Hacker News Reader

Hacker News

Comment by whalesalad | Hacker News Reader

Full thread

whalesalad

I shove my entire home network's DNS thru pihole, cannot imagine life without it.

View on HN

I did too until it broke all of my wife's online shopping. Happy wife, happy life.

With recent piholes you can now ignore specific devices! This what I do for my partner.

Thanks for the hint.

From a practical point of view, the only thing it broke was Ad sponsored results on Google, so I had to teach my wife to go for the normal results, or search directly on Amazon or Wayfair or wherever. What broke for your wife's online shopping?

Several sites shes uses load images from a CDN, she would get to a page that should be full of pictures and those pictures would be missing.

You're not alone. I took out my partner's online calendar by mistake with a PiHole. I think I blocked all her productivity SaaS tools too. Found out in under 5 minutes.

My dad had an outdoorsy distribution list that shoved all links through an ad domain, like straight up as if it was clicked on a site. He was able to copy and paste the text just fine...

I recently transitioned to the phrase "happy spouse, happy house." We all deserve to be happy.

My next firewall will have some kind of machine/port/etc filtering that allows me to whitelist where say my tv/etc can communicate. Even if I have to write it myself because i'm not aware of anything 1/2 as user friendly as the 3rd party "Windows X Firewall control" applet that works on a network level. Yes my current firewall can do this, but it requires me hand entering ip/port/etc combinations in a UI that is terrible.

So, while I use an adblock list with my unbound caching DNS server, it only works with devices which honor the local network DNS settings, which are becoming fewer and fewer thanks to the efforts of the major players to _HELP_ everyone with DOH. A protocol without an easy way to MITM/filter the requests even when the user wants it.

To be fair though, being able to MITM the DNS is kind of a massive security hole. One you are abusing in a productive way but one that many others abuse in very non-productive ways.

I don’t think that is fair at all. It is architecturally appropriate for every site to run DNS resolvers and most of them do outside of the residential space. This isn’t a man in the middle attack and selectively blocking queries according to local preferences doesn’t make it one.

When my ISP decides to replace DNS traffic I call it a MiTM. I happen to be technical enough to fix it. Many of my friends are not.

> So, while I use an adblock list with my unbound caching DNS server, it only works with devices which honor the local network DNS settings...

I co-develop a FOSS DNS + Firewall for Android that prevents apps from doing their own DNS over HTTPS / TLS / QUIC by blocking all connections to IPs that the DNS client (embed within the firewall) hasn't resolved itself or the TTL of whatever answer it once resolved has expired. Something similar to this could and should be implemented by other firewalls, too. The result of such a blanket setting is devastating though, as some apps (like Telegram) refuse to do plain-old DNS and hence refuse to connect at all (so, one may have to selectively allowlist certain IPs / apps). This also has a happy side-effect (or annoying side-effect, depending on how one looks at it) of breaking apps connecting to static IP endpoints (ex: Orbot connecting to Tor bridges).

what is the name of the application?

You would find it here: https://rethinkdns.com/downloads

Same. I even have wireguard set up on my phone so my phone's internet connection is pihole-enabled wherever I am

Is there anyway to extend this to a chomecast so Youtube ads are blocked ?

YouTube ads cannot be blocked at the DNS level.

Dang. Any way to do so via a chromecast ?

You could pay for YouTube Premium

I don't feel like rewarding a company for grabbing a monopoly on short form streaming video then making their service borderline unwatchable through aggressive, increasingly unskippable ads.

Plus (getting back to the topic at hand), having adblock for all your devices is so ... pleasant. You forgot how jarring and upsetting (and LOUD) advertisements are. Having them puncture your DNS adblock while using Chromecast is like getting a wet slap in the face.

I just tried googling "mitmproxy chromecast" and found a bit of a rabbithole of hacks and tweaks that can be done to Chromecasts to alter their behavior in ways they were definitely not intended for :)

I expect there are probably umpteen different ways to block ads with a little digging, although I can't vouch for any as I don't have a Chromecast (or TV) myself.

