Hacker News Reader

Comment by Jaruzel | Hacker News Reader

My experience with Pi-Hole is that there are too many sites that detect that their adverts and tracking scripts don't load and refuse to let you in. It's really hard to white-list for a site in Pi-Hole, as it's blocking for the whole network, so finding what domains you need to unblock is quite laborious. Additionally, if you are not around, and a family member or co-worker can't get to a site then they have no way to bypass it unless they also know how Pi-Hole works.

Personally, I find a browser based advert/tracking blocker add-on to work better.

If Pi-Hole had a webpage where you could put in a domain, i.e. cnbc.com, and it went off and loaded the html of that page, worked out all the other domains that html connects to, and then gives you a 'unblock' button to click, that would improve usability significantly, as even a non-techie user could use it.

View on HN

I couldn't agree more. Pi-Hole is essentially useless for real world scenarios.

I can't hear this short-sighted comments "it doesn't load with pi-hole? then I just close the tab!"

oh really? that's how easy it is in your world? and then you just don't buy that flight ticket? because that shitty online ticket agent uses third-third-party payment providers etc. whos domain is unfortunately blocked in pi-hole? even one single incident might force you to entirely disable pi-hole. most people can't afford to play around with that until it works.

you can't seriously maintain these block lists yourself. you have to rely on a 3rd party, usually some volunteers - great people btw - but even a huge crowd like them can't make sure, that from time to time, in some part of the internet, in some specific country and language, something will be blocked by mistake and you are stuck. with a browser plugin, at least you can disable it for that specific case. with pi-hole there is no such feature. i have to disable my browser adblocker at least once a month, because something doesn't load. and its always off for sites like paypal, because I really want that payment to work and not suddenly screw up the whole transaction.

> Pi-Hole is essentially useless for real world scenarios.

This is a surprising statement because I've used mine at home with 6+ devices and zero issues for almost two years now. It seems fair to say it's not ideal for your needs, but why say something like this that will only deter people from seeing if it works for them?

Same here, I've never even touched the PiHole other than checking stats and doing updates. I've got about 15-20 devices on my network (a few phones, multiple computers, smart TV, Hue Lights, Nest, WeMo, etc). Haven't had a single problem. My Pi just sits there running constantly without even having to reboot it. Can't say the same for any other device that I own.

We're running pi-hole network wide and we just planned a trip with no glitches. The only annoyance (if it's really an annoyance) is clicking on a link in a google search and it's blocked. Go back to Google, realize is was an ad, scroll down a little further and click the real link. No big deal. Nobody in the house is complaining about not reaching sites.

So, yes, it is possible to do this in real world scenarios.

This is my experience as well. I very rarely find sites that don't work because of pi-hole, other than their advertising links.

I can't actually think of a case where I've had to disable pi-hole because a site seemed to have broken functionality. I book flights on Expedia et al all the time.

Every once in a while I want to do competitive shopping, and disable pi-hole for an hour. It's a revelation now much crud shows up (and pops up) when I do.

You made me giggle :-D

worried about resolving ad/tracking urls, yet ordering things via Expedia

If you don’t understand the irony here I’ll giggle even more

Not the person you were replying to, but that was unnecessarily mean. Instead of just poking fun at someone else's ignorance, perhaps you can enlighten them?

Parties like Expedia do more tracking and analytics of what you look at, when you look at and how you look at offers on their site then most of the urls on the pi hole url lists, which are typically referral counting urls (many also just for adult sites), or just for counting traffic. And I wouldn’t be surprised if they sell this data too. Not saying they are, but I wouldn’t be surprised if they do.

Also since when is giggling mean? The assumption that I intended to be mean, is kind of mean too. This is about the same as somebody saying not to eat sugar yet eating lots of fruit that contain sugars, if somebody says that to you surely you giggle without being mean.

Ah, just let him giggle.

If something's really important you could use your phone with wifi off to get an unblocked version via cellular. It's one more step, but some people may find it to be worth the effort.

Have used a Pi-hole for two years and maybe had to whitelist one or two sites (easily found looking at the log), which was easy using Pi-hole's web interface

Additionally, you can simply disable Pi-hole for temporary timeframes using the web interface as well, it has options like "Disable for 15 minutes", if you don't want to bother adding things to a whitelist.

I've used all sorts of financial, ordering, etc. sites and generally have not run into an issue. A single credit card site was one of the two I had to whitelist, and it was easy.

> I couldn't agree more. Pi-Hole is essentially useless for real world scenarios.

As a user of pi-hole, I have no issues with small scale implementations (i.e. less than 20 users) but security is more important than access to random sites for personal use in the environments I work in.

