6 ms·

This is a great solution to a problem that seems to becoming more prevalent. Reminder to devs that bolted on third party scripts should not be in the critical p

This is a great solution to a problem that seems to becoming more prevalent. Reminder to devs that bolted on third party scripts should not be in the critical path. Meaning, if you are doing something like capturing a click event in a Google analytics handler and blocking the redirect until you’ve tracked the click - you’re going to have a bad time. Many tracking scripts are designed for this and will gracefully/silently fail via something like an array push mechanism but I’ve encountered the opposite as well. Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects - but it’s also helped me build more resilient applications that work just as well for people who don’t have trackers enabled.

ethagnawl 6y ago
> Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects I have a family member who works in marketing and am regularly asked to either turn off the pihole or add a new URL to the ignored list for exactly this reason.
- McDyver 6y ago
  You can create groups in pihole and select which devices can bypass it. I'm not sure if you can assign specific lists per group, though
  - llarsson 6y ago
    I believe you can! https://docs.pi-hole.net/database/gravity/groups/ https://docs.pi-hole.net/database/gravity/groups/
- mosselman 6y ago
  The easiest way around this is to install a secondary browser (or use a profile in firefox, but that is cumbersome) for work. They could use a different DNS provider in that browser. I use Brave for this and Firefox for my private stuff. Or they could ask their employer to pay for a VPN services that comes with DNS. Your family member will then have an easy to understand and easy to spot (VPN is ON) way to 'go into work mode' and out of it for private.
  - irae 6y ago
    Or you could have a nice router, like Ubiquiti EdgeRouterX, that is cheap and can create multiple networks. You pin the "marketing enabled" device to a different network without pihole as DNS for their device.
    - reaperducer 6y ago
      More wires. More gear. More complexity. More points of failure. Ugh.
  - paride5745 6y ago
    This is exactly what I do. Brave for work, Firefox for private.
    - reaperducer 6y ago
      It would be interesting if Firefox could release two nearly identical browsers: Firefox Home, and Firefox Work. The only difference between the two is the name and the color of the icon. With both programs in their computers, or both apps on their phones, people could more easily isolate the two phases of life, without going through all the rigamarole of profiles.
      - ethagnawl 6y ago
        I haven't gotten into the habit of using them, but I believe this is how the Multi-Account Containers add-on works.
        mosselman 6y ago
        You can use containers, but those only apply to cookies, etc, everything else, settings, add-ons, etc, will be the same. Different profiles allow for different sets of add-ons, bookmarks, settings, etc.
      - petronio 6y ago
Kimitri 6y ago
Blocking events until they are handled by the tracker's event queue is quite a common problem when using PiHole. It would be nice if those event handlers were registered using Google Tag Manager as it would mean that those event handers would never be registered if trackers are blocked. By the way, I use VPN to bypass PiHole when I encounter these problems. It's a lot less hassle than switching the sinkhole off/on.
- goalieca 6y ago
  I’m unable to use my banks app because the tracker being blocked causes an error that fails very loudly and blocks login. I refuse to whitelist it in pihole.
duxup 6y ago
>I’ve gotta turn it off a lot for various client projects As a web dev I'm running into a lot of security products dorking up web projects and processes these days. It seems to be increasing. I've got customers with security software or other privacy related tools that are constantly 'trying' to do the right thing ... but just become support ticket overhead for me. It's ULTRA frustrating at this point. I've run into several customers now whose email scanners not just block emails arbitrary, but also follow links (fine by me) ... and even SUBMIT A FORM (NOT ok). Presumably to avoid some malware delivery, but now they've submitted something to us on a one time use form... So just sending them an email means their software submits accept or decline options on a form (with our without the email reaching them) and we get a ton of "but I didn't get the email and I didn't decline anything". Meanwhile the end customer is too technically behind the ball to entirely understand what is going on, and some ultra aggressive IT admin just keeps doing it. If you have a lot of customers it just seems to never end. I kinda want to abandon email because of it but there's not a lot of good options. Other issues include some unknown software installed by someone's kid (their IT guy) that blocks rando boring API calls ... the list never seems to end. I support these privacy / security initiatives 100%, we don't do any insidious tracking or anything like that, but it is starting to hit entirely innocuous stuff.
- stinos 6y ago
  Read this and replace "web" with "desktop" and large parts are still spot on, wrt virus scanners and the likes. We work on a product of which the installation is a bit complicated because it needs to install a bunch of other things. 95% of the time that fails the reason is some overly active security tool which messes up (the other 5% mainly machines which haven't been updated for years) To the point that we've started wondering if we wouldn't just start requiring dedicated machines or at least without any of that software, or even just ship PCs with the application pre-installed as it would likely turn out cheaper. Unfortunately that is not really an option as a web dev, so that situation is even worse..
  - codebolt 6y ago
    I develop desktop apps that are run exclusively virtualized, and don't really have to deal with either set of problems. From a developer perspective I'd say it's a pretty sweet spot, as you get the best of both worlds to some extent.
reaperducer 6y ago
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects When you get enough established paying clients, consider firewalling work gear from home gear. My client work computers are not my personal computers. My client computers have their own router that is separate from my personal router. At one time I had my personal internet on cable, and my clients on DSL, but unfortunately that's not possible where I am now. I get a lot of peace of mind from knowing the two are isolated from one another. The only thing they share is a desk. But when work time is done, client laptops go into the closet. Helps with the work-home balance, which is harder working from home.
- algesten 6y ago
  If you got good enough router/access points, you could create separate VLANs for client vs private. Thinking about it, I might just do that when I get back home :)
- xoa 6y ago
  Any particular reason you don't just use VLANs? It sounds like you're describing a textbook case for them. Nearly any routing software should have a firewall too and the whole point is handling layer 3. Even for purely your own stuff segmenting off various devices into their own subnets can still be handy. If you want you even with a single WAN connection you could do something like get a cheap $5/mo VPS|droplet|etc, run wireguard on it, then route all traffic from a given VLAN through it. That'd give you similar WAN isolation.
  - reaperducer 6y ago
    Any particular reason you don't just use VLANs? Because the router I own is better than the router I don't own. Further, everything you describe is a bunch of complexity I don't need in my life. My time is too valuable to spend fiddling with configurations every time some piece of kit does a software update. The way I do it, I plug a wireless router into one ISP, and a different wireless router into another ISP, and I'm done with it. Simple and clean. I'd rather spend my time with my family than "handling layer 3."
godshatter 6y ago
As a person who has been using NoScript or the equivalent for years now, I appreciate this. It also helps out your clients. Instead of a blank page or a broken one, I would now presumably see a functioning page. While they may not get any ad revenue through me, I can't buy their product if they don't let me on the site. Or review it, or tell people about it, etc. There would be a chance now that I would come away from their website with a positive impression instead of hitting the back button and trying the next search result or just writing them off completely. If you care about privacy at all, the web is a very broken place.

