Hacker News Reader

Comment by surround | Hacker News Reader

Pi-hole is very easy to set up, and it works so well you can basically forget about it from that point on. Blocking ads is nice, but it’s also a huge boon for privacy. I run uBlock origin on all my browsers, but Pi-hole still blocks 30-50% of requests on my network. It’s also really nice to be able to glance at the logs and get an idea of what’s going on on your network, or if there’s any unusual activity.

I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing.

View on HN

I set up a pihole and literally forgot about it. Like I was cleaning out a closet on moving day and found it plugged in. Took a moment to even realise what it was doing there.

I’m reminded almost every day that I have a pi-hole since it is not my dns provider when on my company’s vpn. It’s absolutely night and day on so much of the web. Some sites have so many ads now it’s just shocking to be frank.

Why not use a client based content filter such as uBlock Origin?

Not them, but you can’t do that at every company.

Also maybe they use their phone and many combinations of PhoneType + BrowserType don't support the same quality of adblocking as PiHole.

Mobile Firefox Supports ublock Origin nowadays.

I'd encourage anyone to try that out

On iOS too?

No, but there are plenty of other content filtering solutions on iOS, including Mozilla’s own Firefox Focus that can be installed as a system-level content filter.

NextDNS is pretty good especially on iOS where you can’t install adblockers (unlike on rooted android)

You can't?

https://www.imore.com/how-block-ads-your-iphone-or-ipad

> Where can I block ads? Only in Safari (or an app using the Safari View Controller).

Pihole is a system wide Adblocker and so is NextDNS on iOS. So are the ones you can install on Android rooted.

latest ios 13, AdGuard Pro installs VPN profile and filters on DNS level pretty well.

Relevant adventure with iOS update rejection: https://adguard.com/en/blog/adguard-pro-is-back.html

I could (and heck, probably should). But I don't browse websites all that often on the vpn. Just on the occasion that I do, I'm blown away at all the ads :) So just lazy.

Obviously will depend on your company, but some corporate VPN clients will still let you use a local or alternate DNS. Then just add the machines you need to connect to on your work network to your hosts file.

Won't fix your issue but I run a Wireguard VPN on my PiHole that allows me to get onto my local network. The other upside is that once connected you get the PiHole blocking from anywhere....

Finding a years abandoned Linux server on your home network m ight be a good leasson to always treat your home network as if it was compromised.

Honestly curious: how would you exploit it? If the pi isn't exposed to the www by your router, what can you do?

The PiHole interacts with DNS servers. Theoretically - imagine a crafted TXT Record which is somehow improperly handled by dnsmasq.

Essentially - it's reading user-defined data - which is probably enough to be really bad, incase of a malicious exploit in the wild.

Typically a pi-hole is used as a DNS resolver. In order to work it must connect to the internet.

Scenario for attack: Laptop looks up a website, DNS request is made to pi-hole, pi-hole sends request to internet. Response packet received back is actually from an attacker, that uses a known vulnerability in the handling of the packet to take over the machine.

Attacker can now see what DNS requests are being made, and by returning custom responses, it can MITM any HTTP request you make from your laptop. Let's hope everything is encripted via TLS, and hope that some piece of software that just asked for admin permission didn't just install a new TLS trust root.

That is definitely a bad situation. Thanks for the reply. Unnerving to think there'd be even a possibility of getting root just from processing a DNS response!

There are lots of ways. A basic vector is CSRF (like eg https://tools.cisco.com/security/center/content/CiscoSecurit...), or the server side variant (SSRF). Then there's the DNS vector already mentioned. There are others too. Generally it's a bad idea to rely on home network boundary protections.

If you run Windows, it blocks a lot of stuff that isn't browser related. That's why ublock does not get it down to 0 percent.

Right, I didn’t mean to make it sound like uBO was letting stuff through the cracks (it’s actually far more thorough than dns filtering). But the amount of tracking requests that come from outside of the browser and from other devices is no joke.

