6 ms·

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io https://nextdns.io, does all the same stuff and is the alternative to cloudfla

by iou 6y ago

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io https://nextdns.io, does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

ciarannolan 6y ago
Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole? Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option? [0] https://nextdns.io/privacy https://nextdns.io/privacy
- jzig 6y ago
  max laziness and convenience ;)
  - iou 6y ago
    ^^ this though they do also have some additional security protections for typosquatting, safebrowsing, homoglyphs, threat-intelligence which is also nice. All of which could be done on a pihole though not out of the box when I last used it ~2 years ago.
- dastx 6y ago
  Also, unless you go through the trouble of setting up unbound, your requests would need to go to an upstream server anyway, so might as well send them to one with the best privacy policy.
- dogma1138 6y ago
  No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi-hole in the cloud yourself unless. Pricing wise it’s over 2 years worth of service for the price of an original Pi, a good SD card and a case. The only circumstances where Pi Hole is unquestionably superior is if you are on a network that redirects all DNS requests there are still some ISPs that do that however if you are on such network you probably want to either get off it ASAP or use a VPN.
  - ciarannolan 6y ago
    Interesting, thanks! I've been thinking about running a Pi-hole at home and redirecting all my phone traffic through it via WireGuard.
    - GekkePrutser 6y ago
      I do exactly that, though I run my VPN in the cloud (a scaleway instance which is only 3 euro per month). Using algo for the vpn: https://github.com/trailofbits/algo https://github.com/trailofbits/algo . I can highly recommend it! Though I had some issues with play store updates being blocked but that's resolved now. Unfortunately google play services are essentially one big spyware collection so it makes sense for it to block them. I also had to manually provision my Android phone on IKEv2 (ipsec), Algo used to provide a strongswan config but unfortunately they dropped this in favour of wireguard. But you can still set it up manually (and on Samsung devices you don't even need strongswan). Wireguard is faster, yes, but my work blocks pretty much every port they don't know, except IKEv2/ipsec because many contractors use it to connect to their work :)
  - thecureforzits 6y ago
    FWIW, pihole is not tied to any particular hardware. For example: https://github.com/pi-hole/docker-pi-hole https://github.com/pi-hole/docker-pi-hole
    - lostlogin 6y ago
      And in addition you can do other stuff on the pi/device. One should always have a spare Pi around.
    - dogma1138 6y ago
      I know I mentioned you can run it in the cloud/hosted, however for most home installations unless you have a dedicated VM server that is always on it does requires additional hardware. I run pi-hole on my qnap nas at home since it’s always on anyhow.
    - zymhan 6y ago
- FraKtus 6y ago
  I use a smart DNS to unblock streaming web sites that are geo-locked.
neurostimulant 6y ago
Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in the national domain blocklist database. DNS on port other than 53 is still working though, so I have set up my pihole to use an upstream dns server that accept connection on a higher port and a cloudflare DoH server as a fallback (not sure why but DoH is really slow here).
- sneak 6y ago
  Out of curiosity, which country is that (if you're comfortable sharing)? That's a surprising policy I'd not heard of before.
  - neurostimulant 6y ago
    Indonesia. The blocklist mostly contains porn sites, but the government often use it to force foreign companies to comply with their requests (e.g. putting whatsapp on the block list until they comply with the new censorship rule, etc), and also used to censor any websites that offend the government (mostly communist and anti-islamist sites). Even websites that remotely contains nsfw contents end up getting blocked. Reddit and Vimeo is still blocked, tumblr was blocked (until they banned nsfw content recently), and most surprisingly, readthedocs.org was blocked for quite a while before (I'm not even sure why it was blocked in the first place). The block list database can be accessed here, you can query a domain to see if they're blocked in Indonesia: https://trustpositif.kominfo.go.id/ https://trustpositif.kominfo.go.id/
- Nextgrid 6y ago
  They could've at least intercepted the requests and applied their blacklist while leaving unblacklisted requests pass through as-is (so you can still use a custom server for the non-banned domains). Not saying I'm in favour of these shenanigans at all but at least if you are forced to do it then better do it with the minimum level of interference possible.
  - Kliment 6y ago
ekovarski 6y ago
It’s a great service but only the first 300k queries are free, then you are no longer offered any of the benefits unless you pay $1.99 per month
- toomuchtodo 6y ago
  Is that not a trivial amount for hands off DNS recursion services? Consider the cost to purchase a Raspberry Pi, set it up, electricity, wear and tear on flash storage, etc If you point me at a checkout page for $2/month to not even have to think about plugging a Pi in, I’m going to pull my credit card out in a heartbeat. A single coffee costs me more. Think about your time!
  - GekkePrutser 6y ago
    Price-wise it'll probably be a no-brainer. Even though a pi can come as cheap as 2 or 3 coffees. A zero is sufficient for pi-hole. But it's about taking control too. Personally I wouldn't like taking a service even if it were free, over hosting something myself, especially when it's made as easy as Pi-hole does.
  - Tepix 6y ago
    > Think about your time! Pi-hole is a tool to improve your privacy. Handing all your DNS requests to a 3rd party is the exact opposite. Now you have to deal with their privacy policy, track whether that company got hacked or bought etc. Installing and maintaining pi-hole takes very little time.
    - poitrus 6y ago
      Where do you think pi-hole sends your DNS queries?
blntechie 6y ago
Nextdns pings are bad for me in south India. Like 8x slower than Cloudflare and 10x slower than Google. So sticking with PiHole at home setup for now and Windscribe VPN outside home.