ethagnawl 6y ago

> Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects I have a family member who works in marketing and am regularly asked to either turn off the pihole or add a new URL to the ignored list for exactly this reason.

McDyver 6y ago
You can create groups in pihole and select which devices can bypass it. I'm not sure if you can assign specific lists per group, though
- llarsson 6y ago
  I believe you can! https://docs.pi-hole.net/database/gravity/groups/ https://docs.pi-hole.net/database/gravity/groups/
mosselman 6y ago
The easiest way around this is to install a secondary browser (or use a profile in firefox, but that is cumbersome) for work. They could use a different DNS provider in that browser. I use Brave for this and Firefox for my private stuff. Or they could ask their employer to pay for a VPN services that comes with DNS. Your family member will then have an easy to understand and easy to spot (VPN is ON) way to 'go into work mode' and out of it for private.
- irae 6y ago
  Or you could have a nice router, like Ubiquiti EdgeRouterX, that is cheap and can create multiple networks. You pin the "marketing enabled" device to a different network without pihole as DNS for their device.
  - reaperducer 6y ago
    More wires. More gear. More complexity. More points of failure. Ugh.
- paride5745 6y ago
  This is exactly what I do. Brave for work, Firefox for private.
  - reaperducer 6y ago
    It would be interesting if Firefox could release two nearly identical browsers: Firefox Home, and Firefox Work. The only difference between the two is the name and the color of the icon. With both programs in their computers, or both apps on their phones, people could more easily isolate the two phases of life, without going through all the rigamarole of profiles.
    - ethagnawl 6y ago
      I haven't gotten into the habit of using them, but I believe this is how the Multi-Account Containers add-on works.
      - mosselman 6y ago
        You can use containers, but those only apply to cookies, etc, everything else, settings, add-ons, etc, will be the same. Different profiles allow for different sets of add-ons, bookmarks, settings, etc.
    - petronio 6y ago

