Pi-Hole 4.3.2
pi-hole.net
pi-hole.net
My goodness the internet is a dumpster fire without it. So many pages lagging and slow to load. Things I wanted to click that jumped when an ad loaded resulting in miss clicks. Annoying things following me around.
It was especially bad on mobile with the GDRP/Cookie notices and ad's to the point that on my iPhone SE some pages had a thin smear of the actual content no taller than a single line of text. News sites were especially bad for this.
With the experiment ended my pi-hole and ad blockers are now set to very on (and updated to this version and can confirm the block list went from 100,000 to 89,000) and I am much happier. Seems about 20% of the traffic on my network is blocked now which explains why some pages performed so awfully.
The ad industry really needs to up its game because the current state of the web is just horrible.
I also got to see how they were affected for work, study and play over weekends and weekdays.
I did notice I started to wait longer for pages to load with the ad's so that I would not accidentally click on them while they loaded in. That and I got generally annoyed by the web experience in general.
Some sites are littered with "targeted" ads like download buttons and similar, which I'm not even sure why that's allowed.
It's also fun on "big" websites like MS Teams, Netflix, hulu, etc, to see the "blocked" count raise into the hundreds.
If you're able to justify something because of a technicality and are intentionally ignoring the ethics of the situation and what is clearly right/wrong... well, that's not a good look.
Anti-patterns designed to trick us into clicking, signing up, giving up more data, view another few seconds of ads. It never ends! So yeah, we block it. I don't feel sorry. If you don't think it's ethical then you're not paying attention to what's really going on. I used to go around installing Firefox for people before it was called that. Then adblockers, and now I go to people's houses and help them with a raspberry pi loaded with pi-hole. Fuck ads. Fuck that entire industry. And fuck everyone that works in that industry enabling them.
It’s not OK to get a robot that changes the channel for you or to have your magazines sent to a service who cuts the ads out and forwards them on to you.
The implication of your ethical argument was that avoiding ads causes the content creator to fail to get paid, and that's wrong.
There's no material difference between whether I avoid ads manually, or have software do it for me automatically. The end result is the same; the creator misses out on ad revenue. You can't cherry-pick the ad avoidance methods and say some are ethical and some are not when the supposed unethical act is depriving creators of payment.
It's not all black and white. If you want to charge me for content, charge me for content. If I think it's worth it, I'll pay. Don't force an unusable, emotionally-manipulative, probably malware-filled experience on me from the get-go because you don't otherwise have a sustainable business model.
Congrats.
I much prefer the way movies and podcasts so it, as in, having the advertisement as part of the content itself. Instead of plugging in ads on the side, podcasts have a small segment where the host mentions a product and gives their personal experience with it. Moves place products in the shot, which is also a kind of approval from the studio. Webpages, however, just throw in ads with no context, and it's completely jarring.
Part of the problem is that placing ads is much easier than working ad placement into an article, and another part is that paying for things online is a painful experience. I don't mind paying to remove ads, but I'm not going to sign up for a subscription service just to read an article without ads. I really hope something like GNU Taler becomes popular to make these types of microtransactions easier to manage. Even better, I would like something like Netflix, but for quality journalism where I pay a subscription for a variety of content.
I want content producers to get paid, I just don't like advertisements and juggling subscriptions.
(for people who haven't been to the US: coupons are printed on the back of the receipt)
Yeah, people always knock pi-hole for not blocking "everything" like browser-based blockers do, but even though it's not perfect it still makes a huge difference. Due to some network changes I had to go without pi-hole for a couple days after having previously used it for years, and you never really appreciate how much crap pi-hole traps until it's gone.
I use pihole to block ads inside apps, it's unmatched for that.
Yes, it should be disabled by default but it not the end of the world. I would hazard a guess that when Chrome implements something similar that it won't be so easy to disable.
Dumpster fire indeed. The user's computer resources are quickly usurped and things slow to a crawl. Users have been trained to be patient I guess, waiting for websites to "load".