It is just is for security-prioritized environments.

You wouldn't really be STUCK if you are blocked... you can just point your DNS to another IP (like 8.8.8.8 or something). This is DNS based, so if you don't use the Pi-hole DNS server, you aren't affected.

Agreed, sometimes you just NEED to use a shitty site. I have my main browser specially configured ad free and privacy secure but I always have a backup browser.

The people who build websites aren't thinking about us.

Been using pi-hole for over a year with no issues. Not sure what's going on with your experience.

> Additionally, if you are not around, and a family member or co-worker can't get to a site then they have no way to bypass it unless they also know how Pi-Hole works.

I ran into that issue with some household members, that had problems with certain websites that didn't work. Since I run my own DHCP server (not through pi-hole), what I ended up doing is giving them a different (e.g. 1.1.1.1) DNS resolver for their machine (based on their MAC address), and then installing uBlock Origin for them. That way, they can easily turn ad blocking on/off themselves, while I can still have network-wide adblocking on by default (especially useful for mobile devices).

I used to use a pi hole since YouTube on a Samsung smart TV is horrible both YoutTube and Samsung put ads in the same video (YouTube at the start and Samsung ...whenever). But Samsung inject ads frequently and aggressively. Even short ten minute videos are interrupted at least twice by ads sometimes a few seconds before a video ends, I mean really?!?

It worked great for a long time but then but changed my setup.

Then I wanted to try Pi-Hole again going through the setup again but the results were very different. For example my Samsung smart TV absolutely refused to connect. It is the same TV, same Pi device, same everything but no network.

Well that just sold me on never buying another Samsung TV ever. How in the hell does Samsung, a device manufacturer justify inserting ads over content thats not even theirs?

I think basically because (1) they can and (2) no one has stepped in to prevent them from doing it.

But it's absurd.

It seems worse for some videos too which made me think it was YouTube but I can't see YouTube inserting ads mid-video or a few seconds before the end of a video. It's local ads too for my small town so it's targeted very precisely to me.

Other crap is resetting the opt-out after a software update. And also putting the agree or disagree checkbox on a separate page than the actual terms you just read. You read it on one page then exit, look at a bunch of terms and scroll to find the matching document that has the agree or disagree checkbox for one of the TOS documents you read. It's a mess.

Never buy a smart TV just buy a monitor without any smarts.

The sound cuts out on it too you'll miss every few words almost as if it were censoring it.

I'm afraid someday it will not work if it can't update its OS.

> . How in the hell does Samsung, a device manufacturer justify inserting ads over content thats not even theirs?

Earnings growth for shareholders. Something-something-"advertising revolution/innovation".

What model Samsung do you have? I have been using the KS8000 for a couple years and have only ever noticed the small ad that looks like another app in the home screen. I've never had Samsung ads in 3rd party apps.

I tried to find the model in the menu but I can't see it. It's a 50 inch, 4K, UHD only about three years old. I think it has an OS that's different that what is currently available.

It's quite obvious that it's Samsung ads as mentioned it's constant not at the start of a video like how YouTube would do it. And at odd times as if it injects every five minutes no matter what.

I've been using a Samsung TV for the last 3 years and never seen an ad on YouTube. Which model are you using?

I'm not sure it's 50 inch, UHD, 4K so possibly UHDxxxx something.

It's is incredibly annoying to have numerous ads in every video. I even tried to see what was going on using Wireshark but it was beyond my capabilities.

I typically browse the internet with JavaScript disabled by default and rarely come across issues - when I do unless the website is appealing enough to white-list for js I go elsewhere.

I have also found the reader view functionality on iOS to be a godsend when visiting websites, no more cookie notices, GDPR popups or banners taking up 1/3 of the display - bliss!

I see "just going elsewhere" as a possible solution 10 years ago but not today, depending on how much you're using the internet.

To me it feels like the number of sources of information has grown exponentially in the past 10 years. So unless you're talking about a service that more or less locks you in (like a mail provider that you can't easily switch) you can find the same information on dozens of sites. Just pick one that either has reasonable ad practices or one that accepts adblockers.

That depends if you are reading original journalism or aggregated journalism. Something from Reuters or AP (or a tweet .. ) might be on hundreds of websites, but look at a list like this, https://www.aldaily.com/media/ , how many of these stories dont really get published elsewhere.

Sure but how was this better 10 years ago?

"Original anything" (read unique) by definition doesn't go well with the "just go elsewhere" concept. If you can go elsewhere then it's not that original or unique. Time has no bearing on this.

