Pi-Hole: Why You Need a Network-Wide Ad-Blocker

https://blog.cryptoaustralia.org.au/2018/08/06/why-you-need-network-wide-ad-blocker-pi-hole/

by gszathmari • 8 years ago

337 288 8 years ago

blog.cryptoaustralia.org.au

adrianN• 8 years ago

I like the idea of running a Pi-hole, but my crappy ISP provided router is unreliable enough as it is, I don't really want to add a second layer of software that can break. So I'll just stick with UBlock.

Fnoord5• 8 years ago

I can recommend to buy your own router instead (e.g. Turris Omnia/Mox or Ubiquiti EdgeRouter series) and put your provider's in bridge mode. If you're from the EU, you might be able to compel your ISP to do just that.

dingaling• 8 years ago

I also prefer a blocking list and blocker on each terminal device rather than central on the network. It is unpleasant otherwise to open one's laptop at the library or at a friend's house and be bombarded by ads.

mnw21cam2• 8 years ago

This is the single greatest argument against getting a Pi-hole.

schappim• 8 years ago

The install process is curling a script into bash:

    curl -sSL https://install.pi-hole.net | bash

:-)

daef• 8 years ago

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

smittywerben• 8 years ago

Curl bash is fine [0]. Even Windows tools do this now [1].

That said, if you're a linux admin you shouldn't copy-paste r̼̯ḁ͙̬̕n̪͍̯d̳̦͓̜͉͜o̴̳m̳͚ ̡̭s̜̦̣̠̀h͓̲i̼̫̮̗̜t̜̗̜̪̬̲͟ anyways.

[0] https://brew.sh/

[1] https://chocolatey.org/install#installing-chocolatey

bigiain2• 8 years ago

They do at least call it out in the writeup as being poor form. But they don't explain why or offer any alternative...

steevdave• 8 years ago

Maybe they added it after you read it, but when I read the post they specifically mention it's bad and provide a link to read more on why it's bad.

Sure an alternative would be great but the point of the article is to get up and running with the pi-hole software so they went with the fastest install.

WaLLy3K2• 8 years ago

What we need is for the blog to explain things as nicely as the GitHub repo does - unfortunately, it's a topic that's a bit hard to concisely explain in one line.

Repo explanation: https://github.com/pi-hole/pi-hole#one-step-automated-instal...

pbhjpbhj5• 8 years ago

If by they you mean the pi-hole website then I recall being told I could download it and run the download if I didn't want to pipe curl to bash.

ziftface4• 8 years ago

They do have an official docker image, that's a pretty good alternative in my opinion.

Tomte8• 8 years ago

Who cares? Do you unpack your deb archives and look through them, in case the packager snuck something in?

klodolph7• 8 years ago

Where the hell did this argument come from? “If you don’t personally inspect your .deb you might as well be piping curl | sh?”

You can sign a .deb, there’s a whole infrastructure around distributing PGP keys for repos, and plenty of us do examine .deb file from strange places before installing them (like ok, this package runs a service but with appropriately restricted privileges, or that package just has data in it, and yes, some of us examine the source). And when someone distributes a bad .deb we have the ability to put together the package and its signature to get basically a smoking gun that person X is compromised and their key should be revoked immediately. The thing is, with a .deb you don't actually have to detect everything ahead of time you can archive the .deb and figure out what happened after you get pwned.

With curl | sh it’s basically impossible. There's no signature, just a bit of TLS at best which is gone to the ether. You can't sign curl | sh and there are some pretty nice attacks which you can use to thwart people who try to read the script sent from the server. I've seen reports of spear phishing attacks sent to otherwise sophisticated developers that use curl | sh as their vector... because curl | sh is fucking perfect for spear phishing. A .deb... is not.

andreareina• 8 years ago

The problem is that curl|bash isn't authenticated, I don't really know whether the executable I'm getting was really built by the maintainer or if a malicious attacker was able to sneak in and replace it (like what happened with eslint a few weeks ago[1]). Passing off a signed package (as .debs are) as genuine requires getting a hold of the signing key as well, which increases the difficulty of the compromise.

[1]https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...

pbhjpbhj5• 8 years ago

Um, sometimes; but I'm conscious it would be pretty easy to sneak something below my radar ...

I do check for usage figures, project involvement, apparent real name usage and such when considering random apt repos (PPAs).

raverbashing• 8 years ago

Seems like RPi needs a trusted package manager solution

boomlinde3• 8 years ago

It already has a bunch, depending on which OS you are running.

majewsky• 8 years ago

That's like saying the 2018 Lenovo X1 Carbon needs its own trusted package manager.

geerlingguy2• 8 years ago

I’m not sure why Pi Hole doesn’t even maintain a Raspbian apt repo; I’m guessing at least 95% of users use it since it’s the ‘default’ OS for the Pi. Failing that, Debian itself.

phito• 8 years ago

I tried pihole once, but it made my whole network incredibly slow...

Also I can't setup the DNS on my router :(

fyfy18• 8 years ago

I like the idea of Pi-hole but I had the same thing, even though I was running it on a VM much more powerful than a Raspberry Pi.

la_oveja• 8 years ago

why is it based on the raspberry when it has so terrible network interface? literally a +6 year board with a cual core and a gigabit interface can do this for better.

dev_dull• 8 years ago

It’s just resolving dns queries. What types of resources do you think it needs?

Also, newest revision of rpi (model 3 b+) is quad core 1.4ghz with gigabit lan. Overkill for a project like this.

Jaruzel3• 8 years ago

with gigabit lan

Although, tests have shown it's not really gigabit in speed, but it is faster than the old 100mbit NICs previous Pis.

hrktb• 8 years ago

mostly nitpicking, but it's not gigabit lan; the interface is limited by internal bus to 300Mbs

It doesn't matter if you dedicate it to this single use, you'll see more lag if it's also doing file serving stuff in the background for instance (also because of CPU use, not just networking)

corobo• 8 years ago

I have it running on an Ubuntu virtual machine on my NAS. You can probably run it on whatever 6 year old board you like

https://discourse.pi-hole.net/t/hardware-software-requiremen...

