22 ms·

Pi-hole is very easy to set up, and it works so well you can basically forget about it from that point on. Blocking ads is nice, but it’s also a huge boon for p

Pi-hole is very easy to set up, and it works so well you can basically forget about it from that point on. Blocking ads is nice, but it’s also a huge boon for privacy. I run uBlock origin on all my browsers, but Pi-hole still blocks 30-50% of requests on my network. It’s also really nice to be able to glance at the logs and get an idea of what’s going on on your network, or if there’s any unusual activity. I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing.

ciarannolan 6y ago
>I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing. Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.
- deleted 6y ago
  [deleted]
- dastx 6y ago
  Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`. When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more. What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. This CNAME method is also a huge security issue, but I'm not gonna go into that.
  - pottertheotter 6y ago
    > This CNAME method is also a huge security issue, but I'm not gonna go into that. A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?
    - yjftsjthsd-h 6y ago
      For the website - https://news.ycombinator.com/item?id=23137309 https://news.ycombinator.com/item?id=23137309
  - xwdv 6y ago
    > This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.
    - sciurus 6y ago
      This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.
    - totetsu 6y ago
      How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)
      - edoceo 6y ago
        Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)
    - lonelappde 6y ago
      That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?
- pottertheotter 6y ago
  Here's an example from the feature request: Here is an example (the domains are fake, it’s for demonstration purpose only): The domain adcompany.com 5 is in my blacklist, so it returns the IP of my Pi-Hole if I do a DNS query: $ host adcompany.com adcompany.com has address 192.168.1.10 But if I do a DNS query of ad.newspaper.com it doesn’t get blocked by Pi-Hole even though it’s simply an alias (CNAME) for adcompany.com: $ host ad.newspaper.com ad.newspaper.com is an alias for adcompany.com. adcompany.com has address 6.6.6.6 What I would like that Pi-hole do is to check if the domain is a CNAME (in the example ad.newspaper.com) then comparing the domain that is aliased to (in the example adcompany.com) with my blacklist. If it is in my blacklist block the domain (by returning the IP of my Pi-hole). Source: https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cnames/25445/7 https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cn...
- neurostimulant 6y ago
  One of a trick a website operator can use to evade hostname-based adblockers is by putting the ad-serving domain as a cname entry in one of their subdomain. Since the ad now served from a subdomain of their website, it won't get blocked unless the dns adblocker did deep inspection on nested cname entries.
Moru 6y ago
If you run Windows, it blocks a lot of stuff that isn't browser related. That's why ublock does not get it down to 0 percent.
- surround 6y ago
  Right, I didn’t mean to make it sound like uBO was letting stuff through the cracks (it’s actually far more thorough than dns filtering). But the amount of tracking requests that come from outside of the browser and from other devices is no joke.
Waterluvian 6y ago
I set up a pihole and literally forgot about it. Like I was cleaning out a closet on moving day and found it plugged in. Took a moment to even realise what it was doing there.
- city41 6y ago
  I’m reminded almost every day that I have a pi-hole since it is not my dns provider when on my company’s vpn. It’s absolutely night and day on so much of the web. Some sites have so many ads now it’s just shocking to be frank.
  - pfundstein 6y ago
    Why not use a client based content filter such as uBlock Origin?
    - rovr138 6y ago
      Not them, but you can’t do that at every company.
    - Waterluvian 6y ago
      Also maybe they use their phone and many combinations of PhoneType + BrowserType don't support the same quality of adblocking as PiHole.
      - 411111111111111 6y ago
        Mobile Firefox Supports ublock Origin nowadays. I'd encourage anyone to try that out
        meitham 6y ago
        On iOS too?
        6y ago
croon 6y ago
It was really easy to set-up, but on first day it actually broke an Android TV-app on default settings (meaning it blocked some call that stopped the app from loading through). Ironically, after disabling it for a minute and then loading through the app, it didn't block the video ads (not rendered into the video). YMMV of course, but it wasn't usable for me since everyone in the household needs to understand/solve any issues.
- isatty 6y ago
  Which to me is a good thing - smart TV's are garbage. Dumb TV + AppleTV will do just fine.
  - croon 6y ago
    My TV is not on the internet. I have an Nvidia Shield, Android TV is the name of the OS.
  - jgalt212 6y ago
    I guess, but Dumb TV + Roku can be quite terrible from a privacy perspective.
    - CWuestefeld 6y ago
      Logging messages sent by Roku comprise the 2nd largest blocked domain on my pihole. But - they are blocked. In any case, I don't see that a smart TV is going to be any better in this respect.

