Hacker News Reader

Comment by przmk | Hacker News Reader

Except Pi-Hole has some serious limitations as it only acts as a DNS server.

I haven't been able to block Youtube ads on my tv for example.

The easiest way to avoid YouTube ads is to avoid using the YouTube website and its "Javascript player" to play videos. The Google Video download URLs to watch the video, without any ads, are right there in the hxxp://www.youtube.com/watch?v=xxxxxxx webpage. I use a tiny shell script of only 97 characters to extract them. The truth is, where YouTube ads are concerned, neither a modified dnsmasq plus RPi so-called "Pi-Hole" nor any browser extension "ad blocker" is required. No user needs to run Javascript to play videos just like no user needed to run Adobe Flash to play videos. Flash and Javascript are useful, maybe even essential, for tracking and advertising, but are unnecessary for playing video.

I would love to observe you browsing and consuming web content for a day. Sounds like this sort of thing would make it much more laborious. That being said.. could be a good thing for me to not spend so much time watching dumb YouTube videos, and reading "fun" articles.

Wikipedia hasn't been tainted like everything else. I can spend all night reading Wikipedia, and it's way more interesting than most content online. All they do is ask me for $3 every once in a while, and while I'm actually really poor... I still gave 'em $3 out of my cigarette money. I would've never had the confidence to go back to school if that resource wasn't there (or even had the realization that I love learning), but I also wouldnt wake up in the afternoon to see stuff in my browser history like "7:03 AM: Polar Bear Jail", so it's a trade-off. Beats YouTube, though

Linkified, for the other aficionados of ursus maritimus out there:

https://en.wikipedia.org/wiki/Polar_bear_jail

PS: You might enjoy Veritasium (a YouTuber).

Perhaps not aficionados... polar bear jail is a complicated solution to a polar bear problem. The ethics of their incarceration is left as an exercise to the reader

Yeah, I can bounce from one thing to another there just soaking up info for hours.

After all these years of doing that I finally visited the Wikipedia Home page a few weeks ago. I was quite surprised with all the stuff they have there that I had no idea about. That rabbit hole is a lot bigger than I knew about.

My dad's house is on Wikipedia, and we didn't find out until half a decade after he'd bought it. Reason being it's on the historical register, nothing spooky. But, boy, was I jazzed to see a picture of the house I was sitting in with a little map under it on Wikipedia. I felt so documented.

I remember reading that by following hyperlinks in Wikipedia articles, all Wikipedia pages can be indirectly linked back to the page for "Psychology".

>Wikipedia hasn't been tainted like everything else.

The illusion of purity allows corruption to thrive. There are influence teams hired by VIPs who use Wikipedia as simply an extension of cable news/social media. To "get out in front of stories", or if they're late to the game, to scrub/"memoryhole" undesired ones. Wikipedia editing as an amusing hobby for niche nerds is an outdated concept for many topics.

Wikipedia is far too powerful a Persuasion tool to let fail. Its essay-long donation plea's are designed to garner credibility towards innocence. How nefarious could the site be? They're scrounging around for scraps each year!

I think it's understood that controversial topics and current events on Wikipedia are subject to manipulation. But I don't think TPTB are committing payroll to influence my opinion of "Ben Franklin" or "Norwegian Forest cat" or "semipermeable membrane".

It is a predominantly text-only experience. I almost never consume articles from a graphical browser; I do not require images in order to read. With YouTube, either I am downloading videos that others point out by sharing a URL, or I am searching for videos on YouTube from the command line, then downloading. I get no real benefit from using a graphical browser to interact with YouTube, although I am sure Google's online advertising services business gets many benefits.