TeMPOraL• 8 years ago

Because everyone and their dog has two of those boards gathering dust in a drawer, in hopes of being used for some project one day.

epiecs• 8 years ago

Because the pi-hole is a dns server. So it doesn't need to filter all traffic. It just replies to dns requests. And you need a LOT of traffic to completely saturate a 100Mbit link with dns requests :)

erikbye3• 8 years ago

You can run it on whatever hardware you like.

comprev• 8 years ago

I've been running Pi-Hole for a while now installed on the same RPi as XBMC.

Occasionally I bump into false-positives and PH blocks legit websites.

guu• 8 years ago

I had issues with Pi-Hole slowing down page loads significantly until they introduced NXDOMAIN and NULL blocking as an option.

These features made it to the stable build this week so it might be worth trying again for those who had issues in the past.

moviuro• 8 years ago

I do it differently on my own DNS ad blocker: it returns the IP of my "happy" webserver that always returns `204 No Content`, whatever query you send to it. Of course, there's still the issue of https failing, but I've never had any performance issues - much more the opposite actually.

I wrote a tiny bit about how I do it: https://try.popho.be/byeads.html

Jaruzel3• 8 years ago

My experience with Pi-Hole is that there are too many sites that detect that their adverts and tracking scripts don't load and refuse to let you in. It's really hard to white-list for a site in Pi-Hole, as it's blocking for the whole network, so finding what domains you need to unblock is quite laborious. Additionally, if you are not around, and a family member or co-worker can't get to a site then they have no way to bypass it unless they also know how Pi-Hole works.

Personally, I find a browser based advert/tracking blocker add-on to work better.

If Pi-Hole had a webpage where you could put in a domain, i.e. cnbc.com, and it went off and loaded the html of that page, worked out all the other domains that html connects to, and then gives you a 'unblock' button to click, that would improve usability significantly, as even a non-techie user could use it.

Sol-• 8 years ago

I would have the same concern, I imagine the Pi-Hole is best for households only inhabited by tech-affine people. I installed the uBlock Origin addon for some family members and even there they can be easily confused when a website breaks due to it (occurs rarely, but it happens). At least there I can easily tell them to temporarily disable ad-blocking by pressing that big uBlock button.

I don't think it would be feasible for me to explain to them how to temporarily whitelist things on the Pi-Hole.

starquake• 8 years ago

You can add a button to your Raspberry Pi to temporarily disable all the blocking. Not the best solution but still useful to know I think.

zaarn4• 8 years ago

I don't think that's a problem at all.

I did give the family members the password to unlock the block temporarily but after a while they simply stopped using those sites altogether.

It's also a big plus for devices that can't adblock themselves (phones, embedded devices, etc.)

spacedgrey• 8 years ago

For the non-tech-savvy members of the household you can provide a link to the disable API.

e.g. Temporarily disable blocking for 60 seconds,

http://pihole.lan/admin/api.php?disable=60&auth= .

You can also infuriate the teenagers in the household by blocking and unblocking domains at certain times via crontab. e.g.

0 08 * * * /usr/local/bin/pihole -wild --delmode instagram.com youtube.com

0 22 * * * /usr/local/bin/pihole -wild instagram.com youtube.com

dvfjsdhgfv3• 8 years ago

In my experience, most adblock blockers take a lazy approach - it's just a piece of JS loaded together with the main document. So it's ridiculously easy to protect against: just switch off JS with a click and you can read the page in question. Of course it works for documents only - if you need to use an app, things are much trickier and you need to dig up a bit to understand which script you have to block.

swiley• 8 years ago

Usually you don’t even need that, they just cover the page with a div that you can delete in inspector.

andai2• 8 years ago

Due to bandwidth constraints I surfed with images and JS disabled (safari developer options) and oh my god what an improvement it was. No trackers. No ads. No auto-playing video. No newsletter pop ups. No cookie notices. This was GDPR but I imagine that would be gone on most sites too. I'll probably switch back soon. I long for the speed, the elegance...

Boxbot• 8 years ago

I run a Pi-hole (mostly for my phone and paired with OpenVPN and iOS/MacOS content blockers) and run into the same "problem". My advice is to stop patronizing those sites at all. Just like paywalled articles linked on HN, just stop visiting.

Seriously, just stop. It's the only way we're going to move to something less damaging and invasive than the current ad/data economy.

I should note that I do pay quite a lot for journalism and art via subscriptions, Patreon, Kickstater, etc, but I'm not going to tolerate sites clogging up search results with paywalled articles or piles of tracking scripts and media downloads.

icelancer• 8 years ago

This is completely untenable advice to give family that shares your Internet connection, which the OP clearly pointed out.

setr• 8 years ago

Personally, I find a browser based advert/tracking blocker add-on to work better.
If Pi-Hole had a webpage where you could put in a domain, i.e. cnbc.com, and it went off and loaded the html of that page, worked out all the other domains that html connects to, and then gives you a 'unblock' button to click, that would improve usability significantly, as even a non-techie user could use it.

Aren't you just describing uMatrix?

close044• 8 years ago

I think he's describing a local network ad-blocker that you can control and configure from any browser with a simple extension. This means that you can update rules from any device in your home/office and it would still apply for all devices in your network.

c12• 8 years ago

I typically browse the internet with JavaScript disabled by default and rarely come across issues - when I do unless the website is appealing enough to white-list for js I go elsewhere.

I have also found the reader view functionality on iOS to be a godsend when visiting websites, no more cookie notices, GDPR popups or banners taking up 1/3 of the display - bliss!

reustle• 8 years ago

I see "just going elsewhere" as a possible solution 10 years ago but not today, depending on how much you're using the internet.

sametmax• 8 years ago

Yes, but you are part of the tech saavy bubble. That's not a solution for most users who don't want a downgraded version of their facebook/instagram/gmail/etc experience.

jlebrech• 8 years ago

you could have pi-hole redirect to a site with the same story maybe? or even pi-hole could cache it.

xg152• 8 years ago

Generally, I agree - though I imagine the advantage of pi-hole is that it can also block ads in non-browser contexts, e.g. mobile apps.