ciarannolan 6y ago

>I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing. Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.

deleted 6y ago
[deleted]
dastx 6y ago
Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`. When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more. What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. This CNAME method is also a huge security issue, but I'm not gonna go into that.
- pottertheotter 6y ago
  > This CNAME method is also a huge security issue, but I'm not gonna go into that. A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?
  - yjftsjthsd-h 6y ago
    For the website - https://news.ycombinator.com/item?id=23137309 https://news.ycombinator.com/item?id=23137309
- xwdv 6y ago
  > This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.
  - sciurus 6y ago
    This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.
  - totetsu 6y ago
    How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)
    - edoceo 6y ago
      Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)
  - lonelappde 6y ago
    That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?
pottertheotter 6y ago
Here's an example from the feature request: Here is an example (the domains are fake, it’s for demonstration purpose only): The domain adcompany.com 5 is in my blacklist, so it returns the IP of my Pi-Hole if I do a DNS query: $ host adcompany.com adcompany.com has address 192.168.1.10 But if I do a DNS query of ad.newspaper.com it doesn’t get blocked by Pi-Hole even though it’s simply an alias (CNAME) for adcompany.com: $ host ad.newspaper.com ad.newspaper.com is an alias for adcompany.com. adcompany.com has address 6.6.6.6 What I would like that Pi-hole do is to check if the domain is a CNAME (in the example ad.newspaper.com) then comparing the domain that is aliased to (in the example adcompany.com) with my blacklist. If it is in my blacklist block the domain (by returning the IP of my Pi-hole). Source: https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cnames/25445/7 https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cn...
neurostimulant 6y ago
One of a trick a website operator can use to evade hostname-based adblockers is by putting the ad-serving domain as a cname entry in one of their subdomain. Since the ad now served from a subdomain of their website, it won't get blocked unless the dns adblocker did deep inspection on nested cname entries.

Moru 6y ago

If you run Windows, it blocks a lot of stuff that isn't browser related. That's why ublock does not get it down to 0 percent.

surround 6y ago
Right, I didn’t mean to make it sound like uBO was letting stuff through the cracks (it’s actually far more thorough than dns filtering). But the amount of tracking requests that come from outside of the browser and from other devices is no joke.

Waterluvian 6y ago

I set up a pihole and literally forgot about it. Like I was cleaning out a closet on moving day and found it plugged in. Took a moment to even realise what it was doing there.

city41 6y ago
I’m reminded almost every day that I have a pi-hole since it is not my dns provider when on my company’s vpn. It’s absolutely night and day on so much of the web. Some sites have so many ads now it’s just shocking to be frank.
- pfundstein 6y ago
  Why not use a client based content filter such as uBlock Origin?
  - rovr138 6y ago
    Not them, but you can’t do that at every company.
  - Waterluvian 6y ago
    Also maybe they use their phone and many combinations of PhoneType + BrowserType don't support the same quality of adblocking as PiHole.
    - 411111111111111 6y ago
      Mobile Firefox Supports ublock Origin nowadays. I'd encourage anyone to try that out
      - meitham 6y ago
        On iOS too?
        6y ago

croon 6y ago

It was really easy to set-up, but on first day it actually broke an Android TV-app on default settings (meaning it blocked some call that stopped the app from loading through). Ironically, after disabling it for a minute and then loading through the app, it didn't block the video ads (not rendered into the video). YMMV of course, but it wasn't usable for me since everyone in the household needs to understand/solve any issues.

isatty 6y ago
Which to me is a good thing - smart TV's are garbage. Dumb TV + AppleTV will do just fine.
- croon 6y ago
  My TV is not on the internet. I have an Nvidia Shield, Android TV is the name of the OS.
- jgalt212 6y ago
  I guess, but Dumb TV + Roku can be quite terrible from a privacy perspective.
  - CWuestefeld 6y ago
    Logging messages sent by Roku comprise the 2nd largest blocked domain on my pihole. But - they are blocked. In any case, I don't see that a smart TV is going to be any better in this respect.