I absolutely love the DNS based solution for ad-blocking and preventing tracking. I use AdGuard DNS on my PC (DNSCrypt) [0] and phone (DoTLS) [1], and it has improved performance of apps (not just websites), 'cause I guess there's a lot less going on under the hood now (trackers like new-relic and segment might be consuming a good percentage of resources which they wouldn't now since their domains are NX'ing?).
What am I worried about is DNS based black-holing is trivial to workaround against (as an ad-provider, one could simply force use a custom DNS client and pin to a DNS resolver of choice) [2][3][4]. What's next for pi-hole and solutions like AdGuard DNS short of re-writing packets going through UDP/53? Not sure how one would intercept the DoTLS / DoHTTPS connections, to rewrite those.
I'd like to hear if anyone has some thoughts on this, or if this has been discussed elsewhere.
DoTLS and DoHTTPS can be intercepted on your own devices by adding a privately generated certificate to your root store and MITMing the traffic. By design this is the only way to filter this traffic based on content.
Regardless name resolution based ad blocking is relatively futile against even naive workarounds. For instance what is to stop someone from using a custom DoHTTPS format on any webpage to resolve the name directly in browser? What's to prevent them from obfuscating it in a way your MITM couldn't realistically detect?
In the end ad blocking is best done directly on the client through something like uBlock Origin. Not only does this allow you to create a network request block list (now with the added capability of reading/filtering on the whole URI) but it also allows for style based blocks where the ad content could even be blocked if it comes from the same server and resources serving the actual page.
Like Vixie said, route and answer 8.8.8.8. He is complaining that he has to do it. He is not saying that there is no solution.
Putting a DNS client in Chrome (I think they removed it but who knows), or Chromecast, or whatever is "evolutionary pressure".
It forces users to evolve the solution to work around it. This is good.
If users are forced to learn to use an RPi for DNS (and we can see they are doing that with Pi-Hole), and eventually another pocket-sized computer with open-source software for routing, that benefits the community of users who want to avoid ads.
If avoiding ads is the goal, then using a pocket-sized computer with a user-installed OS is better than a solution marketed by a commercial third-party, as almost always those third parties rely partially/wholly/directly/indirectly on the ad business.
Re #4: really?! I missed that news. Sounds horrible. So instead of using my ISP, that I chose and trust, all my DNS queries now go to some foreign megacorp?!
Could just point to an IP directly as well. That could be blacklisted as well but in today's tech stack it is really easy to change variables so that a block would have a short term effect on the client.
I bought the Pi-Hole kit for ~$US100 but was never able to get it to work properly with SSL/TLS sites despite some (admittedly cursory) Googling. It's a great idea in theory.
Right now I use AdBlock plus. Occasionally, to get a webpage to work, I have to disable it.
How does Pi-hole mitigate this issue for non-expert users? My main concern is that if I set this up at home, my wife will get annoyed when her web pages don't work and won't have the patience to learn how to add to the whitelist.
Not directly related, but uBlock Origin is a better ad blocker than AdBlock Plus. From what I understand the uBlock Origin uses fewer resources; but more importantly, doesn't take money from advertisers to allow certain ads: https://adblockplus.org/en/about#monetization
It's more trusted nowadays and very easy to switch to.
There’s a simple pause button on the web interface. I bookmarked it on my wife's phone and showed her how to disable and she's had no trouble since. At first she was skeptical about the pi-hole but after seeing the difference it made, she's totally on board. We don't need to disable it often though, maybe once every month or two.
I am using pfsense with pfblockerng for ad/tracking protection. My wife spents a good amount of time on a mobile fashion game. In addition to the forced in app purchases once a month, it makes her watch plenty of video ads every day. She has to watch those ads to get virtual currency that can be used to purchase things that is a must for playing the game. With the protection enabled, the ads won't show and she can't play. So I had to whiteliste her mobile in pfblockerng. She still complains that it doesn't work. So she uses mobile data to play the game. I am not sure what else in pfsense is breaking it for her, I haven't looked further into it. One good thing is it helps me save bandwidth. My home internet has 500gb limit after which it drops to 1/10th of the speed. She seems to be using up close to her 1.5gb daily limit almost always, just from this game and facebook. So I get more bandwidth to download stuff!
So I did experience this. I eventually just moved my wife's phone over to a static IP/external dns so she didn't have to deal with it. But at least the rest of the network (IoT in particular) had less tracking.
I've unexpectedly nice thing was the Roku screensaver went back to a simple bouncing logo instead of the ad-filled scrolling billboard thing.
On a mac, you can set up Network Locations. I have one set up with the pihole dns server, and have the Automatic one set to normal defaults. There's a simple script[0] that will change your Network Location based on the wifi network you connect to, so I don't have to worry about switching it manually when I leave home and I don't have access to the pi as a DNS server.
