3 ms·

Pi-hole is still very much niche, and outside of that and enterprise network admins, the majority of users are stuck using the trash resolver of their operating

Pi-hole is still very much niche, and outside of that and enterprise network admins, the majority of users are stuck using the trash resolver of their operating system directed to the trash DNS servers of their ISP. If DNS level blocking ever becomes popular enough, malware authors will change their systems to not use the system's DNS, or to use hard coded DNS over TLS/HTTP servers that they know will serve them the data they want. Preventing proprietary applications from doing malicious things is a constant cat and mouse game. Pi-hole works well for now, I would argue, because it's not popular enough to put a big enough dent in the success rate of malware.

TrueDuality 6y ago
pi-hole is the most recognized name on here, but I think you're wrong about DNS level blocking. There are lot of home routers that have started integrating that feature natively. A few examples that I know off hand: - Motorola MH7022 - Eero - Disney Circle Basically any of them that say "content filtering" in their product sheet are using DNS level filtering. > ...the trash resolver of their operating system... I'm very curious why you think the well tested, vetted, and constantly updated resolvers built into OS's are "trash". Is it just because most don't have support for DoH or DoT?
- admax88q 6y ago
  Most of the OS level resolvers just forward to the resolver provided via DHCP. Which is fine for enterprise, but for home users means using the ISPs resolver, which can track users and has a history of injecting ads on failed resolutions. Not to mention the user interface for configuring them has never evolved beyond /etc/hosts and the total disaster that is /etc/resolv.conf (on modern linux distros). The fact that I have to run a separate device such as pi-hole to intercept DNS rather than just point my OS resolver to a blacklist indicates how OS level resolvers have not kept up with the use cases people are asking of them. And of course, no support for DoH or DoT or even DNSSEC.
zamadatix 6y ago
DNS level blocking is extraordinarily common in enterprise settings though so the cat and mouse game for malware trying to avoid it is decades in the making at this point, pi-hole is just a recent common name in the prosumer space.

TrueDuality 6y ago

pi-hole is the most recognized name on here, but I think you're wrong about DNS level blocking. There are lot of home routers that have started integrating that feature natively. A few examples that I know off hand: - Motorola MH7022 - Eero - Disney Circle Basically any of them that say "content filtering" in their product sheet are using DNS level filtering. > ...the trash resolver of their operating system... I'm very curious why you think the well tested, vetted, and constantly updated resolvers built into OS's are "trash". Is it just because most don't have support for DoH or DoT?

admax88q 6y ago
Most of the OS level resolvers just forward to the resolver provided via DHCP. Which is fine for enterprise, but for home users means using the ISPs resolver, which can track users and has a history of injecting ads on failed resolutions. Not to mention the user interface for configuring them has never evolved beyond /etc/hosts and the total disaster that is /etc/resolv.conf (on modern linux distros). The fact that I have to run a separate device such as pi-hole to intercept DNS rather than just point my OS resolver to a blacklist indicates how OS level resolvers have not kept up with the use cases people are asking of them. And of course, no support for DoH or DoT or even DNSSEC.

zamadatix 6y ago

DNS level blocking is extraordinarily common in enterprise settings though so the cat and mouse game for malware trying to avoid it is decades in the making at this point, pi-hole is just a recent common name in the prosumer space.