Interestingly, I find that many egregiously ad/tracker-laden websites actually "work" well enough without Javascript, meaning the content is readable, sometimes even the images are displayed. For these websites, it does not appear that they are purposely designed to be "unusable" without Javascript enabled. As a text-only browser user, I sometimes perceive some websites "do not work" with Javascript enabled. Trying to view them with the "recommended browser" with Javascript enabled makes the computer so unbearably slow and janky that I give up and go back to turning Javascript off.
Websites that can't manage to load an image without javascript are a pet peeve of mine and they are everywhere. News sites are the worst, but even popular images hosts where displaying images is their entire job fail miserably. At the very least sites that can't load the image should show a direct link to the image but they never do. I'd happily welcome back all the marquee tags and "under construction" banners of the past if we could take web development back to the point where we didn't need several massive JavaScript libraries hosted across multiple domains to do the most task like display an image.
You don't really miss out on anything and actually reward proper sites.
It takes a few minutes to set up pi-hole, and it isn't just for websites either. It happily swallows in-app advertisements. The benefits are extended to anybody on your wifi. What possible reason would you have to not use it?
Adobe don't mind. You wouldn't buy it anyway. What suffers is the cheaper/free competition that is completely starved.
Surely you realize that avoiding disrespectful sites and seeking proper sites will send a message?
Two actually, one that that kind of shit isn't acceptable and second, that you appreciate honest people.
If you can't be bothered then maybe we actually deserve the cesspool we've created.
For example, one commenter wanted a simple "reload without blocking" functionality and the response was to use a bookmarklet plus the Pi-Hole API to disable it temporarily. This works, but the problem is that it disables it temporarily for everyone and will inevitably result in "Hey, why's the ad blocker broken?" "Oh, sorry, that was me" conversations.
Likewise, I'd also like to be able to configure block lists on a per-client basis. I don't want any Facebook stuff (for example) to resolve from my devices, but my girlfriend wants to use Facebook.
Similarly, I may want different rules on different networks. For example, I may want to restrict what my IoT network can resolve differently than my regular user network. This is really just a generalization of doing things on a per-client basis.
Currently the only solution to these types of problems is to maintain multiple Pi-Hole installations. This isn't a big deal if it's just one or two, but it doesn't scale reasonably.
Another would be switching to a purpose-built DNS resolver/cache that had this capability.
Finally, you could have per-client DNS IPs, but this would require the cooperation of the DHCP server, which is less typical on a home network where that's often a closed-source router. But a "super pi-hole" following this pattern could also potentially be the DHCP server. (Yes, raspberry pi can run OpenWRT: https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi)
It serves dead pages for CSS, JS and IMG
Pi-Hole has already gone down this road with their FTLDNS package[0], so it's really a question of where they want the project to go.
[0] https://pi-hole.net/2018/02/22/coming-soon-ftldns-pi-holes-o...
I want to set up once and forget it and it should filter everything, automagically, every device, every browser, from the whole home network, forever. If I want to REALLY check something out I will use my mobile's internet.
Haven’t seen ads in a year and am at this point forgetting what people are so upset about ;)
Need to disable it when testing some google analytics settings or working on Pardot forms.
The other is for me, and my personal devices have been manually set to use it as their DNS. It filters a lot more aggressively as I am more willing to put up with broken stuff for more privacy (eg completely blocking all FB domains, lots of Google stuff, etc). It also means I can suspend mine for a bit if I need to and not have the kids bombarded with ads.
You don't need the VLAN, you can just put the two different wifi networks on different subnets or DNS config depending on your router and you're good to go.
(I do put IoT stuff on a guest VLAN though which can only see the gateway and nothing local in the network).
If you want to temporarily disable it for your computer, maybe switch DNS temporarily? Might even be some plugin for that in the browser?
This allows me to to switch location, and instantly reload a page without the Pi-Hole interfering. Of course this only works on my Mac.
Did you ever have to run the following command to reset Apple's local DNS after switching?
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
[0]nextdns.io
No ETAs as yet, of course, but it's something that has been asked about time and time again, and we think we may just have solved it...
