Hacker News Reader

Comment by e2le | Hacker News Reader

Is the Pi-Hole even reasonably effective these days?

> Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely.

https://labzilla.io/blog/force-dns-pihole

View on HN

You can create port forward firewall rules to redirect any outbound DNS port 53 traffic. This will not work for DNS over HTTPS, which is going to be increasingly common for IoT I'd imagine.

edit: method for this on pfSense: https://docs.netgate.com/pfsense/en/latest/recipes/dns-redir...

Then you have to contend with DNS over HTTP, Thanks Firefox and Google....

DNS over HTTP has got to be the most ill thought out "privacy" feature that has done more to HARM privacy then it could ever help

> the most ill thought out "privacy" feature

Whose privacy? DoH helps to protect billions in revenue for the ad network that funds Chrome, Firefox, Safari and web standards.

A better web will need a different revenue model.

In the meantime, here's a maintained guide to blocking DoH with pfsense, https://github.com/jpgpi250/piholemanual/blob/master/doc/Blo...

Many of the biggest ISPs in the US are actively monitoring DNS queries, collecting the data of which sites you visit, and packaging it for sale to ad networks and data brokers. DoH stops that.

It really doesn't, as server name indication is sent in clear text. As encrypted SNI didnt take off, you dont actually get privacy benefits from DoH and friends, just security/mild inconvenience to censors.

> encrypted SNI didnt take off

Says who? I think your data is very old considering that ECH replaced ESNI 2 years ago. IIRC it has ~50% adoption, same as TLS 1.3. Just about every company that cares about security supported ECH for years.

Moreover, someone has to move first. If DoH wasn’t widely deployed you’d be complaining that ECH is useless because DNS is unencrypted.

Yes and it is better that google and cloudflare do that collecting under the guise of protection...

People really are gulible aren't they...

DoH is a not or a privacy feature. It simply changes who is collecting your data and makes it harder for responsibile network operators to protect their users under the guise that the big tech companies are really protecting the users from the network operators and "big bad ISPs".

Ironic given the billions big tech is making from that data.

Google and Cloudflare don’t sell data on dns queries per their privacy policies. Verizon does.

I see this common response, but that is not really a valid rebuttable. Companies do not need to sell your data to violate your privacy, in the case of google their entire model is selling their TARGETING, not the data. That is still a violation of privacy. The fact they did not "sell" it to a 3rd party to form the customer profile changes little.

In the case of cloudflare, it is going to be interesting how they continue to justify the free public services to institutional investors now that they are public. I have a feeling there is going to be some strong pressure to either cease the free services, or find away to monetize them which likely will involve some kind of usage of that data maybe not selling per say, but some other kind of targeting or something to add to the profitability of the company.

I am no more comfortable with cloudflare having my data than I am with google or verizion, I have never used any of their DNS services

Google doesn't sell targeting based on DNS queries.

> I am no more comfortable with cloudflare having my data than I am with google or verizion, I have never used any of their DNS services

It's not either/or. If you use Cloudflare or Google DNS and it isn't encrypted then Verizon has it too. With DoH they don't.

That's a stretch given the context. A smart TV maker can put whatever they want in their own client software. They don't care what features Firefox and Google support.

Smart TV retail prices are subsidized by revenue from data analytics on content search and viewing.

Web browsers are subsidized (free) by search (ad) revenue.

I would rather pay more for a TV than have it subsidized by ads. Or even better, a TV with no smart features, then I can just connect a computer for whatever smarts I want.

That is what I always do, HDMI is great for that.

Who do you think was pushing for the DNS-over-HTTPS standard?

   Authors' Addresses

   Paul Hoffman
   ICANN

   Email: paul.hoffman@icann.org


   Patrick McManus
   Mozilla

   Email: mcmanus@ducksong.com

* https://datatracker.ietf.org/doc/html/rfc8484

If DoH didn’t exist, a device manufacturer could trivially reinvent something equivalent. DoH isn’t the problem.

They could also do that with out DoH, they dont because it is not "trivial" and prone to all kinds of downsides.

DoH is the problem here, as it hides things from network operators making it harder to block ads, spam, and other items at the network level under the guise of privacy, when in reality DoH's actual goal is to further centralize the internet into approved gate keepers like CloudFlare and Google.

You could try this for DoH blocking. It probably needs help staying updated.

https://codeberg.org/unixsheikh/dohblockbuster https://openbsdrouterguide.net/#blocking-doh

Yes; PiHoles are used for far more than just blocking smart TVs. The difference between browsing the web at my house and browsing away from home is so stark that it's almost not worth browsing most sites if I'm not behind it.

So true. At about one week per year spent at a relative's home, I start to consider putting a pi-hole there, too.

I did what i think is the logical extreme and put a pihole on my tailscale network and use that as my dns on any device connected to that network so i have it on the go

Ooh, I will be all over that if the fiber rollout in my neighborhood ever finishes.

I run a simple VPN at my house alongside pinhole. You can block ads anywhere that way.

I do the same. The same pi runs a wireguard server.

I've been strongly considering it precisely because of this, just need to get around to setting it up.

that is what I am connected to right now. it's amazing how much more lightweight the internet is in general with pi-hole/etc.

Yep, took me about 5 minutes to set up with tailscale https://tailscale.com/kb/1114/pi-hole/ (wireguard)

Curious why you're not using Firefox + uBlock Origin. It does CNAME lookups.

I block my TV’s MAC at the router. I use a roku for the streaming apps, which doesn’t seem to hardcode it’s DNS yet. But when it does you can just write some iptables rules. When they switch to dns over https, well I don’t know then haha.

Sounds like we also need a list of IPs to null route

The workaround is already in use for ad hosting - serve all the content from one domain (or an IP) with services natted behind that, so if you block it, nothing works.

The ideal solution is custom clients for every service. Why use their proprietary software? We should make our own software we can use to connect to their servers. That way we can make it do whatever we want.

You two are talking about different problems.

In that case we need to proxy, but only the wanted requests.

Though in the case of a smart TV, you would want to block everything except for whichever streaming services you're subscribed to.

It probably depends on your use patterns. I have a console and a TV in my apartment, but I spend much more time on personal computers than I do on either. My Pi-hole instance is still reasonably effective for that, and I'm sure I could (eventually) be motivated to do the workaround described in the post you linked.

You can DNAT those requests at the router over to a Pi-Hole, unless they’ve upgraded to DoH

I've setup firewall rules to redirect traffic from some devices to avoid that, but some are starting to use dns over https which is more difficult to deal with

pass in on $int_if proto { udp, tcp } from any to any port domain rdr-to [pihole_ip] port domain

Reply on news.ycombinator.com