For "mass content" (aggregation or simply independently reporting on the same topic) you have vastly more choice today. And for unique pieces of information, only available in one place, you would have been just as stuck then as you are now. The uniqueness, not the time is what takes the choice out of the equation.

Find a commercial website that doesn't use google-analytics.com or googletagservices.com its pretty hard.

Yes, but you are part of the tech saavy bubble. That's not a solution for most users who don't want a downgraded version of their facebook/instagram/gmail/etc experience.

> many sites that detect that their adverts and tracking scripts don't load and refuse to let you in

I think I've only seen that once since running pi-hole (which I've done for about six months now), so I assume the rate of occurrence varies widely with what people are browsing. Do you see it a lot on sites with a particular pattern (i.e. pertaining to a certain industry or hobby/interest)?

> and refuse to let you in

I'm fine with that. I doubt the information isn't available elsewhere if I really care about it, and the most insidious stuff I'm blocking tends to be on less important content that I can live without anyway (imgur.com was the final straw that made me install network-level blocking - too many pop-unders, the occasional drive-by install attempt, adverts trying to access my microphone and/or camera, and less worrying but still annoying things like auto-playing audio - if such frivolous sites block me for blocking their ads because they can't police them properly I'm sure I'll live!).

> a family member or co-worker can't get to a site then they have no way to bypass it unless they also know how Pi-Hole works

> Personally, I find a browser based advert/tracking blocker add-on to work better.

Other people is why I run blocking at the network level ATM (as well as on my individual mobile devices). I'd rather deal with the occasional "I can't get into X, oh, it is because of the malware/ad blocker, try somewhere else" conversations than have the tech support load of undoing drive-by installs!

Also, I wouldn't want other people to easily add stuff to my network's whitelist.

Anyone who really objects can always use their own mobile data plan instead of using my network that runs just fine the way I want it to...

>> and refuse to let you in

> I'm fine with that.

Agreed. Sounds like the Pi-hole is working exactly as intended.

As I see it, you have a choice between viewing an ad/malware laden cesspit, or avoiding it. And by installing a Pi-hole, you have already made that choice.

You can also use a remote service like outline.com, paste the url there, and still read the content without the ads and without being blocked by an ad-blocker-blocker, and often even without being blocked by view-limiting paywalls.

> and refuse to let you in

>> I'm fine with that.

That's fine with me too, but doesn't cut it in a family environment. Further, some websites break with an adblocker, even when they don't have ads. E.g. Login with Facebook/Twitter, or some JS heavy sites which happen to have a bad keyword in the name of the file.

> many sites that detect that their adverts and tracking scripts don't load and refuse to let you in

>> I think I've only seen that once since running pi-hole

It used to be a daily occurence until I whitelisted sites. At least with an addon, my mum can just click the button and unblock and get on with her day.

If pi-hole could have some companion extension to make whitelisting easier that would be great.

>Login with Facebook/Twitter, or some JS heavy sites which happen to have a bad keyword in the name of the file.

Pihole is purely DNS, it doesn't trigger of filenames.

Good point. I stand corrected :)

This might be unpopular, but I hope Pihole remains untenable for non-technically savvy users. Advertisers and ad-blocking are always engaged in a game of cat and mouse. I'd prefer advertisers to see Pihole as a tiny niche of the market they don't need to seriously work to defeat.

The only way to defeat them would be to self-host ads. Which would actually be a good thing since publishers would now have an incentive to make them as light as possible since it's their bandwidth being used.

because of how pi-hole works (works on the DNS level), all they have to do is use some CDN domain, which can't possibly be blocked without serious collateral damage.

Yes, but as long as they don't pihole works beautifully because the ads are killed before they are downloaded, in stead of stripped after the download (like with uBlock).

Especially on data capped devices like mobile phones it works wonders.

>the ads are killed before they are downloaded, in stead of stripped after the download (like with uBlock).

That’s false. https://github.com/gorhill/uBlock/wiki/Does-uBlock-block-ads...

> Yes, but as long as they don't pihole works beautifully because the ads are killed before they are downloaded, in stead of stripped after the download (like with uBlock).

> Especially on data capped devices like mobile phones it works wonders.

Are you implying that pihole works wonders on data-capped devices such as mobile phones? If the phone is connected to a network with a pihole, it isn’t using the capped cellular service. If it is using the capped cellular service, it isn’t going through a pihole. Am I missing something?

It's less common, but some people use a VPN while on mobile data to get back to their local network.

https://docs.pi-hole.net/guides/vpn/overview/

I guess you could also setup your pihole to be externally accessible and then point your phone's DNS at it, though I'm not sure that's a particularly good idea.

