10 ms·

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the pr

I'm surprised this is the top slot right now. Troy, generally, puts out interesting info on security related news however this feels a bit minimal. Since the project has been around a number of years now, and it's not relegated to only a RPi I would have expected him to delve into things a bit more. Pi-hole will also break things. I think the common one I always heard from users on my network at home were that Google click-thrus for products always fail. But... Don't deploy it on an RPi. It's not worth the inconvenience of maintaining another entire device for a network service. There's an actively maintained container I'd recommend, or it's very easy to deploy as a VM. Troy also didn't hit on anything like DoH or DoT, surprisingly. Container link: https://hub.docker.com/r/pihole/pihole/ https://hub.docker.com/r/pihole/pihole/ Edit: word

ryandrake 8y ago
It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.
- class4behavior 8y ago
  Yeah, on openwrt you just install the adblock package https://github.com/openwrt/packages/tree/master/net/adblock/files#prerequisites https://github.com/openwrt/packages/tree/master/net/adblock/...
  - rdtsc 8y ago
    That is what I did. I used a TP-Link Archer C7 router and installed adblock and few other useful packages. Works like a charm so far.
  - deleted 8y ago
    [deleted]
  - beagle3 8y ago
    Do you know if it’s possible to deploy it on a virtual AP? E.g. have “MyNetwork” and “MyNetworkWithAds” - so that it is easier for nontechnical users to switch, and also doesn’t deactivate for everyone when just one user needs to (even if only for 5 mins)?
    - class4behavior 8y ago
      Possible but not that simple actually, as there is little to no documentation or shortcut for such a case available using dnsmasq. Afaik you can only realize this by running multiple instances. The childproof network example is the fitting how-to you can learn from: https://forum.openwrt.org/t/kidsafe-or-guest-wifi-forced-safesearch-and-adblock/6559 https://forum.openwrt.org/t/kidsafe-or-guest-wifi-forced-saf...
- mistermann 8y ago
  Can anyone recommend a "2018 good choice" for a consumer router that can run custom firmware (including dnsmasq), or a trustworthy recommendation website? Wirecutter for example doesn't note third party firmware: https://thewirecutter.com/reviews/best-wi-fi-router/ https://thewirecutter.com/reviews/best-wi-fi-router/
  - aurelian15 8y ago
    Not really an off-the shelf consumer router, but since you want to install custom firmware anyways, you might want to consider the PC-Engines APU2 board [1]. You can either install any "normal" desktop x86_64 Linux distribution or a specialized router OS such as OpenWrt [2]. The AMD APU on the board supports hardware virtualisation, so you're able to run several VMs via KVM to isolate the services the router is providing. Of course this board doesn't come with the features of a fully-fledged consumer router, such as built-in DSL/DOCSIS modem, DECT, WiFi, etc, so your mileage may vary. It comes with 3 independent Ethernet ports and 3 mPCIe slots though. [1] http://pcengines.ch/apu2.htm http://pcengines.ch/apu2.htm [2] https://openwrt.org/toh/pcengines/apu2 https://openwrt.org/toh/pcengines/apu2
    - __david__ 8y ago
      I second this. I've been running PC engines stuff for a few years and it's great. I currently have an APU and it handles my gigabit fiber no problem. I use a separate off-the-shelf wireless router in bridge mode which let's me upgrade that independent of the PC engines (wireless hardware tech moves faster than router hardware tech). I run openwrt on it and use the "adblock" package which works like pi-hole (minus the nice web stats). Having it be a plain x86 CPU is nice—For example, I compiled Telegraf on my local Linux machine (since openwrt doesn't have a package for it) and was able to just drop it on with minimal problems.
