlad 8y ago
  > you can't easily do that for the multitude of components that make up pi hole What? The entirety of the project is open source. In fact it's easier to look at the source code that makes up PiHole because it's all in one spot in Github.

giarc 8y ago

https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole Pi Hole is open source, so if someone did try to sneak in some malicious code, it would be seen.

Dragonai 8y ago
Just as a note, a project being open-source doesn't necessarily provide a 100% guarantee that it doesn't contain any (possibly obfuscated) malicious code. Our community likes to think that someone else would catch it, but enough people thinking that way can (and likely often does) lead to the bystander effect. So it's always good to be wary :) Edit: Heartbleed was a good example of this - https://www.csoonline.com/article/3223203/vulnerabilities/what-is-the-heartbleed-bug-how-does-it-work-and-how-was-it-fixed.html https://www.csoonline.com/article/3223203/vulnerabilities/wh... > The most ironic thing here is that OpenSSL is open source software. Anyone could look at the code, and presumably hundreds did, but nobody noticed the fairly elementary coding error.
FroshKiller 8y ago
Seen by what percentage of users who just download the binaries?

karrotwaltz 8y ago

Someone very concerned about ads whitelists can also use multiple ad blocking extensions. It would take every creator to accept the bribe for the ads to go through. Well, if the extension starts injecting ads it's another story...

1943820037 8y ago

Considering that over 20% of https://pi-hole.net https://pi-hole.net is blocked as malicious ads by my browser, I don't really understand why you would trust them to block not only the crap across the wider internet but even against their own self-interest. Remember the warning signs of craziness with NoScript? It's like you guys never learn!

dang 8y ago
Could you please not create new accounts for every few comments you post? We ban accounts that do this, and it's in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. HN is a community. Users needn't use their real name, but do need to have some consistent identity for others to relate to. Otherwise we may as well have no usernames and no community at all. That would be a different kind of forum. Anonymity is fine, and throwaways for a specific purpose are ok, just not routinely. https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0&query=by:dang%20community%20identity https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...