Some ISPs have caps as well. Comcast has caps in most of the USA for example.

My phone and tablet connect via openvpn to a server running pi-hole.

> in stead of stripped after the download (like with uBlock)

That's quite an erroneous statement, especially given how easy it is to verify.

You can see for yourself by using uBlock Origin along with your pi-hole: your pi-hole will see _less_ network requests with uBO (or any other similar blockers really).

Everything which is blocked by uBO will not be seen by your pi-hole, and this simple observation contradicts your statement.

This is what CDNs are designed for, the allow a few companies to get a monopoly on your browsing data. This is why I prefer uMatrix, it blocks all third party requests, a lot of stuff breaks but it breaks because their tracking you.

Doesn't using a CDN break impressions statistics, making it impossible to administer?

Agreed, I find that self-hosted ads tend to be the least offensive. Even if this changed, and some self-hosted ads were intrusive or malicious, it would certainly be a simple problem to solve: block site X.com and don't visit site X.com

I'm waiting for the next generation ad blockers where a cloud based html rendering engine renders the image of the page to a frame buffer, crops out the article or pictures, compresses them, and sends it to my device.

Hell, you could do a mechanical turk system and pay micropayments to 3rd world employees to crawl ad-infested crap and harvest the content for me (Or better yet, share it for the common good)

>Personally, I find a browser based advert/tracking blocker add-on to work better.

>If Pi-Hole had a webpage where you could put in a domain, i.e. cnbc.com, and it went off and loaded the html of that page, worked out all the other domains that html connects to, and then gives you a 'unblock' button to click, that would improve usability significantly, as even a non-techie user could use it.

Aren't you just describing uMatrix?

I think he's describing a local network ad-blocker that you can control and configure from any browser with a simple extension. This means that you can update rules from any device in your home/office and it would still apply for all devices in your network.

exactly! You wouldn't even need an extension.

Just tell your users, if a site isn't loading properly, to go to http://my-pi-hole.local.lan/whitelist and unblock it.

It would be ideal if the workflow could be something more like "click this link" (and pi-hole's GUI would then give you a prominent button to redirect you to an unfiltered version of the last request from your device (or maybe a list, since who knows how many background ones are being silently killed), which would be whitelisted for an hour.

You can do this already. The URL is http://pi.hole

Whether you want them to have access depends on your “users”.

A 1-click option (or maybe 2) is a much better solution for tech-averse users :). And extensions already exist to enable/disable Pi-Hole, the functionality could be expanded to include quick whitelisting.

I would have the same concern, I imagine the Pi-Hole is best for households only inhabited by tech-affine people. I installed the uBlock Origin addon for some family members and even there they can be easily confused when a website breaks due to it (occurs rarely, but it happens). At least there I can easily tell them to temporarily disable ad-blocking by pressing that big uBlock button.

I don't think it would be feasible for me to explain to them how to temporarily whitelist things on the Pi-Hole.

I don't think that's a problem at all.

I did give the family members the password to unlock the block temporarily but after a while they simply stopped using those sites altogether.

It's also a big plus for devices that can't adblock themselves (phones, embedded devices, etc.)

You can add a button to your Raspberry Pi to temporarily disable all the blocking. Not the best solution but still useful to know I think.

I really like this idea. Make it big and red. Easily done it seems:

https://www.hackster.io/marko8904/web-connected-aws-iot-big-...

Do you have a link to a tutorial?

For the non-tech-savvy members of the household you can provide a link to the disable API.

e.g. Temporarily disable blocking for 60 seconds,

http://pihole.lan/admin/api.php?disable=60&auth= .

You can also infuriate the teenagers in the household by blocking and unblocking domains at certain times via crontab. e.g.

0 08 * * * /usr/local/bin/pihole -wild --delmode instagram.com youtube.com

0 22 * * * /usr/local/bin/pihole -wild instagram.com youtube.com

In my experience, most adblock blockers take a lazy approach - it's just a piece of JS loaded together with the main document. So it's ridiculously easy to protect against: just switch off JS with a click and you can read the page in question. Of course it works for documents only - if you need to use an app, things are much trickier and you need to dig up a bit to understand which script you have to block.

Due to bandwidth constraints I surfed with images and JS disabled (safari developer options) and oh my god what an improvement it was. No trackers. No ads. No auto-playing video. No newsletter pop ups. No cookie notices. This was GDPR but I imagine that would be gone on most sites too. I'll probably switch back soon. I long for the speed, the elegance...

Usually you don’t even need that, they just cover the page with a div that you can delete in inspector.