    - Arbalest 8y ago
      Unfortunately it does not come with 3 mPCIe slots, the one furthest to the left is an mSATA port.
  - creeble 8y ago
- windexh8er 8y ago
  I'd argue Pi-hole is quite a bit more than dnsmasq (it's actually a fork of dnsmasq called ftldns) out of the box. It's also very much more approachable by the majority and the web interface gives people immediate feedback and configurability without having to understand configurations for the services directly. https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ftldns-improved-blocking-modes-regex-docker-and-more/ https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ft... https://docs.pi-hole.net/ftldns/ https://docs.pi-hole.net/ftldns/
  - ryandrake 8y ago
    Interesting, didnt realize the “pi-hole” branded package was more than vanilla dnsmasq glued together with shell scripts.
    - Spivak 8y ago
      Go back in the project history and you'll see that it originally was! It's matured a lot since then.
- user812 8y ago
  And Hacker News is essentially just a bit of HTML, CSS and lots of words.
  - _emacsomancer_ 8y ago
    And a bit of Lisp. (I.e. https://en.wikipedia.org/wiki/Arc_(programming_language) https://en.wikipedia.org/wiki/Arc_(programming_language) )
- copperx 8y ago
  Assuming I'm only interested in blocking ads in one computer, is there a software solution for this on Linux or Windows? (I know that Mac has Little Snitch).
  - clear_dg 8y ago
    Why not use a browser extension? uBlock Origin is pretty good from what I hear. I use uMatrix by the same dev, and it serves me well. Both work on major browsers (FF, Chrome, Opera, etc..).
- cptskippy 8y ago
  I was doing this using Tomato and it introduced serious stability issues in the two routers (both Asus) I tried it on. Pi-Hole is a drop in replacement to an existing network setup that doesn't require hacking your router to install a custom firmware. It will also persist router upgrades. My only gripe with Pi-Hole, which isn't their fault really, is that power losses can quickly corrupt the Raspberry Pi's SD Card. I have my network gear on a battery backup but when I was first validating Pi-Hole I had it sitting on my desktop and managed to corrupt the SD card with power drops.
  - jschwartzi 8y ago
    Use a different root filesystem. Ext4 is not robust against power loss, as I've discovered in multiple embedded Linux systems where Ext4 was used. The best filesystems for robustness against power loss seem to be log-structured filesystems like YAFFS2 or QNX's ETFS. The design of the filesystem basically means that a block is never modified on flash, only obsoleted by future writes. The trade-off is that the filesystem has to be reconstructed from the raw blocks at power-on but it's incredibly robust. And the filesystem also has to be garbage-collected before additional writes can be performed. But as long as you run your filesystem below capacity this isn't a big deal.
    - ryandrake 8y ago
      Back in the day (also before ext4) we solved this by mounting the root filesystem read-only. Depending on any other application for the machine, you may not need filesystem writes at all once it is set up. Bonus: it’s even friendlier to the flash.
      - jschwartzi 8y ago
        This is how I've solved the problem in the past. Too bad systemd discourages this. It also doesn't protect the partition where your database and log files are kept.
        freeone3000 8y ago
thatcat 8y ago
I assume DoH is dns over http, what is DoT?
- mjy78 8y ago
  DNS over TLS
- deleted 8y ago
  [deleted]
pbhjpbhj 8y ago
On an RPi I can plug it in to the USB on my router for power and connect with ethernet. Otherwise I have to run a full powered server perpetually to manage DNS for the home network. Made sense to me. I stopped using it as mine was seemingly hacked (100,000 lookups or so in a short time, presumably some sort of page-impression generation?) and I hadn't the time to trace if it was a problem with the project or not.
