Hacker News Reader

Comment by janwillemb | Hacker News Reader

Good that the root cause is being addressed. In the meantime, I'll be reducing the symptoms by routing all my DNS traffic through my pi.hole instance.

View on HN

I wouldn't be surprised if these mentioned apps comes with google's dns resolvers baked in, in that case routing through pihole doesn't help here.

Afaik, some apps like Netflix that rely on geo-blocking for their content licensing do it already and it's only a matter of time until they switch to DNS over HTTP so requests cannot be altered at all.

That's just going to break functionality on many networks.

I set up a rule on my router to drop any DNS traffic and DoH traffic to well known DNS providers unless it comes from the server running pihole. Otherwise it was proving very hard to find out how to force applications / mobile devices to use my DNS server.

That only works as long as you can easily distinguish the DNS traffic from the rest, right?

For instance if my VideoApp serves content from videoapp.example.com and I use my own DNS also at videoapp.example.com, served over DoH, I think that's basically the end for host-based content blockers.

you could also just NAT port 52 to your pihole. (translating 8.8.8.8 ofcourse).

I don't know if this would work with DoH. (but DoH is terrible anyways)

There are block lists for DoH servers and other DNS queries can be forwarded to your own resolver.

How are you routing through your pihole when connected only to mobile broadband?

Wireguard. All traffic from my phone is routed thru a VPS hosted in Germany, where all traffic to 8.8.[84].[84] is blocked.

+1 for wireguard. I leave it on always. Only thing I have trouble with is Sonos, which does not even connect to the system even in my own network.

I believe the issue with Sonos and the VPN is making mDNS or multicast available across subnets.

I struggled with a similar issue with Spotify to play to networked devices from my device.

This may point you in the right direction...

https://en.community.sonos.com/advanced-setups-229000/yet-an...

If it’s actually a mDNS/multicast issue, you can run an mDNS proxy or similar to bridge the networks. I don’t have a Sonos setup to test with, but it works for other mDNS services.

My easy fix for that was to use Tasker to disable my Wireguard tunnel when on my home network and enable it again when I'm not. The official Wireguard app has Tasker integration, so you can use it to manage individual tunnels if you like.

I use open source app Nebulo[1] which is a localhost pseudo-VPN which reroutes all DNS to any DoH/DoT you want. It also has a request log, I was (not very) surprised when it came my default file manager connects to facespace when I don't have any account there.

The bad news is, GPS still turns on on its own and camera seem to click sometimes </tinfoil>

[1] https://play.google.com/store/apps/details?id=com.frostnerd....

A VPN should do the trick. A Raspberry Pi running PiHole Wireguard can be set up quite easily, with dozens of tutorials on the internet.

Assuming you know what to block, the connection would fail after the first DNS query thus saving you bandwidth and privacy.

As also mentioned by others, I'm connecting my devices via Wireguard to my home network. This is not always flawless.

VPN

But your phone is still connecting out to the internet and therefore using your data allowance.

But instead of loading an ad or sending telemetry, it will merely query DNS and then give up.

But it won't be able to download the ads, so only the dns query will go over the air.

If you're using Android: Blokada from f-droid is another option if you want to skip even that.

I think most people have basically unlimited data these days, and I'm sure nobody is worrying about the cost of a DNS request.

Most people I know don't have unlimited data. My plan, for example, gives me 10GB/month. In any case, DNS queries shouldn't be a problem for most users.

In my neck of the woods, "unlimited" means 10GB uncapped, with throttling to just about good ol' ADSL speeds after that.

Aren't smartphones starting to penetrate third world countries?

Yes. Is that relevant? Their data is often cheaper than ours!

Which 'ours' ?

Cheaper compared to the income & cost of life ? With the median world income being $30/month, I doubt so !

> With the median world income being $30/month, I doubt so !

First of all, this isn't even true - it's around $240/month.

https://news.gallup.com/poll/166211/worldwide-median-househo...

Second, people living in those countries aren't buying US data plans at US prices are they? You don't live in the Congo but shop for your data plan at a California strip-mall, do you?

Oh, right, I confused median with '1 dollar per day' extreme poverty line :

https://ourworldindata.org/extreme-poverty

Which should be around 5% these days.

> Second, people living in those countries aren't buying US data plans at US prices are they? You don't live in the Congo but shop for your data plan at a California strip-mall, do you?

Ok, so what are these prices ?

https://www.cellularabroad.com/packages-congo.html#tabs-2

That's $100/Go for 3G. (Which is still 10 times cheaper than my first data plan !) But I suspect that this website is directed to rich westerners, anyone from third world countries here that might shine a light on this issue ?

I pay 19.99 € for 10gb and unlimited G3 after (Germany). It varies wildly between countries.

I know some eastern nations that have 50gb G4 for 10-15€, which is about as much as you'd pay for 1 meal in a pretty cheap restaurant.

You consider Germany and eastern (Europe?) to be third world nations ??

do you force that as a DNS provider, block all other DNS options, including DNS over https? I use AdGuard but there are sooooo many ways around it.

Reply on news.ycombinator.com