At least it can until those apps start to use their own hardwired DNS/DoH server...

joshschreuder• 8 years ago

Weird, my experience doesn't match yours, and I run both Pi Hole and uBlock. I guess the blocklists factor in a lot and also the sites you visit.

dspillett• 8 years ago

many sites that detect that their adverts and tracking scripts don't load and refuse to let you in

I think I've only seen that once since running pi-hole (which I've done for about six months now), so I assume the rate of occurrence varies widely with what people are browsing. Do you see it a lot on sites with a particular pattern (i.e. pertaining to a certain industry or hobby/interest)?

and refuse to let you in

I'm fine with that. I doubt the information isn't available elsewhere if I really care about it, and the most insidious stuff I'm blocking tends to be on less important content that I can live without anyway (imgur.com was the final straw that made me install network-level blocking - too many pop-unders, the occasional drive-by install attempt, adverts trying to access my microphone and/or camera, and less worrying but still annoying things like auto-playing audio - if such frivolous sites block me for blocking their ads because they can't police them properly I'm sure I'll live!).

a family member or co-worker can't get to a site then they have no way to bypass it unless they also know how Pi-Hole works
Personally, I find a browser based advert/tracking blocker add-on to work better.

Other people is why I run blocking at the network level ATM (as well as on my individual mobile devices). I'd rather deal with the occasional "I can't get into X, oh, it is because of the malware/ad blocker, try somewhere else" conversations than have the tech support load of undoing drive-by installs!

Also, I wouldn't want other people to easily add stuff to my network's whitelist.

Anyone who really objects can always use their own mobile data plan instead of using my network that runs just fine the way I want it to...

mnw21cam2• 8 years ago

> and refuse to let you in
I'm fine with that.

Agreed. Sounds like the Pi-hole is working exactly as intended.

As I see it, you have a choice between viewing an ad/malware laden cesspit, or avoiding it. And by installing a Pi-hole, you have already made that choice.

amaccuish2• 8 years ago

and refuse to let you in
> I'm fine with that.

That's fine with me too, but doesn't cut it in a family environment. Further, some websites break with an adblocker, even when they don't have ads. E.g. Login with Facebook/Twitter, or some JS heavy sites which happen to have a bad keyword in the name of the file.

many sites that detect that their adverts and tracking scripts don't load and refuse to let you in
> I think I've only seen that once since running pi-hole

It used to be a daily occurence until I whitelisted sites. At least with an addon, my mum can just click the button and unblock and get on with her day.

If pi-hole could have some companion extension to make whitelisting easier that would be great.

everdrive2• 8 years ago

This might be unpopular, but I hope Pihole remains untenable for non-technically savvy users. Advertisers and ad-blocking are always engaged in a game of cat and mouse. I'd prefer advertisers to see Pihole as a tiny niche of the market they don't need to seriously work to defeat.

apexalpha3• 8 years ago

The only way to defeat them would be to self-host ads. Which would actually be a good thing since publishers would now have an incentive to make them as light as possible since it's their bandwidth being used.

mikec30102• 8 years ago

I'm waiting for the next generation ad blockers where a cloud based html rendering engine renders the image of the page to a frame buffer, crops out the article or pictures, compresses them, and sends it to my device.

Hell, you could do a mechanical turk system and pay micropayments to 3rd world employees to crawl ad-infested crap and harvest the content for me (Or better yet, share it for the common good)

cup-of-tea• 8 years ago

Not a problem. I can't remember that ever happening, but if it did I would just close the tab. Pi-hole works as intended.

jackson1way• 8 years ago

I couldn't agree more. Pi-Hole is essentially useless for real world scenarios.

I can't hear this short-sighted comments "it doesn't load with pi-hole? then I just close the tab!"

oh really? that's how easy it is in your world? and then you just don't buy that flight ticket? because that shitty online ticket agent uses third-third-party payment providers etc. whos domain is unfortunately blocked in pi-hole? even one single incident might force you to entirely disable pi-hole. most people can't afford to play around with that until it works.

you can't seriously maintain these block lists yourself. you have to rely on a 3rd party, usually some volunteers - great people btw - but even a huge crowd like them can't make sure, that from time to time, in some part of the internet, in some specific country and language, something will be blocked by mistake and you are stuck. with a browser plugin, at least you can disable it for that specific case. with pi-hole there is no such feature. i have to disable my browser adblocker at least once a month, because something doesn't load. and its always off for sites like paypal, because I really want that payment to work and not suddenly screw up the whole transaction.

JustSomeNobody• 8 years ago

We're running pi-hole network wide and we just planned a trip with no glitches. The only annoyance (if it's really an annoyance) is clicking on a link in a google search and it's blocked. Go back to Google, realize is was an ad, scroll down a little further and click the real link. No big deal. Nobody in the house is complaining about not reaching sites.

So, yes, it is possible to do this in real world scenarios.

jackstraw42• 8 years ago

Pi-Hole is essentially useless for real world scenarios.

This is a surprising statement because I've used mine at home with 6+ devices and zero issues for almost two years now. It seems fair to say it's not ideal for your needs, but why say something like this that will only deter people from seeing if it works for them?

wlesieutre• 8 years ago

If something's really important you could use your phone with wifi off to get an unblocked version via cellular. It's one more step, but some people may find it to be worth the effort.

EvilEndures2• 8 years ago

I couldn't agree more. Pi-Hole is essentially useless for real world scenarios.

As a user of pi-hole, I have no issues with small scale implementations (i.e. less than 20 users) but security is more important than access to random sites for personal use in the environments I work in.

It is just is for security-prioritized environments.

cortesoft• 8 years ago

You wouldn't really be STUCK if you are blocked... you can just point your DNS to another IP (like 8.8.8.8 or something). This is DNS based, so if you don't use the Pi-hole DNS server, you aren't affected.

phobosdeimos2• 8 years ago

Agreed, sometimes you just NEED to use a shitty site. I have my main browser specially configured ad free and privacy secure but I always have a backup browser.

The people who build websites aren't thinking about us.

kup0• 8 years ago

Have used a Pi-hole for two years and maybe had to whitelist one or two sites (easily found looking at the log), which was easy using Pi-hole's web interface

Additionally, you can simply disable Pi-hole for temporary timeframes using the web interface as well, it has options like "Disable for 15 minutes", if you don't want to bother adding things to a whitelist.