>>The easiest way to avoid YouTube ads

I found the actual easiest way to avoid YouTube ads, and maintain support for content providers whose services I enjoy, is to get a Premium subscription. ¯\_(ツ)_/¯

The only way that works as a "business" is if Google also sells online advertising services. Nevertheless, the company must sell online advertising services as a business model in order to survive. This makes it arguable that the company is actively working against users supporting content providers by paying ("supporting") them directly. Google functions as a middleman selling online advertising services. It pays content providers a cut from the ad revenue, not from relatively small fees collected from a relatively small number of users who want pay an advertising company not to bother them. Depending on how much hazard risk one assigns to online advertising and the destruction of privacy by monopolistic actors that are seemingly immune from legal regulation and able to operate outside the law, this could be seen as some sort of "protection money". https://en.wikipedia.org/wiki/Protection_racket

Ideally signing up via India. Fortunately, I got an Indian wife with a local payment method and a VPN. Now I am paying roughly 90 euro cents per month for a student subscription, as both discounts can be combined ;)

>"I use a tiny shell script of only 97 characters to extract them."

Would you mind sharing the script?

For something like Firefox, pulling them out of exported bookmarks is as simple as:-

grep "https://www.youtube.com/watch?v=" /tmp/bookmarks.html | cut -b22-64

Why not just use https://youtube-dl.org/

Typo. 997 characters according to wc -c.

You can set your router with a firewall NAT rule to capture all DNS requests and redirect them to use Pi-Hole. Your tv will think it talks to 8.8.8.8 when in reality it will talk to your server.

doesn't stop dns over https, which stuff like chromecast employs

And that's why DNS over HTTPS was created in the first place, to get rid of ad blocking on Chromecast and Android.

On Android now Proxies don't apply anymore to apps like YouTube, and as these apps also use DoH, there's no way to block ads anymore.

All talk of "security" and "privacy" is false, as always it was all about profit. I honestly wonder if the people at Google working on DoH even knew why management supported their project, or if they genuinely believed they did something good while management secretly realised the potential profits from DoH

Well, it's not like they were forced to do name resolution over DNS before... They could just as well deploy their own custom name resolvers and talk to them via IP from applications like YouTube for Android.

The scenario you're describing (DNS-level blocks) could always be circumvented.

On the other hand, if you live in the US and don't override the ISP's name servers, most probably they will spy on you and sometimes even do things like injecting ads into third party websites. This was the thing DoH was meant to solve.

> They could just as well deploy their own custom name resolvers and talk to them via IP from applications like YouTube for Android.

The Chromecast has 8.8.8.8 hardcoded, but recently an ISP started integrating ad-blocking via DNS filtering (with 8.8.8.8 MitM) in their ISP routers. That case actually went to court.

It'll always be possible to do the filtering as prosumer, but the current state of the art of "it just works" ad blockers is something Google is fighting against (also see Manifest v3)

Your response to the first scenario didn’t invalidate it - Google could have made a https://dns.google.com endpoint in 2013 before DOH and only allowed the Chromecast to work if it could get dns responses from there.

Yeah but that would require developers intentionally building an anti-adblock solution, while funding a solution like DoH allows Google to save face

What percentage of Google's users do you think have a pi hole? I buy that their changes to ad blockers in Chromium are motivated by this kind of logic, since they are used by a material number of people. But for DoH it just doesn't add up, it's such a fringe case. It's also worth noting that DoH was spearheaded by Mozilla, Google just got on the ship at the next port.

Not every thing that big corporations say they do for security reasons or whatever is a cynical ploy. Do you think they're experimenting with post quantum cryptography in Chrome Canary in preparation to drop a 50k qubit quantum computer on the market sometime soon?

Some ISPs started integrating pi-hole functionality into their ISP routers, and that actually went to court.

On Android, some of the most popular apps are fake-VPNs which just register your own device as VPN with itself so they can filter ads.

This isn't about the pi-hole, this is about ad blocking becoming "too easy". You can always block DoH. But no ISP can include such a blocker by default easily anymore.

Wait, how do you block DoH without blocking other HTTPS traffic?

Do you have to block every known DoH server? Looking at Google's DoH certificate they list quite a few hostnames and IPs as Subject Alt Names:

    dns.google
    *.dns.google.com
    8888.google
    dns.google.com
    dns64.dns.google
    2001:4860:4860::64
    2001:4860:4860::6464
    2001:4860:4860::8844
    2001:4860:4860::8888
    8.8.4.4
    8.8.8.8

Issued by Google Trust Services...