Granted, none of this answers your question directly, but a manual Network Location switch from System Preferences is a somewhat simple change that's a little less friction than a whitelist. The auto changer should switch it back next time your wife's computer reconnects to the network in case she forgets.
You'd have to show her how to login to the web GUI and temporarily disable it I think, but I wonder if it's the use case.
If you're enabling ad filtering on the DNS level on your router, its more along the lines of forced ad filtering on your entire network, so you're kind of sacrificing user configurability for global ad filtering on your network.
Personally, I've only had the experience of a broken webpage once in two and a half years of using it.
I had to divert a bunch of devices (Samsung TV, Switch, etc.) around the pi-hole because it was easier than trying to figure out what they needed whitelisting.
It doesn't. I stopped using it when one of their default lists started blocking Microsoft.com. I get some people don't like Ms, but that kind of default is just plain negligent. Blocking updates silently is never ok in my book.
I wonder why there is no public official dns-server with the pi-hole blockings included. This would allow me to just insert the dns-ip into my fritzbox without having to setup and run a raspberry.
You're probably going to want to whitelist a domain here and there relative to the default blacklist. And the pi-hole has a few blacklists that aren't enabled by default, since they are much more strict.
So pi-hole-as-a-service doesn't make too much sense.
Pi-hole isn't difficult to setup but AdGuard Home is much easier. Just download the binary and run it. If you want it to start on boot run it with the `--install` flag. Works on Linux, Mac, and Windows.
Pi-hole replaces your DNS on the local network so one device is protecting all your other devices without you having to do anthing else. Yes, even that Wii or whatever :-)
I've been running an instance of this on a DigitalOcean VM for a couple of years now. Keeping my instance external is nice so I can use it from home, work, and for friends and family, with all of my devices. Fantastic project, highly recommended.
I recently talked about Pi-Hole in another thread[0]: I'm using Wireguard in combination with Pi-Hole on a cheap VPS as a VPN on my iPhone, it's blazingly fast and super stable. Will be trying this on my Mac as well now. I only allow access to the console from a fixed IP-address to add whitelists when needed. Everything loads much faster, websites, even apps I feel, though it might just be wishful thinking that last one.
I tried this with OpenVPN a while back and it was a spectacular failure because keeping the tunnel open also kept the cellular connection active and that sent battery consumption through the roof. I'm talking about 8-10 hours "standby" time on a modern iPhone.
Is that not a problem with your setup?
I looked into on-demand but is required a mdm profile and that seemed more trouble than it's worth.
It was surprisingly very easy and straightforward to setup, and working very well! It's most useful on Android/iOS.
One small change I've done is to set the Pi-hole DNS server only on a specific set of VPN connections (using specific ports) in order to have a full, unfiltered VPN if necessary.
1) Are the DNS request sent to oblivion or a fake address is returned instead? If the former, wouldn't a failed DNS request generate some sort of timeout?
2) Would a failed DNS request generate multiple retries to load a resource that is not available? (I can imagine this for application other than browsers).
3) How long until pages with ads will start solving addresses through some sort of script? Like in the section of the page responsible for showing an ad, manually crafting and sending a DNS request to 8.8.8.8 or whatever.
As far as I can tell the default blocking method in current builds is NXDOMAIN. You can read the details directly from the PiHole official page [0]. Short version, it just returns a no such domain.
More info on blocking modes [1]. This says the default (and recommended) blocking mode is NULL but it wasn't the case when I recently did my last install. Not sure if it was something with my build or maybe the docs need to be updated.
You will find that failing to access the resource on the other side will make many clients try and try again. On my PiHole I see Philips Hue, Microsoft, or Sonos with tens of thousands of retries triggered by previous failures to contact their destinations.
I run it at home and have use the dhcp server, too. All the numerous family PCs, Kindles, phone, etc, use it and it works great. For a family of four with two teen-age kids, it blocks about 20% of the DNS traffic we create.
A friend and I just launched an MVP a couple of weeks ago so people in New Zealand (and kiwis abroad) could have a VPN with PiHole hosted here in NZ: https://expatvpn.co.nz - however from the early users it seems everyone's just been using it for their phone mainly. I'm thinking I might rebrand it to be more for secure mobile browsing or something...
If any contributors are reading this: please consider adding separate blocklists per IP range. The use case is very simple: adults in the house get to see things kids don't get to see (and get their Youtube and games shut off if homework is not done), yet ads and tracking are still blocked for everybody.
This will almost certainly never get implemented because the community has a more or less accepted workaround. Run more than 1 pi-hole.
It's a common-ish practice in the community to have a restrictive pi-hole running in your guest/kids network and a more permissive pi-hole running in the trusted/adults network. Pi-holes require so few resources and maintenance that it's not much burden to run more than one.