I'm going to guess that there are also major UI changes that will need to come along to make this feature usable. Maybe the release that incorporates everything could be Pi-Hole 5.0?
[1] https://docs.netgate.com/pfsense/en/latest/packages/pfblocke...
https://openwrt.org/docs/guide-user/virtualization/qemu_host
> You can craft a URL that disables pi-hole for X minutes, using the API. You hit the boomark and boom, pi-hole temporarily disabled. If you save it to your phone's home-screen, you've got an instant disable button.
There should be a browser plugin to make this convenient. Maybe a good side project?
It's great, but many blocklists are bad. People often use https://firebog.net/ to get their blocklists, and use only those with a checkmark which are, quote, "least likely to interfere with browsing".
Bollocks, I've had to disable a few of the recommended ones, and adding manual whitelisted hosts because they were blocking legitimate sites (ocsp.apple.com), blocking Windows updates, blocking Instagram altogether!
Anyways, I maintain an 'Ads & Tracking' blocklist that I believe is pretty reliable and you are welcome to give it a try if you like: https://www.github.developerdan.com/hosts/
I've been maintaining my list publicly for over a year, and I've got to say its not always clear what deserves to be blocked, what should be blocked but can't be due to broken functionality, and what is legitimate like the OCSP servers. Everyone has their own personal level of expected privacy vs functionality. Its impossible to make everyone happy. I just wanted to say that being a maintainer of these lists isn't always easy. The obvious example you provided with (ocsp.apple.com) isn't exactly obvious because it _could_ be used for tracking, and it certainly isn't need for functional reasons (although I would argue that it is needed for security reasons). Anyways, there is a lot of gray when it comes to blocking and you can't make everyone happy.
At the end of the day, that’s really all you need as a technical user, so I couldn’t justify he rest of what came with pi-hole, which I believe targets a less tech-savvy crowd.
YMMV and I’m very happy Pi-hole exists, I think I’m just not the target audience.
--
EDIT: see here[0] for an example configuration.
This is what Pihole is...
All extra is just default blocklists, API access, dashboard with stats and settings.
Compared to what I linked above, there's really no comparison in terms of simplicity.
That is what PiHole, in its core, is!
The rest is just for the webserver, dashboard and API. You don't really need that. Sure, you're solution requires less code but I don't think it's easier to setup or manage.
I think this really depends on who you are. For me, using a systemd timer and a systemd service is easier than the set of ad-hoc solutions Pi-hole uses. For someone else, probably Pi-hole is easier. That was my point in the OP.
Adguard DNS is a simple solution for lazy people. Change your DNS server and, well, that's it.
One as container on my Nuc at home for myself, and 2 other on old Pi's (one is a 1st gen B model) for family. A simple cron job to run every 2 months keeps everything up to date. For myself I use Wireguard to only forward DNS packets to the PiHole when I'm outside the house.
If you install a PiHole (and maybe Unchecky.com) your help desk calls from family will drop by 90% (personal experience).
Phoning home is not an Amcrest-specific thing, all of my cameras (I have a handful of Amcrest and D-Link cameras, and one Reolink camera) try to do that. I've put them all in a separate VLAN which can't access anything, not even DNS. The NVR software lives on a different VLAN and is able to open connections to the cameras for recording.
This setup works perfectly. Most importantly, the cameras all work fine even if they can't phone home.
Not to mention the cool toys you can setup to see what is happening
For a home wireless router, you can buy a supported device and install OpenWRT. https://openwrt.org/supported_devices
I believe I also accomplished the same thing with an Asus router/AP running DD-WRT, but that was a long time ago.
Some of them are starting to exhibit mechanical failures - I have one pan/tilt model where the connection between the camera and the rest of the unit has broken, and I have another where the mechanical IR filter is starting to stick and sometimes fails to engage or disengage. I think these failures are primarily age-related and I expect that my Amcrest cameras will eventually start to fail in the same way.
These days my main considerations are whether the camera can serve up an RTSP stream. I do all of the motion detection/notification/recording/viewing/etc via Blue Iris.
