Stuff a Pi-hole in your router because your browser is about to betray you
theregister.com
theregister.com
In the last 3 months, NextDNS has blocked nearly 9% of 10M DNS queries from devices in my household with no ill effects that I'm aware of. (I'm not affiliated with NextDNS in any way, other than as a satisfied paying customer.)
I still use uBlock origin, but like how NextDNS will block stuff from phones and other devices as well.
I have been using NextDNS for many years now, but I didn't get why I should use Tailscale.
Regardless they look like good alternative for users who are unable to setup or are prevented from using a pihole.
If someone wanted your internet traffic, they wouldn't bother with NextDNS. They would just compel your internet provider to give it to them.
This is not a real risk to using NextDNS.
As long as due process and checks and balances are respected, there's absolutely nothing to worry about lmfao.
But I'd love to hear your ideas.
NextDNS lets you choose where to store your logs, along with a retention time of 1 hour to 2 years. Logging can also be completely disabled.
The choices for log storage are (1) United States, (2) European Union, and (3) Switzerland.
Nextdns is great
These companies can easily be acquired by Big Tech. Nothing stops them from selling out and selling their customers out. This is a win for the DNS provider, a win for Big Tech and a loss for the internet user.
Google already collects fees from some people who are willing to pay in return for "no ads"; meanwhile Google still collects data on these people; it may be used to support ads shown elsewhere or for any purpose whatsoever. Paying does not stop the online ads problem. If anything it makes online ads even more attractive; they can be used to annoy people into paying fees. Some people will actually pay to have their data collected by an advertising company.
As far as I know, please correct if wrong,, Pi Hole is 100% non-commercial. It is basically a modified dnsmasq with default settings that forward queries to third party DNS providers that profit from ad services, like Google. If online advertising were to decrease or disappear, then Pi Hole is not threatened. Whereas a third party DNS service like NextDNS has a financial incentive to ensure that the online ads problem persists, as it creates their "market". The disapperance of online ads, for whatever reason, would be catastrophic for NextDNS.
I am not a Pi Hole user as I do nmot like dnsmasq. I use other DNS software and map DNS data collected in bulk from variety of sources into local forward proxy memory.
Adtech and the web are identifiable by mostly unique domains, but what if that could be hidden? What if the adtech industry builds and pushes a reverse proxy tech of sorts for page content inside the page where the web server goes and loads 3rd party content for the page render before sending it you? The theoretical result could make every request looks like it comes from the domain you requested and there's nothing to discriminate on when it comes to DNS requests.
Unrealistic? Today, maybe. Wait until DNS ad blocking goes mainstream, Manifestv2 addons are long since stamped out and Manifestv3 addons are proven to be gutted and defeated. If click-through rates are noticeably higher with some kind of anti-dnsblocking proxy, we'll probably see proxies everywhere. What we'd do then for ad-block is beyond me.
Filtering proxies on the other end. A lot of corporate networks already MITM all traffic so they can block, monitor, and rewrite; and ironically that has been much-maligned by those working for Big Browser, ostensibly for "security" reasons. Ditto for the DoH advocates.
I've been running a filtering proxy on my network since the turn of the century. This was somewhat common in the past, then waned as browsers started growing extension functionality (one wonders if growing, and then now heavily restricting, extensions was a way to discourage proxying) but I suspect it'll become more popular in the future too.
https://news.ycombinator.com/item?id=36824165
https://news.ycombinator.com/item?id=36832736
...and the fact that TLS fingerprinting is now a thing, and you'll be easily considered a "bot" by many sites if you MITM your own traffic, shows what their real intentions are.
I thought about wiring up a physical button which would send the "disable for N minutes command" before I realized I was playing with too much fire.
I have a button on my stream deck to enable/disable pihole but I totally understand that is an annoyance for others!
No! Stop using Chrome! There are other browsers you could (and should) use instead!
Pi-Hole 6 appeared a few weeks ago. Since then, there have been a few small bug fixes and it's now up to version 6.0.5.
The new release is lighter weight and has fewer external dependencies: it no longer needs PHP or an external web server. If you run the Docker container version on top of another Linux OS, it's lighter still, as the container is now based on Alpine Linux instead of Debian.
Is it really worth setting up a dedicated ad-blocker on your own network? We decided it was high time to try.
I've been running pihole at two locations for many years. It does a great job of blocking ads and scripts on all devices.
I customized one of my two locations and it stopped service DHCP on one of the two subnets after the update a few weeks ago. I reverted the update and it's been fine. (I keep good backups.) A friend who also runs it had the same problem and he provided me with his solution before I had a chance to look at it myself:
listeningMode = "ALL" ### CHANGED, default = "LOCAL"
As the article notes, Mozilla is telegraphing incoming targeted advertisements in Firefox. Everything else is a Chrome derivative and unless someone steps up to maintain Manifest V2 (which I've seen no evidence of so far), uBlock Origin will no longer function on them.