I've used all sorts of financial, ordering, etc. sites and generally have not run into an issue. A single credit card site was one of the two I had to whitelist, and it was easy.

spicyusername• 8 years ago

Been using pi-hole for over a year with no issues. Not sure what's going on with your experience.

samfriedman• 8 years ago

I've found that most sites which attempt to block access due to ad-blockers typically do so with a full-page pop-up element which hides the (fully loaded) content underneath. With uBlock Origin it's easy enough to use the element-picker to remove the blocking elements of the webpage.

jasonkostempski• 8 years ago

It's best to just not go to those sites. Never whitelist, it defeats the whole purpose if you care one bit about tracking. If I come across enough links to a site that does that, I add them to my url blacklist, so I never see them again. I wish uBlock Origin would add that feature so I did't have to maintain my own junky plugin to do it.

redleggedfrog• 8 years ago

Simple phrasing could change this. If the site was deemed "unacceptable", not just "blocked", with no particular detail people would find alternatives (even pick up the phone?). This could be done at both the browser and ISP level, as well as something like Pi-Hole.

dghughes4• 8 years ago

I used to use a pi hole since YouTube on a Samsung smart TV is horrible both YoutTube and Samsung put ads in the same video (YouTube at the start and Samsung ...whenever). But Samsung inject ads frequently and aggressively. Even short ten minute videos are interrupted at least twice by ads sometimes a few seconds before a video ends, I mean really?!?

It worked great for a long time but then but changed my setup.

Then I wanted to try Pi-Hole again going through the setup again but the results were very different. For example my Samsung smart TV absolutely refused to connect. It is the same TV, same Pi device, same everything but no network.

krisroadruck• 8 years ago

Well that just sold me on never buying another Samsung TV ever. How in the hell does Samsung, a device manufacturer justify inserting ads over content thats not even theirs?

LynxInLA• 8 years ago

What model Samsung do you have? I have been using the KS8000 for a couple years and have only ever noticed the small ad that looks like another app in the home screen. I've never had Samsung ads in 3rd party apps.

dingo_bat2• 8 years ago

I've been using a Samsung TV for the last 3 years and never seen an ad on YouTube. Which model are you using?

palebluedot• 8 years ago

Additionally, if you are not around, and a family member or co-worker can't get to a site then they have no way to bypass it unless they also know how Pi-Hole works.

I ran into that issue with some household members, that had problems with certain websites that didn't work. Since I run my own DHCP server (not through pi-hole), what I ended up doing is giving them a different (e.g. 1.1.1.1) DNS resolver for their machine (based on their MAC address), and then installing uBlock Origin for them. That way, they can easily turn ad blocking on/off themselves, while I can still have network-wide adblocking on by default (especially useful for mobile devices).

city412• 8 years ago

Here is how to disable pihole via a url: https://www.reddit.com/r/pihole/comments/81z8jp/temporarily_...

With this anyone in your family can temporarily disable it to unblock themselves if needed.

craftyguy8• 8 years ago

Sending the pihole admin password in a non-https url query string seems like a bad idea. You might argue that your network is 'trusted', but then I'd remind you that this pihole device is designed to intercept all dns on your network, and would be used quite maliciously if compromised.

downrightmike• 8 years ago

I purposely black list any sites that complain about not able to load their ads. Using both is a better answer.

vitaflo2• 8 years ago

If Pi-Hole had a webpage where you could put in a domain, i.e. cnbc.com, and it went off and loaded the html of that page, worked out all the other domains that html connects to, and then gives you a 'unblock' button to click, that would improve usability significantly, as even a non-techie user could use it.

It kind of already has this. Just tail the log in the web admin, then hit the site in your browser. Unblock the sites that were blocked on that request.

I've been using pihole for a year and have only had one site that refused to load. Was pretty easy to figure out which request it was and whitelist it.

saudioger2• 8 years ago

I'd really really like a simple whitelisting interface too. Sometimes I just need to get shit done for a minute, and then I'd just start blocking again. All or nothing is incredibly frustrating sometimes.

luxpir3• 8 years ago

It's got that... Disable for 10s, 30s, 5m, custom or permanent. GUI or CLI.

binbag3• 8 years ago

I could be on the wrong track here, but the MACE ad-blocker built into the PIA VPN seems to work very well by itself. It's not free like PiHole is, but pretty cheap, and a VPN is probably a better starting point for security than a local blocker. Am I missing something here?

jaxn• 8 years ago

I have a VPS with an Outline VPN that I use. I'm going to try to put PiHole on there and see if I can get it to work.

Fnoord5• 8 years ago

and a VPN is probably a better starting point for security than a local blocker. Am I missing something here?

Why? A VPN is just another (S)POF. I'm not afraid my ISP will MITM me. With a VPN, who knows what they log or not? Also, OpenVPN's performance is terrible. If you want to avoid detection of BitTorrent, sure, but then just route only that over a VPN. If your ISP MITMs you, and you're paying them, consider to jump ship.

I see uBlock being mentioned throughout this thread. uBlock Origin is (very) nice, but its client-side overhead and you can't use it on "apps". What I do is catch all DNS requests and forward them to my DNS-based adblocking (I basically run Pi-Hole on an ER-L) and forward that to DNS over TLS (which works with Quad9). This is all used even if I'm roaming (via WireGuard, ie. very low overhead). So it is irrelevant which network my roaming clients use.

binbag3• 8 years ago

The performance of my network is certainly not terrible when connected to the VPN. Download speed is not noticeably affected and my ping to quake servers (I run VPN all the time, even while gaming) is often lower with the VPN connected.

Regarding your 'why is it more secure' question - because I live in the UK where the government and a myriad of its approved bodies are now allowed to look at user traffic and see my IP and what websites I've visited. I don't have to worry about that now - although yes I need to trust that PIA really are not logging.

JumpCrisscross• 8 years ago

For some reason, I was reminded of the message iOS’s original top-selling as blocker posted when pulling their app [1]. (TL; DR They felt bad about denying advertisers their revenues.) While the web is gnarly and unforgiving, we’ve progressed—as a culture—in our general treatment of ads and ad blockers.

[1] https://marco.org/2015/09/18/just-doesnt-feel-good

rangibaby• 8 years ago

What an odd thing to feel bad about.