- lostlogin 8y ago
  And if you’re that way inclined, a POE Pi hat can get another cable removed.
  - voltagex_ 8y ago
    Have they fixed the PoE issues? http://linuxgizmos.com/refund-offered-for-raspberry-pi-poe-hat-due-to-power-issues/ http://linuxgizmos.com/refund-offered-for-raspberry-pi-poe-h...
    - lostlogin 8y ago
      I wasn’t aware of that - thanks. I think I’ll be safe as there will be no peripherals plugged in, but that’s something that needs considering it seems.
      - voltagex_ 8y ago
        I've gone the route of using another box to do PoE -> 5V USB, but unfortunately the TP-Link converter is outputting 4.8V instead of 5V (the Pi3b will technically run on this, but it's not a good idea).
andreasvc 8y ago
The simplest approach is to use a hosts file: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/
- briffle 8y ago
  That doesn't work the same as pihole. PiHole blocks ads on ALL devices on your network. Your computer, your laptop, your phone, your kids kindle, etc. As long as they are on your network, they are protected (and browsing web pages on an older phone, things are much faster)
  - andreasvc 8y ago
    Yup, that's a downside. The advantage is that it's much simpler and will also work when you're not on your home network.
    - FroshKiller 8y ago
      Well, I'm connected to my home network via VPN when I'm not on my home network, so....
    - daxorid 8y ago
      You can also run pi-hole on a tiny VPS and set your DNS statically on all devices.
      - LynxInLA 8y ago
        do you have any links for doing this?
        spurgu 8y ago
        Yeah this is something I've been thinking about lately as well. Pi-Hole seems cool but what about most of the time when I'm somewhere else than my local network?
    - 8y ago
Tomte 8y ago
Of course I have deployed it on a Raspberry. I don't have another always-on computer, and while it's not the only supported target, it is the one most Pi-Hole users have, so I get maximum community support. I'm doubting whether electricity cost might be too high (it's getting mighty warm), but I haven't measured it, yet. So far, I love my Pi-Hole. Absolutely no problems with it.
- TheSmiddy 8y ago
  At 100% power draw the charger I use to power my pi uses 5 watts so you're pretty safe on the power.
- lostlogin 8y ago
  A cron job every hour with a slack notification of temp >60C has put me at ease. It goes over occasionally so I suppose I’ll need a fan at some point.
bogomipz 8y ago
Thanks for the link. I guessing this would handle the use case of being able to acess Pi-Hole while traveling or in a coffee shop correct? This seems to be a limitation of having this on a Pi.
jwilk 8y ago
> DoH or DoT I wasn't familiar with these terms and they are a bit ungooglable. :-/ DoH = DNS-over-HTTPS DoT = DNS-over-TLS
shawn 8y ago
Hello. I have recently been banned and would like to run an experiment. If you read this, please click “vouch”, upvote, and then click “unvouch.” My hypothesis is that very few people read dead comments. How few? Let’s measure it. It costs nothing to participate, and it won’t harm the site since unvouching a comment will cause it to revert to [dead]. If you don’t know how to vouch a comment, click on this comment’s timestamp and click “vouch.” Thank you for helping.
wp381640 8y ago
Troy's skill is taking security and privacy topics and translating them with practical tips to an IT enthusiast audience that is much broader than hn Look at his comments and replies to gauge the audience for his content - deploying more privacy and security tools and knowledge can only be a good thing
mianos 8y ago
The setup script runs perfectly on Ubuntu in an lxd container as well.