Android 9 has support for custom private DNS servers so I just point it to my home IP and works great, no adverts when I'm out of the house.
One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.
DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A
> A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic.
DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.
I hesitate to mention this, as it causes heads to explode, but the problem you're describing is nicely solved with port-knocking. Might be easier than setting up the php page, etc. ...
Edit: found this guide https://www.inmotionhosting.com/support/website/ssh/how-to-u...
Looks like I could just create some bookmarks for the ports and open them sequentially.
I think overall this is a much better solution than messing with php/bash - good idea and thanks!
The gist is, on the client configuration:
1. Set DNS server IP against allowed IP in the peer (which is your wireguard server) section.
2. Set DNS entry to the same IP as above for the client interface.
Ref the discussion and the linked blog post (that talks abt Pi-Hole with wireguard): https://news.ycombinator.com/item?id=19544532, https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun...
DNS = <public-resolver>,<private-reslover>
...wouldn't work?
Edit: per discussion on r/Wireguard, looks like one soln is to run dnsmasq locally on ::53 and forward public queries to the VPN/DNS provider of your choosing and resolve private queries locally.
https://www.reddit.com/r/WireGuard/comments/cmhap6/use_both_...
I guess the main benefit of the PiHole is to have ad blocking on mobile devices, iPads... and others, do you think this is worth the effort of setting up in your experience?
Assuming you're running this on a RPi at home, do you have DynDNS or how are you managing the external IP?
At home I have another pihole running in my router.
I run my Pihole on an Ubuntu system with other things (not running on a Raspberry Pi), so my issues might not be yours. The update process always resets the management port. After rebooting the system, I have to manually restart the Pihole process for Pihole to work.
I've wanted one for a while but just wanna plug it in and go to the web console, not buy it set it up install it etc.
Thanks!
I'm a total newbie and figured it out, but didn't find it "effortless". Lots of instructions to follow.
[0]: https://uk.pi-supply.com/products/pi-hole-kit-network-wide-a...
https://www.adafruit.com/product/3973
and
https://www.adafruit.com/product/3974
I am not affiliated with Adafruit nor do I own either of these products.
It really comes down to where you want to block ads.
Also, I don't know if Ublock Origin actually blocks the ad requests or just prevents them from loading, but if it's the latter, then you can reduce traffic with Pi-hole as well.
One way I've noticed the difference with and without pihole is that most apps on my phone become ad free when I connect to my home network. On most phones ad blockers exist, but those are just another layer of software that needs to be woken when the phone wakes from deep sleep.
I use pihole + uBlock in Firefox with tracking protection (on both mobile and PC) for my browsing, but Pihole saves me the effort of finding a reliable Android system ad blocker that's reasonably power efficient. I'm considering also using it on my laptop as a VM to get the same features on the go.
But piHole can be used for blocking device telemetry. From installed softwares is the OS itself
Someone also claimed TV's from the same manufacturer connects to eachother in a mesh to find a way to phone home but that sounds a little too spectacular...
Is there any possibility Pi-Hole and the DNS server plus hosts file could be used in an attack? Could I setup a web server with identical UI to my target site, get one of the list providers to direct chase.com to my IP, list gets propagated to all Pi-Hole devices, and start collecting credentials?
* F12
* Console tab
* jQuery('body').css('font-weight', '500');
Disabling third party cookies works much better, and for mobile safari using free ka-block.
Like I get depreciating stuff but this seems like it’s still very much in active use? No plan B/transition?
> select filter lists for use in your browser provided that you are using a compatible ad blocker (tested with Adblock Plus, AdBlock and uBlock Origin).
The replacement is any other list of hosts available for PiHole.
"AdGuard Annoyances" or "Fanboy's Annoyance List" and "Fanboy's Cookie List" should do the trick.
However, I recommend enabling "Ignore generic cosmetic filters" in order to not load giant stylesheets into every single page.
I found it worked better for me because the annoyances list was too broad and blocked too many legitimate page elements, such as the <div> containing the play button for NPR podcasts.