It would be a pretty large feature to support separate blocklists per IP range.
My concern is that this kind of solutions, while neat, may push advertisers to start requiring content owners to host the advertisement content and/or directly communicate with advertiser api. In other words, Pi-Hole will only work while not terribly popular.
I tried this out over a weekend but decided to abandon it due to some of the sites I frequent being blocked. Whitelisting isn't a viable solution here as I would then need to teach my girlfriend how to do it and any family members who decide to visit.
I am starting to be concerned that the ability to use DNS to block tracking, malware, and advertisements is only going to prove temporary.
There appears to be more effort generally to secure and encrypt the entire DNS system. This is really good and should be applauded and supported. But it will come with a downside... once we reach a future in which DNS records are encrypted end to end, and DNS records are only valid when signed by certain keys, and authenticated NXDOMAIN records... then things like Pi-Hole start to become more difficult as for security of DNS we'll have lost the convenience of changing the answers.
I have been running a pi-hole server in my home for almost a year now, and I love it. We usually have around 30 devices (including IoT devices), and have never had any issues. Adding/removing sites, disabling (when necessary), updating...its all there and very easy to operate. The logs are just ok, and the blacklist/whitelist is handy.
It was quick and easy to setup on an existing Ubuntu server install.
[+] [-] ignoramous|7 years ago|reply
What am I worried about is DNS based black-holing is trivial to workaround against (as an ad-provider, one could simply force use a custom DNS client and pin to a DNS resolver of choice) [2][3][4]. What's next for pi-hole and solutions like AdGuard DNS short of re-writing packets going through UDP/53? Not sure how one would intercept the DoTLS / DoHTTPS connections, to rewrite those.
I'd like to hear if anyone has some thoughts on this, or if this has been discussed elsewhere.
[0] https://simplednscrypt.org/
[1] https://news.ycombinator.com/item?id=18788410
[2] https://news.ycombinator.com/item?id=19170671
[3] https://news.ycombinator.com/item?id=19106023
[4] Firefox 64 for PC, by default, was configured to ignore OS/Network Interface provided DNS resolver and used CloudFlare's over HTTPS.
[+] [-] zamadatix|7 years ago|reply
Regardless name resolution based ad blocking is relatively futile against even naive workarounds. For instance what is to stop someone from using a custom DoHTTPS format on any webpage to resolve the name directly in browser? What's to prevent them from obfuscating it in a way your MITM couldn't realistically detect?
In the end ad blocking is best done directly on the client through something like uBlock Origin. Not only does this allow you to create a network request block list (now with the added capability of reading/filtering on the whole URI) but it also allows for style based blocks where the ad content could even be blocked if it comes from the same server and resources serving the actual page.
[+] [-] 3xblah|7 years ago|reply
Putting a DNS client in Chrome (I think they removed it but who knows), or Chromecast, or whatever is "evolutionary pressure".
It forces users to evolve the solution to work around it. This is good.
If users are forced to learn to use an RPi for DNS (and we can see they are doing that with Pi-Hole), and eventually another pocket-sized computer with open-source software for routing, that benefits the community of users who want to avoid ads.
If avoiding ads is the goal, then using a pocket-sized computer with a user-installed OS is better than a solution marketed by a commercial third-party, as almost always those third parties rely partially/wholly/directly/indirectly on the ad business.
[+] [-] 1over137|7 years ago|reply
[+] [-] sudo-i|7 years ago|reply
[+] [-] toredash|7 years ago|reply
[+] [-] wnissen|7 years ago|reply
https://uk.pi-supply.com/products/pi-hole-kit-network-wide-a...
[+] [-] caioau|7 years ago|reply
[deleted]
[+] [-] _emacsomancer_|7 years ago|reply
[+] [-] muppetman|7 years ago|reply
https://hub.docker.com/r/pihole/pihole/
[+] [-] kissgyorgy|7 years ago|reply
[+] [-] unknown|7 years ago|reply
[deleted]
[+] [-] jedberg|7 years ago|reply
How does Pi-hole mitigate this issue for non-expert users? My main concern is that if I set this up at home, my wife will get annoyed when her web pages don't work and won't have the patience to learn how to add to the whitelist.
[+] [-] jeffmk|7 years ago|reply
It's more trusted nowadays and very easy to switch to.
[+] [-] bollockitis|7 years ago|reply
[+] [-] jukic|7 years ago|reply
I haven't had any issues come from me or anyone in my family using it thus far. Although, there's an active discussion which that whitelist pulls mostly from here: https://discourse.pi-hole.net/t/commonly-whitelisted-domains...
[+] [-] nonamechicken|7 years ago|reply
[+] [-] dtparr|7 years ago|reply
I've unexpectedly nice thing was the Roku screensaver went back to a simple bouncing logo instead of the ad-filled scrolling billboard thing.