People are taking the piss out of you everyday. They butt into your life, take a cheap shot at you and then disappear. They leer at you from tall buildings and make you feel small. They make flippant comments from buses that imply you're not sexy enough and that all the fun is happening somewhere else. They are on TV making your girlfriend feel inadequate. They have access to the most sophisticated technology the world has ever seen and they bully you with it. They are The Advertisers and they are laughing at you. You, however, are forbidden to touch them. Trademarks, intellectual property rights and copyright law mean advertisers can say what they like wherever they like with total impunity. Fuck that. Any advert in a public space that gives you no choice whether you see it or not is yours. It's yours to take, re-arrange and re-use. You can do whatever you like with it. Asking for permission is like asking to keep a rock someone just threw at your head. You owe the companies nothing. Less than nothing, you especially don't owe them any courtesy. They owe you. They have re-arranged the world to put themselves in front of you. They never asked for your permission, don't even start asking for theirs.

Banksy

javajosh• 8 years ago

Wonderful quote. The concept I have been playing with I call "consensual communication". We dont allow people to run up to us and shove food in our mouths, and yet we allow information to be shoved into our minds - and as the quote notes, they have the gall to place restrictions on the object of assault.

dredmorbius• 8 years ago

Actually Sean Tejaratchi. Banky used it with attribution, though that's frequently lost / misstated (as here).

https://web.archive.org/web/20120321232424/http://readingfre...

Ezhik• 8 years ago

Personally, it's not primarily about the actual ads, but all the tracking and JavaScript and shady UI patterns.

Somebody trying to tell me I should keep all ads on because ads pay for the content? Fuck that, tracking my every move pays for the content, and I want no part of that, even if I lose access to the content.

The ad industry wired the consumers to expect things for free to begin with, so I don't know why I should feel any guilt at all for trying to block ads and gigabytes worth of unnecessary and often down right malicious JavaScript code.

corv3• 8 years ago

Is there a way I can keep a second DNS as a fallback that doesn't get used unless my pi-hole is down?

nirav72• 8 years ago

Yes. Just set your secondary dns in your client to whatever dns you were using before. It will fall back on secondary if primary dns via pihole fails.

corv3• 8 years ago

Sometimes the secondary will take precedence over the primary even though pi-hole is reachable.

Mashimo2• 8 years ago

Sure. I put in your second DNS as .. seconds DNS.

My routers DHCPD gives pi-hole as primary and itself as secondary DNS.

corv3• 8 years ago

It seems that both primary and secondary are being used in round-robin and the primary gets relegated when secondary happens to answer faster.

apexalpha3• 8 years ago

Install a second Pi as PiHole as well. It also runs fine next to Kodi or so if you have one already. DNS requests are incredibly small.

ramshanker• 8 years ago

When I am on home wifi, no ads in my mobile thanks to PiHole. So many apps are filled with ads while on the move. Clearly pihole version of web feels more snappy.

There are apps serving the App Add tiles BEFORE they load real content from their own far-away (by latency) servers.

Tomte8• 8 years ago

I love how the Protestant Church of Germany has a very good installation description on their web site: https://datenschutz.ekd.de/2018/04/12/pi-hole-ein-erfahrungs...

dvfjsdhgfv3• 8 years ago

I found this bit interesting:

After meanwhile four weeks "leisure mode" of the Pi-hole in my network this comes up stately 12245 DNS inquiries, of which 7102 DNS inquiries were blocked. That's 58%. It's interesting, if not surprising, that six of the top 10 blocked domains come from Microsoft, two from Google, and one each from Amazon and Vungle.com.

erikbye3• 8 years ago

If you block Windows telemetry domains and run Windows, naturally those domains will be at the top... I have a lot of blocklists, but I think one of the default ones includes Windows telemetry.

watson.telemetry.microsoft.com 15110

v10.vortex-win.data.microsoft.com 11338

fls-na.amazon.com 4397

nexus.officeapps.live.com 3547

settings-win.data.microsoft.com 3463

collector.githubapp.com 3396

www.google-analytics.com 3379

www.googletagmanager.com 2246

www.googletagservices.com 2204

clc.stackoverflow.com 2173

userbinator• 8 years ago

I'm not surprised. I remember reading before that Germany was one of the countries with the highest adblocker use.

PhasmaFelis2• 8 years ago

To think it only costs $100 and a few days' shipping time to get all the benefits of a software ad blocker than anyone can install for free in less than 60 seconds.

zaarn4• 8 years ago

Pi-Hole offers more than a simple software blocker, or rather, something a bit different.

Everyone on my wifi or LAN benefits from adblocking. Even guests that are just there for the day. Devices that cannot run adblockers benefit. It doesn't require any installation at all.

And if you bought a compatible raspi plus PSU for 100$ you go scammed pretty hard, I'd pay 40$, maybe 50$, for that combination tops.

PhasmaFelis2• 8 years ago

Devices that cannot run adblockers benefit.

Adblockers have been available on the Android and iPhone app stores for a while now.

And if you bought a compatible raspi plus PSU for 100$ you go scammed pretty hard

I'm quoting from the article, which admittedly uses Australian dollars. But I still don't see a need to pay any amount of money for the benefit of hypothetical visitors who already don't care enough to install a free adblocker on their phone.

I'm sure there are valuable use cases for the Pi-Hole; in an small office environment, or if you fear some very specific malware, or if you really, really want a bulletproof way to block ads in free phone games. I object to the article making it sound like it's something everyone needs in their home, giving no coherent evidence and ignoring the real drawbacks. (The first thing I do when a site doesn't work is try disabling AdBlock Plus; even ignoring anti-adblockers, quite a few poorly-designed sites just break if an adblocker is running. A hardware adblocker that can't be locally or temporarily disabled with a few clicks is a bad idea.)

