Hacker News Reader

Comment by ethbr0 | Hacker News Reader

Seems like a good place to ask... do people run explicit firewalls for their Roku devices?

Realize it's cat and mouse with an updatable controlled platform's data exfiltration, but curious if there are any low-maintenance solutions to do some good?

Agree that Rokus are a great solution, but I'm uncomfortable with a one-time-purchase device's long-term revenue priorities.

View on HN

I have a few Roku devices around. All my IoT devices are relegated to a segmented VLAN. Beyond that DNS is locked down. I block all of the DoH/DoT providers that are commonly used and then run specific DNS block lists for manufacturers. I also leverage NextDNS [0] as it easily allows me to build profiles per use case. I know they also have Roku specific DNS blocking (for telemetry, ads, etc). I had used PiHole in the past but like that I can use NextDNS everywhere all the time much more easily than I can with PiHole. It also provides overrides so I can still resolve internal addresses where I might want to. This helps when using things like Tailscale and not having to rely on another subdomain to think about.

[0] https://www.nextdns.io

Apple TV or your own Kodi box is probably the best in that category. I used to use Apple TV and leave the Smart TV itself off the internet. The family wanted tighter google integration so that eventually went away.

Also remember that if you’re using cloud TV services, you’re just moving the data aggregation/ad network integrations/resale to that service.

I currently use ControlD to adblock my whole network: https://controld.com/ I constantly see Roku ads being blocked every 2 seconds.

Additionally, Roku allows users to disable ads in a secret settings menu: https://lifehacker.com/those-roku-ads-are-just-a-setting-act.... These instructions have worked for me twice in the last week.

One of my TVs has a Roku; I have them plugged into a powerstrip with control/switched outlets, so that power to the Roku gets cut when the TV is turned off.

Reply on news.ycombinator.com