3 ms·

So I guess someone will have to come up with a turn-key pihole-alike?

mh- 5y ago
Not even close to a replacement for the type of active, context-aware evaluation uBlock can do. Additionally, if a solution like Pi-hole was ever sufficiently mainstream, more sites would start serving their ads from the same hostname as the page. It's not difficult to do with the CDN providers most media sites already use.
deleted 5y ago
[deleted]
cheschire 5y ago
Doesn’t https and subsequently DNS over HTTPS effectively negate pi-hole? Honest inexperienced question.
- sofixa 5y ago
  HTTPS no, because you're still making regular old DNS queries for every domain, but DNS over HTTPS or stuff like Chromecasts using hardcoded DNS servers do effectively negate Pi-Hole.
- EvanAnderson 5y ago
  Yes. Next you'll have to MiTM the DNS over HTTPS. Next in the arms race comes certificate-pinning. Controlling your name resolution will probably remain possible on Linux, but I expect most other platforms will make it exceedingly difficult for "normal" users. Embedded devices are already "game over". You don't own them (even if you paid for them). Controlling name resolution on your own network (and MiTM'ing HTTPS) makes you the same as a hostile nation-state actor. We can't have that.
  - kelnos 5y ago
    > Embedded devices are already "game over". You don't own them (even if you paid for them). Ugh, seriously. I have a Chromecast, and couldn't figure out why it wouldn't play things on my local network (via DNS names set up in my router's resolver). Turns out Google hard-codes their own DNS servers and doesn't allow you to change them. The fix was to give the Chromecast a reserved IP address, and then set up some iptables rules on the router to redirect requests from it to 8.8.8.8 and 8.8.4.4 on port 53 to my router. I'm surprised that Chromecast is using old-school port-53 DNS and not DoH.
    - throwawaycuriou 5y ago
      is there any alternative software yet that can reproduce the Chromecast, including masquerading as one to my phone?
- pkulak 5y ago
  HTTPS doesn't, though DNS over HTTPS does. No one really uses DNS over HTTPS right now though.

mh- 5y ago

Not even close to a replacement for the type of active, context-aware evaluation uBlock can do. Additionally, if a solution like Pi-hole was ever sufficiently mainstream, more sites would start serving their ads from the same hostname as the page. It's not difficult to do with the CDN providers most media sites already use.

deleted 5y ago

[deleted]

cheschire 5y ago

Doesn’t https and subsequently DNS over HTTPS effectively negate pi-hole? Honest inexperienced question.

sofixa 5y ago
HTTPS no, because you're still making regular old DNS queries for every domain, but DNS over HTTPS or stuff like Chromecasts using hardcoded DNS servers do effectively negate Pi-Hole.
EvanAnderson 5y ago
Yes. Next you'll have to MiTM the DNS over HTTPS. Next in the arms race comes certificate-pinning. Controlling your name resolution will probably remain possible on Linux, but I expect most other platforms will make it exceedingly difficult for "normal" users. Embedded devices are already "game over". You don't own them (even if you paid for them). Controlling name resolution on your own network (and MiTM'ing HTTPS) makes you the same as a hostile nation-state actor. We can't have that.
- kelnos 5y ago
  > Embedded devices are already "game over". You don't own them (even if you paid for them). Ugh, seriously. I have a Chromecast, and couldn't figure out why it wouldn't play things on my local network (via DNS names set up in my router's resolver). Turns out Google hard-codes their own DNS servers and doesn't allow you to change them. The fix was to give the Chromecast a reserved IP address, and then set up some iptables rules on the router to redirect requests from it to 8.8.8.8 and 8.8.4.4 on port 53 to my router. I'm surprised that Chromecast is using old-school port-53 DNS and not DoH.
  - throwawaycuriou 5y ago
    is there any alternative software yet that can reproduce the Chromecast, including masquerading as one to my phone?
pkulak 5y ago
HTTPS doesn't, though DNS over HTTPS does. No one really uses DNS over HTTPS right now though.