FWIW, a while back I reached my eye-twitch limit with Raid: Shadow Legends (deeply impressioning irritating ads: ...why...?), and so I stared at YouTube's load process to try and figure out if I could viably block everything.

The technique I ended up using exploited the fact I was running within a Chrome extension and overloaded JSON.parse (lmao), and was specific to the HTML delivered for desktop, but has worked for months.

I reckon it's quite possible the data sent to Chromecasts is similar enough that you could viably block it by MITMing the device then rewriting the JSON (or possibly gRPC) responses being sent to it.

Using YouTube Vanced on a no-name Android TV stick might be an alternative. (Untested but should presumably/theoretically work.)

I already run my own DNS server; is there some way to fetch the pihole DNS blacklist so I can use it myself? A brief look at their github account didn't turn up anything that looked obviously like "this is the blacklist repo".

I go network -> bind -> root so I get pihole blocking and my local dns

Pihole just includes some well known lists.. and what they've included by default has changed over time.

I think it's currently this:

https://raw.githubusercontent.com/StevenBlack/hosts/master/h...

If you are running bind you can use my python script to aggregate various block lists into a zone file: https://github.com/Trellmor/bind-adblock

It used to be easy to do this, I used to download the list to my Ubiquiti router and massage it slightly to work with dnsmasq. More recent releases of pihole include regular expressions as part of the list specification so you can't flatten the list easily any more.

"I already run my own DNS server ..."

I run my own resolver (unbound) that I point all of my networks/devices to.

That resolver has, as its upstream, my nextdns.io account address. nextdns has the pihole/ublock lists built-in.

So you get to run your own DNS server, you don't have to implement any of the blocking yourself, and you just point your upstream to the address you get when you sign up.

I'm quite happy with this setup ...

DNS + MITM proxy is what I use. When I'm away from home I still VPN back in and go through the proxy. Besides adblocking, it also applies various page filters to make a few frequently-used sites more usable.

I found it enlightening with the amount of data an xbox sends home

It's enlightening when you see all the crap that all the devices on your network are doing. You can take things a step further and isolate IOT devices on isolated subnets, with additional firewall/security rules to create a choke point for all traffic.

Only a matter of time before applications begin to roll their own encrypted forms of DNS in order to circumvent ad blockers.

You mean like DOH? which is quickly becoming ubiquitous.

I expect they mean bypass your networks DNS completely and use hard coded ip's or a hard coded DNS (with some way to obscure it).

DNS filtering and blocking is a very powerful tool great for bypassing many features/pitfalls of the internet.

If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers.

I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS).

The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it.

[1]: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

DOH is one way to do it. HTTPS is a secure channel.

That's why I had to start MITMing all of my HTTPS connections.

That's when the apps start embedding(pinning) certificates and completely ignoring any additional root certs you might want them to accept from the OS.

That's when you start injecting your own certificate into the certificate verification APIs... one of the amazing powers you get when you're root and actually have full control of your device, no wonder it scares big (ad)tech for users to have that power.

I think this is the biggest piece that gets overlooked by many. I still remember the first time I ran pihole and saw all the stuff attempted and blocked. It is one thing to know all those connections are made in theory. It is so radicalizing to see it first hand on your home network.

Just check my pihole there and curry 44.7% of the requests were blocked.

I've seen it as high as 73%.

Seeing how frequently the Xbox phoned home even when it was “off” prompted me to switch the settings from “instant on” to “power save” mode.

My xbox turns itself on all the time entirely randomly. Most mornings its already turned on. I will be in the next room and hear the startup beep go off. I don't know if its a faulty switch or maybe I should put on a tinfoil hat.

This and I combo it with restricting DNS lookups to the actual LAN servers. No way to bypass the DNS at that point via the firewall.

> This and I combo it with restricting DNS lookups to the actual LAN servers.

This won't prevent OPs concern with apps doing DNS over HTTPS, would it?

> No way to bypass the DNS at that point via the firewall.

Some apps do not even do DNS and connect to static IPv4s and IPv6s straight-away. Even if IPv4 is limited, plenty IPv6 to go around than an ip-table can handle.

Are there filter lists or something similar to what adblock extensions are using?

Reply on news.ycombinator.com