Google is digging as many moats as they can without triggering antitrust scrutiny. They have to plan for the future, not the here and now.

One could redirect any traffic destined for the IP of the DOH server to one's own DOH server on localhost.

Unlike DNS over TLS, and plain old DNS, the only way to 'redirect any traffic' is to have a blocklist of known DoH hosts, since it's just HTTPS, port 443, traffic, you can't tell if it's your page load or a DNS query.

As of today, how many DOH servers are running from IP addresses also used for serving websites. In the testing I have done with publicly advertised DOH servers, generally, the IPs are only used for DoH (sometimes DoT, too). Of course this could change.

The localhost forward proxy I use can distinguish DoH requests from other HTTP requests because the DoH query URL structures used are mostly the same; they follow RFC8484. As of today, it is easy to probe IP addresses for listening DoH servers. The list of "known DoH hosts" is still quite small. Of course this could change.

To be clear, I am defintely not a proponent of applications ignoring user system-wide DNS settings and using DoH to obscure that fact. I have long run localhost root and DNS for myself and have no need for third party DNS, whether ISP or open resolvers.

However, as an end user I see no reason to trust any outgoing HTTPS traffic from applications authored by folks who are agreeable to online advertising as a business model.

The greatest threat I face is online advertising, not DNS lookups associated with malware. With DoH, HTTPS traffic could contain an unwanted DNS request, but prior to DoH it could also contain data to be used for tracking and advertising purposes. I felt the need to start monitoring/MITM'ing the HTTPS traffic on the private networks I control long before anyone proposed DoH. I would guess many corporations and other organisations do the same.

Not if the resolver is validating the tls certificate. That's the point of doh, make impossible to intercept dns query.

MitM is not possible with DOH if the client checks for a valid certificate.

If you use android TV, you can install https://github.com/yuliskov/SmartTubeNext

that does not support casting as far as I have tried unfortunately.

No app can accept casts.

When your are using Google Cast, you don't stream from your device to the TV/Chromecast. Your device sends a package containing the app name you want to open and some basic configuration data and then the TV/Chromecast downloads a web app from Google's severs and opens it with the configuration you provided. Then your device can interact with it.

There's another solution to avoid ads that people seem to skip : get yourself a youtube premium membership. You can spread the cost across your family, and you'll stop playing cat and mouse (at least on youtube)

Note that I'm not against ad blocking in general, but if you use a website a lot, it seems fair to me to remunerate it one way or another, and at least paying for membership is not a business model based on selling your data.

But it costs you, and they still collect your data and will sell it for ads elsewhere.

Ublock on PC, youtube vanced on android!

Not a stretch to assume the data on one who pays for Youtube Premium is more desired than one who does not. 'Whales' to use a term in the mobile gaming market.

Short of installing a third-party application like smartyoutube or vanced, you are not going to be successful in blocking YouTube ads. YouTube caught up with dns filtering ad-blockers and started placing their ads in the same domain as the video content.

Ublock Origin seems to be working for me. I don't use YouTube that often, but I've never seen an add that I can remember.

Edit: I guess maybe you're just talking about on a smart TV.

ublock origin can do url based filtering, which can't be done via something like pihole where it's only at the dns level.

Thanks for the clarification. I've been using UBO for a long time and sort of take it for granted. It's pretty amazing how thorough it is. The school system I work for pushes out Addblock to all of their Chrome devices, and it doesn't even come close.

This is the one hole I haven't been able to fill. Between guilt about not contributing to people's channels which I genuinely enjoy and the ads on the tv, I commited to buying premium next year.

Seems like you would need a pi-hole alternative that acts like a proxy. I imagine there is something like that out there, just not familiar with the choices.

There is privoxy - https://www.privoxy.org/

However, as most sites are https nowdays, privoxy is effectively limited to just blocking domains, making it pretty similar to pihole ...

Yeah would need a proper MITM setup to deal with the https

Some routers allow you to change the DNS server. If you have or buy a configurable router, it should work.

Or disable builtin DHCP for that matter...

Why not pay for premium?

youtube-dl for that

Reply on news.ycombinator.com