I would love to be able to rely on my browser to be a user agent that actually has my interests and only my interests at heart—I have hopes that maybe Orion can get there with a paid-for model. But in the meantime, most of the choices I can see are flawed in some way that justifies an extra layer of protection.
> Everything else is a Chrome derivative
Waterfox was sold 5 years ago to an ad company [0], and the developer's response on that thread was... not ideal. From what I understand they separated from them a few years later, but the developer's response to complaints about the sale ("I’ve never tried to have it as a privacy product specifically ... all the outrage towards me for that has been, at least towards me, a little unfair.") don't lead to a lot of confidence even under a new business model.
And this is suggestive of the problem I see in general with the smaller players: their bus factor is too small and the number of people who have to be involved in a bad decision is too low. Switching to a small fork like these ones doesn't mean I can stop worrying about what my browser might do, it just changes the types of things I have to worry about. I still need layers of protection just like I do with Firefox or Chrome.
Anyway -- your other point about bus factors is also fair, but I think it's made a bit moot by the big players (evidently, Mozilla included) making bad decisions in spite of (or because of?) their size.
Perhaps the future involves people being more lean about which browsers they're tied to, and making the jump more often. Guess we'll see.
True—I'm more counting on big players moving slowly and with lots of eyes on them. Mozilla's descent has been one that I've been following for years now, and I don't expect to be surprised by a sudden rug pull the way that a smaller player can do.
> I have hopes that maybe Orion can get there with a paid-for model
I'm using Midori for this purpose and it quite sucks a bit. I really hope a good alt browser jumps into the repos soon.
Yes stop using chrome as your daily driver.
Brave and opera were on a workstation I was cleaning up, so I flipped back and forth between them, but am going to do some deep dive on Monday.
Anyone using Puffin, Freenet or Vivaldi? I am going to spend a day with each next week on a slow system.
The one thing I was looking for as an alternative to Nightly, was it's speller, that was getting old. Then a week or so ago, it has become significantly better.
I’m personally sympathetic to the lack of diversity in rendering engines, which makes any Chromium browser a no-go in my case. (iOS sucks; Apple still requires all iOS browsers to use WebKit, as far as I know.) Fortunately, LibreWolf is still actively maintained.
The next thing they'll do is to claim that DNS over TLS (probably port 443 mind you) is mandatory.
On a side note, Safari's latest version seems to do this, and there's no way I can figure out how to disable the behavior.
Per usual, they'll claim is "for safety", but the real motive is to kneecap extremely useful tools like PiHole.
Of course, the escalation from the user side is likely to involve more firewalls and proxies.
> Bootnote: If any loyal Reg readers have built a Pi-hole allow-list to whitelist El Reg and its sister sites, do please let us know in the comments.
Classic Real Irony™ ? No.
a literary technique, originally used in Greek tragedy, by which the full significance of a character's words or actions is clear to the audience or reader although unknown to the character.uBlock Origin protects individual browser profiles only. That is, if you have uBlock Origin installed and it's enabled on a given browser profile, that specific usage is protected.
Yes, uBo gives far more power in blocking online content, where it's available. But it only goes so far.
With PiHole, one of the disadvantages is that when you use another network you lose all your ad / malware blocking protections. I find it jarring when I use a tool w/o any native ad-blocking on an outside network.
Best practice is to use both DNS-based blocking (for global coverage on your LAN) AND uBlock Origin for browser instances where it's available (desktop generally, Firefox/Android on mobile).
Now compare to the article: "chrome users are forced to use less capable UbO lite. Enter PiHole!"
So, basically, PiHole gives you all that you lose because of the Chrome dropping v2. I cannot read that in any other way.
uBo will block more than just source-based content (though it does include very extensive domain blocklists). It will also, for example, block YouTube ads (added by YT, but not sponsorship bits within the video itself), ads identified by CSS or JS syntax, and (if you choose to do so) other Web annoyances, for example sticky header/navigation bars if those are present and you've installed the appropriate additional blocklists.
PiHole can't do any of the latter, though again, it's far better than nothing, and covers more than just the browser. Example of the latter, one of the Android podcast apps I have inserts advertising, that happens to be caught (usually) by my DNS-based blackhole when I'm at home, but not when I'm travelling. It's jarring to see those ads should I fire up the app when I'm on the road.
Conversely, adding PiHole helps even if you manage to keep chrome with manifest v2 working!
Hard to tell from their site tbh, it is possible to pay but if they have free options I didn’t wade through enough product info to find them.