There's also this bookmarklet which deletes fixed elements (unfortunately I don't know the original author):

  javascript:(function()%7B(function%20()%20%7Bvar%20i%2C%20elements%20%3D%20document.querySelectorAll('body%20*')%3Bfor%20(i%20%3D%200%3B%20i%20<%20elements.length%3B%20i%2B%2B)%20%7Bif%20(getComputedStyle(elements%5Bi%5D).position%20%3D%3D%3D%20'fixed')%20%7Belements%5Bi%5D.parentNode.removeChild(elements%5Bi%5D)%3B%7D%7D%7D)()%7D)()

Author is Alisdair McDiarmid:

https://alisdair.mcdiarmid.org/kill-sticky-headers/

This is a very useful skill. I run into a surprising number of pages where invisible elements prevent you from continuing (unintentionally, eg payment forms).

Also that crap on the bottom of every Medium article.

... and the top... and the sides...

"kill sticky" is amazing for this. One click gets most annoying stuff.

https://alisdair.mcdiarmid.org/kill-sticky-headers/

That's at least two clicks. Disabling JS with a plugin like disable-HTML is one click.

Or zap with uBlock origin

Weird, my experience doesn't match yours, and I run both Pi Hole and uBlock. I guess the blocklists factor in a lot and also the sites you visit.

Here is how to disable pihole via a url: https://www.reddit.com/r/pihole/comments/81z8jp/temporarily_...

With this anyone in your family can temporarily disable it to unblock themselves if needed.

Sending the pihole admin password in a non-https url query string seems like a bad idea. You might argue that your network is 'trusted', but then I'd remind you that this pihole device is designed to intercept all dns on your network, and would be used quite maliciously if compromised.

You can add a certificate and then access it over https: https://discourse.pi-hole.net/t/enabling-https-for-your-pi-h...

I don't think my neighbors are sniffing my wifi traffic, I wouldn't think the password to be at risk

It's best to just not go to those sites. Never whitelist, it defeats the whole purpose if you care one bit about tracking. If I come across enough links to a site that does that, I add them to my url blacklist, so I never see them again. I wish uBlock Origin would add that feature so I did't have to maintain my own junky plugin to do it.

Simple phrasing could change this. If the site was deemed "unacceptable", not just "blocked", with no particular detail people would find alternatives (even pick up the phone?). This could be done at both the browser and ISP level, as well as something like Pi-Hole.

It kind of already has this. Just tail the log in the web admin, then hit the site in your browser. Unblock the sites that were blocked on that request.

I've been using pihole for a year and have only had one site that refused to load. Was pretty easy to figure out which request it was and whitelist it.

Generally, I agree - though I imagine the advantage of pi-hole is that it can also block ads in non-browser contexts, e.g. mobile apps.

At least it can until those apps start to use their own hardwired DNS/DoH server...

I've found that most sites which attempt to block access due to ad-blockers typically do so with a full-page pop-up element which hides the (fully loaded) content underneath. With uBlock Origin it's easy enough to use the element-picker to remove the blocking elements of the webpage.

I'd really really like a simple whitelisting interface too. Sometimes I just need to get shit done for a minute, and then I'd just start blocking again. All or nothing is incredibly frustrating sometimes.

It's got that... Disable for 10s, 30s, 5m, custom or permanent. GUI or CLI.

ok, sold then

I run a Pi-hole (mostly for my phone and paired with OpenVPN and iOS/MacOS content blockers) and run into the same "problem". My advice is to stop patronizing those sites at all. Just like paywalled articles linked on HN, just stop visiting.

Seriously, just stop. It's the only way we're going to move to something less damaging and invasive than the current ad/data economy.

I should note that I do pay quite a lot for journalism and art via subscriptions, Patreon, Kickstater, etc, but I'm not going to tolerate sites clogging up search results with paywalled articles or piles of tracking scripts and media downloads.

This is completely untenable advice to give family that shares your Internet connection, which the OP clearly pointed out.

Why? I've been running pi-hole on the home network for over 2 years already, and indeed sometimes I get complaints about shopping sites not working, but there is always an alternative site that does work so we order there instead. Just last week it even saved us money because it turned out a different site had the same product at a significantly lower price.

Apart from a few non-important edge cases literally every major site works without problems with a pi-hole. I think 'simply stop using sites that refuse to work unless they can track you' is a very valid and workable solution.

I purposely black list any sites that complain about not able to load their ads. Using both is a better answer.

you could have pi-hole redirect to a site with the same story maybe? or even pi-hole could cache it.

Not a problem. I can't remember that ever happening, but if it did I would just close the tab. Pi-hole works as intended.

Reply on news.ycombinator.com