Mashimo2• 8 years ago

I installed it on my NAS. No extra hardware cost. The benefit of pi-hole is that also mobile devices now have ads blocked. Also build in tracking from Windows is blocked.

mikestew• 8 years ago

Software ad blockers don't block in-app ads. And I'm open to suggestions of how to use an ad blocker to keep my Nest thermostat from pinging Google's servers four times a second. Using Pi-Hole, it was a matter of, "WTF is that thermostat doing? <click "add to blacklist">. sigh, I'll deal with it later." [0]

[0] Yes, there are at least a half dozen ways to deal with this w/o Pi-Hole. But Pi-Hole: 1. brought it to my attention and 2. offered a (at least temporary) solution with the click of a mouse.

myf01d• 8 years ago

what about path based blocking for https websites? this dns-based method isn't really effective unless for known ad and tracking domains, I guess most of the time you need to block a certain path and that cannot be known for the case of https except inside the browser itself after decrypting the TLS payload. Also this could break some websites and users don't even recognize this is due to pi-hole. This is why I believe that adblockers at the endpoint like ublock-origin are the most effective way to block ads.

ohiovr• 8 years ago

Pi-Hole has dnsmasq built in so it is also handy for doing things like connecting to ssh servers in your network with your own hostnames instead of just ip addresses.

b3lvedere• 8 years ago

My experiences using a Pi-Hole at home (Debian VM) have been very good.

Recently i upgraded to version 4.0 (https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ft...) and it seems working perfectly fine.

Great job Pi-Hole team! Thank you!

j0hnml2• 8 years ago

Is there any reason you chose running on a VM as opposed to something like a RPi3?

geerlingguy2• 8 years ago

Marginal speed gains (though Pi hole isn’t super resource-intensive so the speed up isn’t huge unless you’re piping through a ton of DNS traffic), and you don’t need a Pi at all :)

crtasm4• 8 years ago

Mine is on a Debian VM too, I already had a server to put it on and my RPI is busy running 4player super bomberman :-)

BLKNSLVR2• 8 years ago

I'm also running it on a VM because I had spare capacity on an existing VM host, so it was essentially a no-cost addition.

Also Pi-Hole has been great. I'm reminded of how effective it is every time I load up web pages on mobile or at work, or anywhere else that doesn't filter out the large percentage of the Internet that I didn't ask to see.

vmp• 8 years ago

I wrote a lightweight DNS proxy for this purpose in python+twisted and sqlite3: https://gitlab.com/Sharky/blocklist2bind/blob/master/twisted... which also works really well on a RaspPi 3 with pypy3.

a_imho• 8 years ago

Blocking is good, obfuscation is better.

r3vrse• 8 years ago

In other words my current smartphone will be unsafe for everyday use after September 2018, but it may have some life left in it by protecting its operating system with some network level security.

I stopped paying attention when I read this.

Pi-Hole is an ad blocker and it is fit for that purpose. No argument from me. However, to give this advice to people for whom device and network security is not a major or even minor concern is frankly dangerous.

Buy an iPhone. Buy a Mac. Keep your Windows PCs updated. Get a mesh WiFi solution that takes care of firmware patches automatically. Run a browser-based blocker that updates in the background without interaction.

These are the low-hanging fruit that should be done long before you are trying to set up what is essentially MITM-as-an-appliance without any paid support or guarantee.

Who is this article actually helping?

paulcarroty3• 8 years ago

Buy an iPhone. Buy a Mac. Keep your Windows PCs updated.

What?

jacobush• 8 years ago

An iOS device tracks a lot of what you do, especially if you don't opt out of anything iCloud. But the bulk of the tracking is done by one "evil" corporation, who takes the majority of its money from selling devices.

With a normal Android device, you are tracked every step of the way, by apps, by Google, by Samsung and their awful software quality or by random Chinese entities.

If you don't spend a lot of time, an iOS device is the lesser evil when it comes to tracking. An iOS device with automatic app updates turned off, no iCloud, and where you say no to most apps asking for permissions on first run, is pretty locked down.

There are downsides, of course. It's kind of sad that you can't buy a mobile device which is just a network node by default, not a spying machine by default.

freehunter2• 8 years ago

It's pretty simple: buy a device that is supported by the manufacturer for the lifetime of the device. The Nexus 5X was released in 2015, so it's abandoned after three years. The oldest supported iPhone is the 5s, which was released in 2013 and will be supported by iOS 12 which means it gets security updates until at least fall of 2019 (maybe longer).

A straight-from-Google Android phone is out of support after 3 years, while a comparable iPhone is still supported after 6 years.

probably_wrong• 8 years ago

Who is this article actually helping?

Those who cannot afford iPhones and Macs?

SeriousM• 8 years ago

In what universe is an apple product helping you in any meaningful way?

ziftface4• 8 years ago

How is a DNS server MiTM?

gervase• 8 years ago

Who is this article actually helping?

It seems to be primarily targeted at highly-technical people, such as those who might stumble on this article via HN, or who casually frequent websites with "crypto" in their name.

These audiences naturally would have a higher tolerance to technical adoption barriers than the average consumer, which is who your other advice seems to be targeting.

robszumski• 8 years ago

Does anyone have experience with the optional network ad blocker built into the eero? I think it’s an additional charge so I haven’t tried it. Does it use this same rule set?

paulcarroty3• 8 years ago

https://github.com/StevenBlack/hosts

and you don't need a device.

badbug2• 8 years ago

Where do I edit the hosts file on my iPhone? Or my Android device? Or my smartTV, etc, etc, etc

hello_asdf• 8 years ago

I put mine on router with dnsmasq.

rndomsrmn• 8 years ago

Or https://github.com/notracking/hosts-blocklists that uses a dnsmasq feature to block full domains.

moltar2• 8 years ago

Just got one a month ago. Doesn’t work for YouTube ads, which was my primary use case. In Canada, we don’t have YouTube Red, and thus there’s no way to buy out of the ads.

Also I loaded all block lists marked as safe. Yet many sites are broken.

Now I’m contemplating as to how best to repurpose the Pi.

crtasm4• 8 years ago

Make a Youtube-dl server? Or run kodi+YouTube and watch on your TV with no ads.

technofiend• 8 years ago

Use it to carry all your traffic to a US-based host via VPN and purchase YouTube Red with a US address? Hacky, I know.

r3bl• 8 years ago

You'd have to be connected to the VPN at all times to use it. The minute you're not using it, all the Red features disappear, regardless if you have an active subscription or not[0].

So your option is to have an always-on VPN. If you're doing that from your phone, you might as well install NetGuard, which is a no-root open source adblocking solution that MitMs your connections by pretending to be a VPN, and is available on Google Play. Works with YouTube, and doesn't require monthly subscription.