by iou 6y ago

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io https://nextdns.io, does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

ciarannolan 6y ago

Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole? Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option? [0] https://nextdns.io/privacy https://nextdns.io/privacy

jzig 6y ago
max laziness and convenience ;)
- iou 6y ago
  ^^ this though they do also have some additional security protections for typosquatting, safebrowsing, homoglyphs, threat-intelligence which is also nice. All of which could be done on a pihole though not out of the box when I last used it ~2 years ago.
dastx 6y ago
Also, unless you go through the trouble of setting up unbound, your requests would need to go to an upstream server anyway, so might as well send them to one with the best privacy policy.
dogma1138 6y ago
No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi-hole in the cloud yourself unless. Pricing wise it’s over 2 years worth of service for the price of an original Pi, a good SD card and a case. The only circumstances where Pi Hole is unquestionably superior is if you are on a network that redirects all DNS requests there are still some ISPs that do that however if you are on such network you probably want to either get off it ASAP or use a VPN.
- ciarannolan 6y ago
  Interesting, thanks! I've been thinking about running a Pi-hole at home and redirecting all my phone traffic through it via WireGuard.
  - GekkePrutser 6y ago
    I do exactly that, though I run my VPN in the cloud (a scaleway instance which is only 3 euro per month). Using algo for the vpn: https://github.com/trailofbits/algo https://github.com/trailofbits/algo . I can highly recommend it! Though I had some issues with play store updates being blocked but that's resolved now. Unfortunately google play services are essentially one big spyware collection so it makes sense for it to block them. I also had to manually provision my Android phone on IKEv2 (ipsec), Algo used to provide a strongswan config but unfortunately they dropped this in favour of wireguard. But you can still set it up manually (and on Samsung devices you don't even need strongswan). Wireguard is faster, yes, but my work blocks pretty much every port they don't know, except IKEv2/ipsec because many contractors use it to connect to their work :)
- thecureforzits 6y ago
  FWIW, pihole is not tied to any particular hardware. For example: https://github.com/pi-hole/docker-pi-hole https://github.com/pi-hole/docker-pi-hole
  - lostlogin 6y ago
    And in addition you can do other stuff on the pi/device. One should always have a spare Pi around.
  - dogma1138 6y ago
    I know I mentioned you can run it in the cloud/hosted, however for most home installations unless you have a dedicated VM server that is always on it does requires additional hardware. I run pi-hole on my qnap nas at home since it’s always on anyhow.
  - zymhan 6y ago
FraKtus 6y ago
I use a smart DNS to unblock streaming web sites that are geo-locked.

neurostimulant 6y ago

Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in the national domain blocklist database. DNS on port other than 53 is still working though, so I have set up my pihole to use an upstream dns server that accept connection on a higher port and a cloudflare DoH server as a fallback (not sure why but DoH is really slow here).

sneak 6y ago
Out of curiosity, which country is that (if you're comfortable sharing)? That's a surprising policy I'd not heard of before.
- neurostimulant 6y ago
  Indonesia. The blocklist mostly contains porn sites, but the government often use it to force foreign companies to comply with their requests (e.g. putting whatsapp on the block list until they comply with the new censorship rule, etc), and also used to censor any websites that offend the government (mostly communist and anti-islamist sites). Even websites that remotely contains nsfw contents end up getting blocked. Reddit and Vimeo is still blocked, tumblr was blocked (until they banned nsfw content recently), and most surprisingly, readthedocs.org was blocked for quite a while before (I'm not even sure why it was blocked in the first place). The block list database can be accessed here, you can query a domain to see if they're blocked in Indonesia: https://trustpositif.kominfo.go.id/ https://trustpositif.kominfo.go.id/
Nextgrid 6y ago
They could've at least intercepted the requests and applied their blacklist while leaving unblacklisted requests pass through as-is (so you can still use a custom server for the non-banned domains). Not saying I'm in favour of these shenanigans at all but at least if you are forced to do it then better do it with the minimum level of interference possible.
- Kliment 6y ago

ekovarski 6y ago

It’s a great service but only the first 300k queries are free, then you are no longer offered any of the benefits unless you pay $1.99 per month

toomuchtodo 6y ago
Is that not a trivial amount for hands off DNS recursion services? Consider the cost to purchase a Raspberry Pi, set it up, electricity, wear and tear on flash storage, etc If you point me at a checkout page for $2/month to not even have to think about plugging a Pi in, I’m going to pull my credit card out in a heartbeat. A single coffee costs me more. Think about your time!
- GekkePrutser 6y ago
  Price-wise it'll probably be a no-brainer. Even though a pi can come as cheap as 2 or 3 coffees. A zero is sufficient for pi-hole. But it's about taking control too. Personally I wouldn't like taking a service even if it were free, over hosting something myself, especially when it's made as easy as Pi-hole does.
- Tepix 6y ago
  > Think about your time! Pi-hole is a tool to improve your privacy. Handing all your DNS requests to a 3rd party is the exact opposite. Now you have to deal with their privacy policy, track whether that company got hacked or bought etc. Installing and maintaining pi-hole takes very little time.
  - poitrus 6y ago
    Where do you think pi-hole sends your DNS queries?

blntechie 6y ago

Nextdns pings are bad for me in south India. Like 8x slower than Cloudflare and 10x slower than Google. So sticking with PiHole at home setup for now and Windscribe VPN outside home.