ryandrake 8y ago

It’s essentially dnsmasq which can be run directly on your wireless router if you are using custom firmware. No separate hw needed, no need to horse around with dockers or containers or any of that stuff. I’d guess a lot of people are already running dnsmasq for other purposes, so adding the blocklist and periodically updating it should be trivial.

class4behavior 8y ago
Yeah, on openwrt you just install the adblock package https://github.com/openwrt/packages/tree/master/net/adblock/files#prerequisites https://github.com/openwrt/packages/tree/master/net/adblock/...
- rdtsc 8y ago
  That is what I did. I used a TP-Link Archer C7 router and installed adblock and few other useful packages. Works like a charm so far.
- deleted 8y ago
  [deleted]
- beagle3 8y ago
  Do you know if it’s possible to deploy it on a virtual AP? E.g. have “MyNetwork” and “MyNetworkWithAds” - so that it is easier for nontechnical users to switch, and also doesn’t deactivate for everyone when just one user needs to (even if only for 5 mins)?
  - class4behavior 8y ago
    Possible but not that simple actually, as there is little to no documentation or shortcut for such a case available using dnsmasq. Afaik you can only realize this by running multiple instances. The childproof network example is the fitting how-to you can learn from: https://forum.openwrt.org/t/kidsafe-or-guest-wifi-forced-safesearch-and-adblock/6559 https://forum.openwrt.org/t/kidsafe-or-guest-wifi-forced-saf...
mistermann 8y ago
Can anyone recommend a "2018 good choice" for a consumer router that can run custom firmware (including dnsmasq), or a trustworthy recommendation website? Wirecutter for example doesn't note third party firmware: https://thewirecutter.com/reviews/best-wi-fi-router/ https://thewirecutter.com/reviews/best-wi-fi-router/
- aurelian15 8y ago
  Not really an off-the shelf consumer router, but since you want to install custom firmware anyways, you might want to consider the PC-Engines APU2 board [1]. You can either install any "normal" desktop x86_64 Linux distribution or a specialized router OS such as OpenWrt [2]. The AMD APU on the board supports hardware virtualisation, so you're able to run several VMs via KVM to isolate the services the router is providing. Of course this board doesn't come with the features of a fully-fledged consumer router, such as built-in DSL/DOCSIS modem, DECT, WiFi, etc, so your mileage may vary. It comes with 3 independent Ethernet ports and 3 mPCIe slots though. [1] http://pcengines.ch/apu2.htm http://pcengines.ch/apu2.htm [2] https://openwrt.org/toh/pcengines/apu2 https://openwrt.org/toh/pcengines/apu2
  - __david__ 8y ago
    I second this. I've been running PC engines stuff for a few years and it's great. I currently have an APU and it handles my gigabit fiber no problem. I use a separate off-the-shelf wireless router in bridge mode which let's me upgrade that independent of the PC engines (wireless hardware tech moves faster than router hardware tech). I run openwrt on it and use the "adblock" package which works like pi-hole (minus the nice web stats). Having it be a plain x86 CPU is nice—For example, I compiled Telegraf on my local Linux machine (since openwrt doesn't have a package for it) and was able to just drop it on with minimal problems.
  - Arbalest 8y ago
    Unfortunately it does not come with 3 mPCIe slots, the one furthest to the left is an mSATA port.
- creeble 8y ago
windexh8er 8y ago
I'd argue Pi-hole is quite a bit more than dnsmasq (it's actually a fork of dnsmasq called ftldns) out of the box. It's also very much more approachable by the majority and the web interface gives people immediate feedback and configurability without having to understand configurations for the services directly. https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ftldns-improved-blocking-modes-regex-docker-and-more/ https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ft... https://docs.pi-hole.net/ftldns/ https://docs.pi-hole.net/ftldns/
- ryandrake 8y ago
  Interesting, didnt realize the “pi-hole” branded package was more than vanilla dnsmasq glued together with shell scripts.
  - Spivak 8y ago
    Go back in the project history and you'll see that it originally was! It's matured a lot since then.
user812 8y ago
And Hacker News is essentially just a bit of HTML, CSS and lots of words.
- _emacsomancer_ 8y ago
  And a bit of Lisp. (I.e. https://en.wikipedia.org/wiki/Arc_(programming_language) https://en.wikipedia.org/wiki/Arc_(programming_language) )
copperx 8y ago
Assuming I'm only interested in blocking ads in one computer, is there a software solution for this on Linux or Windows? (I know that Mac has Little Snitch).
- clear_dg 8y ago
  Why not use a browser extension? uBlock Origin is pretty good from what I hear. I use uMatrix by the same dev, and it serves me well. Both work on major browsers (FF, Chrome, Opera, etc..).
cptskippy 8y ago
I was doing this using Tomato and it introduced serious stability issues in the two routers (both Asus) I tried it on. Pi-Hole is a drop in replacement to an existing network setup that doesn't require hacking your router to install a custom firmware. It will also persist router upgrades. My only gripe with Pi-Hole, which isn't their fault really, is that power losses can quickly corrupt the Raspberry Pi's SD Card. I have my network gear on a battery backup but when I was first validating Pi-Hole I had it sitting on my desktop and managed to corrupt the SD card with power drops.
- jschwartzi 8y ago
  Use a different root filesystem. Ext4 is not robust against power loss, as I've discovered in multiple embedded Linux systems where Ext4 was used. The best filesystems for robustness against power loss seem to be log-structured filesystems like YAFFS2 or QNX's ETFS. The design of the filesystem basically means that a block is never modified on flash, only obsoleted by future writes. The trade-off is that the filesystem has to be reconstructed from the raw blocks at power-on but it's incredibly robust. And the filesystem also has to be garbage-collected before additional writes can be performed. But as long as you run your filesystem below capacity this isn't a big deal.
  - ryandrake 8y ago
    Back in the day (also before ext4) we solved this by mounting the root filesystem read-only. Depending on any other application for the machine, you may not need filesystem writes at all once it is set up. Bonus: it’s even friendlier to the flash.
    - jschwartzi 8y ago
      This is how I've solved the problem in the past. Too bad systemd discourages this. It also doesn't protect the partition where your database and log files are kept.
      - freeone3000 8y ago

thatcat 8y ago

I assume DoH is dns over http, what is DoT?