[0] Source: Activated the YouTube Red trial when I was on a travel to the US, and lost all the benefits the moment I landed home.

greenshackle2• 8 years ago

Since mid-June it's been renamed YouTube Premium and you can get it in Canada.

moltar2• 8 years ago

Sweet! Thank you for letting me know! Problem solved :D

driverdan2• 8 years ago

uBlock Origin blocks YT ads in the browser.

obituary_latte2• 8 years ago

I love that pi-hole will even block commercials on “free” tv apps that run on fire/apple tv.

mlevental2• 8 years ago

I bought a pi exactly for this and couldn't get the to work. it broke YouTube because the commercials wouldn't load. have you managed to get that to work?

obituary_latte2• 8 years ago

Sorry — didn’t try with YouTube — it was working with Crackle and if I remember correctly the AMC app. That’s odd though because I’m pretty certain it blocks the YT adds on my phone (unless that’s the Purify/1Blocker add block apps which it may be).

pbhjpbhj5• 8 years ago

I tried pi-hole (a few months back on an rpi3) and am pretty sure it got hacked, making something like 100,000 DNS requests in a few minutes during a low use period. I'd guess that's some sort of advertising impressions hack.

Unfortunately I didn't have time to sort the issue, so can't guarantee I didn't err. But I stopped using it; which was a shame as I really liked the device usage reporting in particular.

Anyone else had similar? Make sure to check your stats.

Majestic121• 8 years ago

This article might be of interest to you : https://docs.pi-hole.net/guides/vpn/overview/

It describes how your Pi-Hole can be used for DNS Amplification Attacks by attackers, and how to prevent it

24gttghh• 8 years ago

If the case is the pi-hole was an open resolver, then a simple firewall rule should have been enabled to block port 53 from the WAN...

t3ra7• 8 years ago

I am actively using PiHole in my home network with over 8 devices doing around ~30k requests per day. Some highlights:

* By a huge margin the nosiest device is my Android Phone. >40% traffic is coming from just my phone (which is crazy!)

* I have 650,000+ in my domain blacklist and folks complaining about "it doesnt work on pihole" just have taken that tiny bit of error to unblock some domains like "ssl.googleanalytics.com" which break a lot apps. It took me about 1 day to see what isnt working (ex Facebook app break if graph.facebook.com is blocked)

* On avg 28% of my requests are blocked and 42% are cached. I am quite sure generally my surfing experience is snappier

-- Things like learn running PiHole :

How prevalent tracking really is across the web. A lot of apps dont go "online" if google analytics is blocked (example Toggl)

Manufacturers like Xiaomi are spamming the network with requests - mostly for notification spam

How amazingly scalable, stable RPi+PiHole is - we ran a workshop with 150+ DHCP leases and nearly a few 100k DNS requests without a glitch. Pi didnt even heat up a bit

SmartTV are freaking noisy. Samsung TV makes ~300 DNS requests in <5 min of startup. Literally every button press in the "smart home" is tracked

luxpir3• 8 years ago

I wanted to say something positive too, after seeing how the thread went here. No issues from the non-technical users in the household, at all, really. The domains I've whitelisted are mainly one-offs - I haven't whitelisted GA as above and nothing has broken here.

I've ended up using uMatrix and uBlock together on my personal machine as they don't interfere with each other and uBlock has an extra list or two that blocks even more tracking and ads - including all youtube ads. Which is just so satisfying. But other devices (of all kinds) run ad and tracker free, with a faster browsing experience to boot.

So that's no ads on any devices on the network, all running on a pi that is also a media centre, NAS and IRC client. Takes minutes to set up and is regularly updated. I don't get what's not to like.

iDemonix• 8 years ago

* By a huge margin the nosiest device is my Android Phone. >40% traffic is coming from just my phone (which is crazy!)

I work for a small ISP-for-schools. We had an issue which eventually turned out to be related to a specific version of Snapchat on Android, when its connection back to Snapchat was blocked, it'd try and send a mixture of GET/POST at a rate of 1000s a minute. When you've got thousands of devices doing that, it's like an internal DDoS.

We've had a few problems like this and it always appears to be Android apps...

craftyguy8• 8 years ago

How did you resolve that snapchat problem?

driverdan2• 8 years ago

I use AdAway on my phone to blackhole ads and trackers. I've seen some weird behavior in certain apps I assume is due to it but I've never had any app not work.

Same thing on laptop. I use a combination of blackholed DNS, a firewall, and uBlock Origin in the browser. Some sites won't work due to poor error handling which is their loss. I've never had a native app not work.

craftyguy8• 8 years ago

which is their loss

Exactly what my stance is towards sites that 'need' crap to work. My favorite are news sites/blogs whose primary content is text, but display a completely white blank page when the adblocker is up. (some even do this when you disable JS too. why JS is 'required' for displaying any text is beyond me)

teeteetech• 8 years ago

I've been thinking about setting up twilio with PiHole so I can just copy-paste-sms a url to unblock for people on my network.

Any idea of the feasibility of this?

kingbirdy• 8 years ago

pihole has a CLI to block/unblock URLs, so it should be pretty straightforward

natch2• 8 years ago

When something isn't working, how do you determine with a tiny bit of effort which one or more domains out of the 650,000+ domains to whitelist?

TremendousJudge2• 8 years ago

I want to know this as well

michaelbuckbee2• 8 years ago

Here is what I do:

1. Switch off DNS from PiHole to ISP DNS (or Google/CF, whatever non blocking DNS)

2. Reload page in Chrome with uBlock Origin and selectively allow domains to load until the page loads.

3. Whitelist domain in PiHole

This works b/c both uBlock Origin and PiHole out of the box use basically the same blocklists (or you can force them to).

luxpir3• 8 years ago

Easiest way: check the log to see what was blocked. It's as simple as that.

Happens so infrequently though - the lists are made up of domains you don't typically want to whitelist. Only 133,608 on my lists though, and that's pretty up to date.

t3ra7• 8 years ago

I use the web interface and filter it with the IP address of the device. It will usually show up in the top of the list and try whitelisting.