Kimitri 6y ago

Blocking events until they are handled by the tracker's event queue is quite a common problem when using PiHole. It would be nice if those event handlers were registered using Google Tag Manager as it would mean that those event handers would never be registered if trackers are blocked. By the way, I use VPN to bypass PiHole when I encounter these problems. It's a lot less hassle than switching the sinkhole off/on.

goalieca 6y ago
I’m unable to use my banks app because the tracker being blocked causes an error that fails very loudly and blocks login. I refuse to whitelist it in pihole.

duxup 6y ago

>I’ve gotta turn it off a lot for various client projects As a web dev I'm running into a lot of security products dorking up web projects and processes these days. It seems to be increasing. I've got customers with security software or other privacy related tools that are constantly 'trying' to do the right thing ... but just become support ticket overhead for me. It's ULTRA frustrating at this point. I've run into several customers now whose email scanners not just block emails arbitrary, but also follow links (fine by me) ... and even SUBMIT A FORM (NOT ok). Presumably to avoid some malware delivery, but now they've submitted something to us on a one time use form... So just sending them an email means their software submits accept or decline options on a form (with our without the email reaching them) and we get a ton of "but I didn't get the email and I didn't decline anything". Meanwhile the end customer is too technically behind the ball to entirely understand what is going on, and some ultra aggressive IT admin just keeps doing it. If you have a lot of customers it just seems to never end. I kinda want to abandon email because of it but there's not a lot of good options. Other issues include some unknown software installed by someone's kid (their IT guy) that blocks rando boring API calls ... the list never seems to end. I support these privacy / security initiatives 100%, we don't do any insidious tracking or anything like that, but it is starting to hit entirely innocuous stuff.

stinos 6y ago
Read this and replace "web" with "desktop" and large parts are still spot on, wrt virus scanners and the likes. We work on a product of which the installation is a bit complicated because it needs to install a bunch of other things. 95% of the time that fails the reason is some overly active security tool which messes up (the other 5% mainly machines which haven't been updated for years) To the point that we've started wondering if we wouldn't just start requiring dedicated machines or at least without any of that software, or even just ship PCs with the application pre-installed as it would likely turn out cheaper. Unfortunately that is not really an option as a web dev, so that situation is even worse..
- codebolt 6y ago
  I develop desktop apps that are run exclusively virtualized, and don't really have to deal with either set of problems. From a developer perspective I'd say it's a pretty sweet spot, as you get the best of both worlds to some extent.

reaperducer 6y ago

Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects When you get enough established paying clients, consider firewalling work gear from home gear. My client work computers are not my personal computers. My client computers have their own router that is separate from my personal router. At one time I had my personal internet on cable, and my clients on DSL, but unfortunately that's not possible where I am now. I get a lot of peace of mind from knowing the two are isolated from one another. The only thing they share is a desk. But when work time is done, client laptops go into the closet. Helps with the work-home balance, which is harder working from home.

algesten 6y ago
If you got good enough router/access points, you could create separate VLANs for client vs private. Thinking about it, I might just do that when I get back home :)
xoa 6y ago
Any particular reason you don't just use VLANs? It sounds like you're describing a textbook case for them. Nearly any routing software should have a firewall too and the whole point is handling layer 3. Even for purely your own stuff segmenting off various devices into their own subnets can still be handy. If you want you even with a single WAN connection you could do something like get a cheap $5/mo VPS|droplet|etc, run wireguard on it, then route all traffic from a given VLAN through it. That'd give you similar WAN isolation.
- reaperducer 6y ago
  Any particular reason you don't just use VLANs? Because the router I own is better than the router I don't own. Further, everything you describe is a bunch of complexity I don't need in my life. My time is too valuable to spend fiddling with configurations every time some piece of kit does a software update. The way I do it, I plug a wireless router into one ISP, and a different wireless router into another ISP, and I'm done with it. Simple and clean. I'd rather spend my time with my family than "handling layer 3."

godshatter 6y ago

As a person who has been using NoScript or the equivalent for years now, I appreciate this. It also helps out your clients. Instead of a blank page or a broken one, I would now presumably see a functioning page. While they may not get any ad revenue through me, I can't buy their product if they don't let me on the site. Or review it, or tell people about it, etc. There would be a chance now that I would come away from their website with a positive impression instead of hitting the back button and trying the next search result or just writing them off completely. If you care about privacy at all, the web is a very broken place.