mjy78 8y ago
DNS over TLS
deleted 8y ago
[deleted]

pbhjpbhj 8y ago

On an RPi I can plug it in to the USB on my router for power and connect with ethernet. Otherwise I have to run a full powered server perpetually to manage DNS for the home network. Made sense to me. I stopped using it as mine was seemingly hacked (100,000 lookups or so in a short time, presumably some sort of page-impression generation?) and I hadn't the time to trace if it was a problem with the project or not.

lostlogin 8y ago
And if you’re that way inclined, a POE Pi hat can get another cable removed.
- voltagex_ 8y ago
  Have they fixed the PoE issues? http://linuxgizmos.com/refund-offered-for-raspberry-pi-poe-hat-due-to-power-issues/ http://linuxgizmos.com/refund-offered-for-raspberry-pi-poe-h...
  - lostlogin 8y ago
    I wasn’t aware of that - thanks. I think I’ll be safe as there will be no peripherals plugged in, but that’s something that needs considering it seems.
    - voltagex_ 8y ago
      I've gone the route of using another box to do PoE -> 5V USB, but unfortunately the TP-Link converter is outputting 4.8V instead of 5V (the Pi3b will technically run on this, but it's not a good idea).

andreasvc 8y ago

The simplest approach is to use a hosts file: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/

briffle 8y ago
That doesn't work the same as pihole. PiHole blocks ads on ALL devices on your network. Your computer, your laptop, your phone, your kids kindle, etc. As long as they are on your network, they are protected (and browsing web pages on an older phone, things are much faster)
- andreasvc 8y ago
  Yup, that's a downside. The advantage is that it's much simpler and will also work when you're not on your home network.
  - FroshKiller 8y ago
    Well, I'm connected to my home network via VPN when I'm not on my home network, so....
  - daxorid 8y ago
    You can also run pi-hole on a tiny VPS and set your DNS statically on all devices.
    - LynxInLA 8y ago
      do you have any links for doing this?
      - spurgu 8y ago
        Yeah this is something I've been thinking about lately as well. Pi-Hole seems cool but what about most of the time when I'm somewhere else than my local network?
  - 8y ago

Tomte 8y ago

Of course I have deployed it on a Raspberry. I don't have another always-on computer, and while it's not the only supported target, it is the one most Pi-Hole users have, so I get maximum community support. I'm doubting whether electricity cost might be too high (it's getting mighty warm), but I haven't measured it, yet. So far, I love my Pi-Hole. Absolutely no problems with it.

TheSmiddy 8y ago
At 100% power draw the charger I use to power my pi uses 5 watts so you're pretty safe on the power.
lostlogin 8y ago
A cron job every hour with a slack notification of temp >60C has put me at ease. It goes over occasionally so I suppose I’ll need a fan at some point.

bogomipz 8y ago

Thanks for the link. I guessing this would handle the use case of being able to acess Pi-Hole while traveling or in a coffee shop correct? This seems to be a limitation of having this on a Pi.

jwilk 8y ago

> DoH or DoT I wasn't familiar with these terms and they are a bit ungooglable. :-/ DoH = DNS-over-HTTPS DoT = DNS-over-TLS

shawn 8y ago

Hello. I have recently been banned and would like to run an experiment. If you read this, please click “vouch”, upvote, and then click “unvouch.” My hypothesis is that very few people read dead comments. How few? Let’s measure it. It costs nothing to participate, and it won’t harm the site since unvouching a comment will cause it to revert to [dead]. If you don’t know how to vouch a comment, click on this comment’s timestamp and click “vouch.” Thank you for helping.

wp381640 8y ago

Troy's skill is taking security and privacy topics and translating them with practical tips to an IT enthusiast audience that is much broader than hn Look at his comments and replies to gauge the audience for his content - deploying more privacy and security tools and knowledge can only be a good thing

mianos 8y ago

The setup script runs perfectly on Ubuntu in an lxd container as well.