>I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing.

Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.

Some ad agencies starting asking hosters to add a CNAME record to one of their domains.

Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com.

As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money!

So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`.

When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more.

What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

This CNAME method is also a huge security issue, but I'm not gonna go into that.

> This CNAME method is also a huge security issue, but I'm not gonna go into that.

A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?

For the website - https://news.ycombinator.com/item?id=23137309

> This CNAME method is also a huge security issue, but I'm not gonna go into that.

I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.

How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)

Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)

That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?

Yep, that combined with an orphaned DNS record

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Right

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Yeah, uBlock Origin recently added a new permission request just to allow that.

From my understanding, it only works in Firefox and not Chrome though as an FYI.

Correct. Chrome doesn't have such mechanism and if I'm not mistaken, they've already shot down the idea of adding this API.

cdn.goodsite.com -> tracker.badsite.com

cdn used to mean - serve the same static content all over the world and speed things up.

cdn now means - serve up different content to every single person and track them.

take a look at stack overflow and it's cdn.

Just because bad guys use a CDN doesn't mean CDNs are bad

Thanks! I hadn't heard of this method. One question though: What will prevent the ad providers from asking their customers to add an A/AAAA record to one of their IPs? That'll be much harder to combat for an adblocker especially because those IPs will usually be shared with actual content services.

Of course this'll add overhead to the visited website manager because the IPs will probably change regularly as they're pointing to cloud services. But I'm sure they'll manage to automate this.

I bet this will be the next step in this cat & mouse game.

I think it would be only marginally harder to combat, since now you just need a list of IPs to block. Someone would have to maintain the (likely ever changing) list of IPs used, but that's not so different from what's happening now.

> Someone would have to maintain the (likely ever changing) list of IPs used

What if the ad-network is domain-fronting via a CDN? Either ways, can't block IPs since http-domain <-> IP isn't supposed to be a one-to-one mapping, each belong to different layers of the TCP/IP stak.

Here's an example from the feature request:

Here is an example (the domains are fake, it’s for demonstration purpose only): The domain adcompany.com 5 is in my blacklist, so it returns the IP of my Pi-Hole if I do a DNS query:

$ host adcompany.com adcompany.com has address 192.168.1.10

But if I do a DNS query of ad.newspaper.com it doesn’t get blocked by Pi-Hole even though it’s simply an alias (CNAME) for adcompany.com:

$ host ad.newspaper.com ad.newspaper.com is an alias for adcompany.com. adcompany.com has address 6.6.6.6

What I would like that Pi-hole do is to check if the domain is a CNAME (in the example ad.newspaper.com) then comparing the domain that is aliased to (in the example adcompany.com) with my blacklist. If it is in my blacklist block the domain (by returning the IP of my Pi-hole).

Source: https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cn...

One of a trick a website operator can use to evade hostname-based adblockers is by putting the ad-serving domain as a cname entry in one of their subdomain. Since the ad now served from a subdomain of their website, it won't get blocked unless the dns adblocker did deep inspection on nested cname entries.

It was really easy to set-up, but on first day it actually broke an Android TV-app on default settings (meaning it blocked some call that stopped the app from loading through).

Ironically, after disabling it for a minute and then loading through the app, it didn't block the video ads (not rendered into the video).

YMMV of course, but it wasn't usable for me since everyone in the household needs to understand/solve any issues.

Which to me is a good thing - smart TV's are garbage. Dumb TV + AppleTV will do just fine.

My TV is not on the internet. I have an Nvidia Shield, Android TV is the name of the OS.

I guess, but Dumb TV + Roku can be quite terrible from a privacy perspective.

Logging messages sent by Roku comprise the 2nd largest blocked domain on my pihole. But - they are blocked.

In any case, I don't see that a smart TV is going to be any better in this respect.

Reply on news.ycombinator.com