Example my Samsung TV took some effort : multiple domains were blocked and had to restart my TV everytime, thankfully PiHole has a neat responsive web interface. After allowing 2 domains it started to work or else it wouldnt go online.

danjoc2• 8 years ago

Ultimately, this is going to end badly for advertisers. All ISPs block port 25. In < 5 years, all ISPs will provide PiHole functionality on their networks. "Net Neutrality" is gone. This is going to be glorious. Thank goodness for the FCC making this protection available to the masses.

KnightEternal• 8 years ago

Care to elaborate?

poopchute• 8 years ago

Or.. Advertisers will pay ISP's to inject ads.

yumraj• 8 years ago

Which blocklists are you using? Could you share?

t3ra7• 8 years ago

I use lists curate by firebog https://firebog.net/

heroprotagonist2• 8 years ago

I wonder how tricky it'd be to serve a local copy of google analytics code that simply didn't report back to them. Or perhaps just redirect outgoing requests from GA to some internal resource that collects (for yourself instead of google) or drops the data and returns an expected response.

Then there would be no need to unblock their trackers to make websites function.

organsnyder• 8 years ago

Due to SSL, it wouldn't be easy: you'd need to have SSL certs for some google.com subdomains, and they'd need to be trusted by every device. Blocking the traffic is much easier.

DavideNL• 8 years ago

Sounds a little like the “decentraleyes” extension...

https://git.synz.io/Synzvato/decentraleyes

EvilEndures2• 8 years ago

The only way to do it is to have admin/root on all the devices so you can install your own SSL root certs and "steal" google's domain internally with suitable certs.

It can be done but not in a BYOD situation.

t3ra7• 8 years ago

So this happened after a posted this comment (weird coincidence :/)

My pi hole graph started to look like - https://imgur.com/a/Jj8bmPW

NVIDIA geforce experience really wants to talk to the mothership :| Ended up uninstalling it

mayamatrix• 8 years ago

Would you mind sharing your lists? I only have about 140k in mine but would like to increase my protection.

t3ra7• 8 years ago

Firebog.net has curated lists

alessioalex• 8 years ago

How did you detect which device was the nosiest? Do you have static ip addresses for each one?

t3ra7• 8 years ago

It's my home network, there are devices you can count on your finger. Also DHCP lease times by default are in multiple hours on home routers so IPs don't often change. also the web Interface shows hostnames

alexrsagen• 8 years ago

The page is very self-contradicting...

It says in verbatim "However, I do have a problem with: Pop-up and pop-under ads that hi-jack my internet browsing experience".

However, the site itself has a "subscribe" overlay that has to be removed with developer tools or manually blocked if uBlock Origin is enabled with annoyances filters.

ziftface4• 8 years ago

I guess he made his point

admax88q• 8 years ago

It really seems like the only reason I need this device is that most of my devices are not truly under my control.

The fact that my phone does not have these features baked in and comes with apps that violate my privacy and serve me ads without regard for malware those ads may contain is because my phone doesn't truly obdy me first.

mlinksva• 8 years ago

Does anyone use Pi-Hole for larger-than-home networks, e.g., for an office, cafe, school...?

Also, it seems like Pi-Hole ought to be a router feature rather than requiring a separate device. Does any router vendor or router OS distro integrate Pi-Hole?

witnessmenow• 8 years ago

I have a relatively short video (~8 mins) explaining how pi-hole works and how to install it if anyone interested

https://youtu.be/_rZhCLh3WyY

muxator• 8 years ago

Alternative for those who run OpenWRT on their modem/router: you can opkg install adblock, and also get an easy web based administrator interface via LuCi.

kevlar1818• 8 years ago

If you run OpenWRT/LEDE on your home router, you can just install this package:

https://github.com/openwrt/packages/tree/master/net/adblock/...

ocdtrekkie• 8 years ago

Finally broke down, got out an old Pi I had in storage and set up a Pi-Hole last week. So far the experience has been pretty positive.

expertentipp• 8 years ago

Internet without ad and tracking blocker is unwatchable and unusable at this point. Occasionally I get taste of it while browsing on the iphone (unable to edit the hosts file) and it is a nightmare. Advertisers and tracking providers hijacked the web.

ectospheno• 8 years ago

iOS has several nice ad blockers and has for quite some time now.

dingo_bat2• 8 years ago

What's the advantage over just using ublock everywhere? Why go to all this effort and include another point of failure in your network when you can just install an extension?

vitaflo2• 8 years ago

The advantage is for anything you can't install ublock on. It's program agnostic.

class4behavior• 8 years ago

Pihole manages your hosts file which redirects domain names to a configured IP-address; a local one when the goal is blocking. It is a bit overhyped but useful when you understand what it's for.

It uses the same lists as uBlock, but only the rules which filter the entire domains. Meaning, uBlock covers a lot more ground and preserves the operability of most websites.

As such, just for browser activity it is a redundant measure.

The difference is, for everything else it affects all your traffic; that is, Android or Windows apps, telemetry, bad content in HTML emails, etc.

If you install it on a router, you can cover all your devices. That can immediately or later cause issues with websites and apps inhibiting usage when ads or trackers are blocked. So you need to be available for whitelisting.

veritas3241• 8 years ago

There's a persistent bug with my Pi-Hole where every time it's active it causes my wife complains that several of the websites she wants to visit are unusable. :-D

intopieces• 8 years ago

Is this something I can put next to my parents’ router and not kill their internet experience? They like Facebook.

eximius• 8 years ago

I use wireguard with DNS routed to an `unbound` instance on the wireguard VPS. The VPS costs me $1/mo. The only problem I've gotten is when `unbound` crashes because it uses ~400MB of RAM to hold the blacklist and the little vps only has 256MB of RAM (and 1GB of swap)!

randop• 8 years ago

For me i use http://www.ipcop.org/ then use the blacklist on http://www.shallalist.de/ Using this on an old laptop.

kstenerud• 8 years ago

I've added an LXC container builder for it: https://github.com/kstenerud/virtual-builders/tree/master/ma...

adultSwim• 8 years ago

I do not have a problem with internet advertising in general.

I do.

NoPicklez• 8 years ago

Quad9 offers a similar type of network-side ad-blocker for free.

https://www.quad9.net/

Pi-Hole: Why You Need a Network-Wide Ad-Blocker

Related Stories