[+] [-] secondstring|7 years ago|reply
Granted, none of this answers your question directly, but a manual Network Location switch from System Preferences is a somewhat simple change that's a little less friction than a whitelist. The auto changer should switch it back next time your wife's computer reconnects to the network in case she forgets.
[0] https://github.com/eprev/locationchanger
[+] [-] JauntyHatAngle|7 years ago|reply
If you're enabling ad filtering on the DNS level on your router, its more along the lines of forced ad filtering on your entire network, so you're kind of sacrificing user configurability for global ad filtering on your network.
Personally, I've only had the experience of a broken webpage once in two and a half years of using it.
[+] [-] zimpenfish|7 years ago|reply
[+] [-] obituary_latte|7 years ago|reply
[+] [-] tw04|7 years ago|reply
[+] [-] schappim|7 years ago|reply
[+] [-] tosh|7 years ago|reply
[+] [-] realPubkey|7 years ago|reply
[+] [-] clarkmoody|7 years ago|reply
So pi-hole-as-a-service doesn't make too much sense.
[+] [-] tbronchain|7 years ago|reply
However, as it's been said, you might want to easily whitelist some domains.
[+] [-] snazz|7 years ago|reply
[+] [-] dsissitka|7 years ago|reply
https://github.com/AdguardTeam/AdGuardHome
Pi-hole isn't difficult to setup but AdGuard Home is much easier. Just download the binary and run it. If you want it to start on boot run it with the `--install` flag. Works on Linux, Mac, and Windows.
[+] [-] Moru|7 years ago|reply
[+] [-] _emacsomancer_|7 years ago|reply
[+] [-] xd1936|7 years ago|reply
[+] [-] Down_n_Out|7 years ago|reply
[0] https://news.ycombinator.com/item?id=19186795
[+] [-] bluegreyred|7 years ago|reply
I looked into on-demand but is required a mdm profile and that seemed more trouble than it's worth.
[+] [-] Jemm|7 years ago|reply
[+] [-] kang|7 years ago|reply
[+] [-] tbronchain|7 years ago|reply
It was surprisingly very easy and straightforward to setup, and working very well! It's most useful on Android/iOS.
One small change I've done is to set the Pi-hole DNS server only on a specific set of VPN connections (using specific ports) in order to have a full, unfiltered VPN if necessary.
[+] [-] scoutt|7 years ago|reply
1) Are the DNS request sent to oblivion or a fake address is returned instead? If the former, wouldn't a failed DNS request generate some sort of timeout?
2) Would a failed DNS request generate multiple retries to load a resource that is not available? (I can imagine this for application other than browsers).
3) How long until pages with ads will start solving addresses through some sort of script? Like in the section of the page responsible for showing an ad, manually crafting and sending a DNS request to 8.8.8.8 or whatever.
edit: for clarity
[+] [-] close04|7 years ago|reply
More info on blocking modes [1]. This says the default (and recommended) blocking mode is NULL but it wasn't the case when I recently did my last install. Not sure if it was something with my build or maybe the docs need to be updated.
You will find that failing to access the resource on the other side will make many clients try and try again. On my PiHole I see Philips Hue, Microsoft, or Sonos with tens of thousands of retries triggered by previous failures to contact their destinations.
[0] https://pi-hole.net/2018/05/18/nxdomain-and-null-blocking-wi...
[1] https://docs.pi-hole.net/ftldns/blockingmode/
[+] [-] HugoDaniel|7 years ago|reply
Also beware as most ads in your phone apps come from ad intermediaries that are either dynamic or constantly change.
Pi-Hole is a cool project but please take in consideration those two when using it. We are far from the 90's in ad-tech.
[+] [-] LVDOVICVS|7 years ago|reply
Love it.
[+] [-] forinti|7 years ago|reply
[+] [-] veb|7 years ago|reply
[+] [-] m0zg|7 years ago|reply
[+] [-] xythian|7 years ago|reply
It's a common-ish practice in the community to have a restrictive pi-hole running in your guest/kids network and a more permissive pi-hole running in the trusted/adults network. Pi-holes require so few resources and maintenance that it's not much burden to run more than one.
It would be a pretty large feature to support separate blocklists per IP range.
[+] [-] IanSanders|7 years ago|reply
[+] [-] tjpnz|7 years ago|reply
[+] [-] buro9|7 years ago|reply
There appears to be more effort generally to secure and encrypt the entire DNS system. This is really good and should be applauded and supported. But it will come with a downside... once we reach a future in which DNS records are encrypted end to end, and DNS records are only valid when signed by certain keys, and authenticated NXDOMAIN records... then things like Pi-Hole start to become more difficult as for security of DNS we'll have lost the convenience of changing the answers.
[+] [-] waltwalther|7 years ago|reply
It was quick and easy to setup on an existing Ubuntu server install.