10 ms·

Pi-hole: A black hole for Internet advertisements

472 points by DanielRibeiro 7y ago

Piskvorrr 7y ago
[tinfoilhat] Given that Chrome now became Google's weapon against adblocking, how long until it starts refusing to use Pi-hole specifically? https://news.ycombinator.com/item?id=20044430 https://news.ycombinator.com/item?id=20044430 [/tinfoilhat]
- imglorp 7y ago
  How would a web browser know which DNS it's using? You set your DNS preference to point to the PI-hole and it should behave like any other DNS server. I guess it could attempt to resolve some spam domain like doubleclick.net and if it was incorrect it could complain...
  - dbg31415 7y ago
    https://www.xda-developers.com/fix-dns-ad-blocker-chrome/ https://www.xda-developers.com/fix-dns-ad-blocker-chrome/
  - pricecomstock 7y ago
    Sure, but what's to stop any application from choosing some other DNS to use? There was a bit of controversy about FireFox doing exactly that. https://yro.slashdot.org/story/18/08/05/2353249/security-researchers-express-concerns-over-mozillas-new-dns-resolution-for-firefox https://yro.slashdot.org/story/18/08/05/2353249/security-res...
  - voidmain0001 7y ago
    While you're at it, add Blokada to your Android device and it too will eliminate the need for uBlock Origin or Ghostery in Chrome on Android since it's operating outside of the browser's sandbox. Or use Firefox on Android and continue using the ad block plugins it provides. Hopefully Firefox doesn't go away anytime soon...
  - NetBeck 7y ago
    They could force Chrome to use Google's DNS over HTTPS.
    - deleted 7y ago
      [deleted]
  - Nux 7y ago
    There is a clear and definite trend of taking DNS out of the user's control, see all the hype with DNS over HTTPS etc etc. Firefox is working on using DoH (opt-in at the beginning, but who knows) from "select" providers. Chrome has a similar switch, surely. Same with Android 9, opt-in DoH, but maybe it'll become opt-out or no-opt in the future. In the name of privacy and security of course, but with the totally unintended side effect of users unable to dodge ads via DNS/hosts. Interesting, no?
    - wang_li 7y ago
      > There is a clear and definite trend of taking DNS out of the user's control, see all the hype with DNS over HTTPS etc etc. It seems absurd that these companies are blurring the line between software and malware. Software vendors are going to have to start paying for the bandwidth they use on networks against the will of the network operator.
    - deleted 7y ago
      [deleted]
    - ktm5j 7y ago
      The argument you are making is a huge stretch.. Cloudflare is one of the bigger driving forces for DoH and they have nothing to do with ad revenue. Claiming that DoH is some sneaky way to get rid of things like pi-hole is just ridiculous.
      - Nux 7y ago
        DoH in itself is not sneaky, no more than ping is. The push to centralise DNS resolution in the hands of a few questionable actors is and this is what is happening. Cloudflare for example would absolutely love to know what you're up to all day; and because they can now correlate data from their "omnipresent" WAF with the data from 1.1.1.1 they could get some interesting information... And believe you me, they're not sending it to /dev/null.
        kasey_junk 7y ago
        Cloudflare makes a pretty specific statement against what you are saying: "1.1.1.1 does not mine any user data. Logs are kept for 24 hours for debugging purposes, then they are purged." Are you claiming they are lying?
  - e-moe 7y ago
    some of their products already have hardcoded Google DNS. see https://www.reddit.com/r/googlehome/comments/8917ci/google_home_mini_using_its_own_dns_addresses_are/ https://www.reddit.com/r/googlehome/comments/8917ci/google_h...
- dogecoinbase 7y ago
  It already does. This is the purpose of putting a DNS-over-HTTPS resolver into the browser, so you can't bypass it with local resolvers.
  - spaceribs 7y ago
    Couldn't I sign my own pi-hole and add the certificate to my phone/computer?
    - mkl 7y ago
      No use if e.g. Chrome hardcodes Google's servers and ignores the system ones.
      - TrinaryWorksToo 7y ago
        Could you hardcode the ip addresses in your own NAT?
        yjftsjthsd-h 7y ago
        This is, in fact, already sometimes necessary since there are things that will hard code 8.8.8.8.
  - handzbagz1 7y ago
    So you block access to Google's DNS (except for your local DNS server) on your router. And so the arms race continues.
- pjc50 7y ago
  This is the dark side of DNS-over-HTTPs: it prevents the network operator from changing what is received by browsers. Sometimes this is legitimate, as in Pi-hole. Paul Vixie got very upset when he discovered that his chromecast bypasses local DNS settings to go directly to Google: https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671 I wouldn't be surprised if soon Chrome defaults to DNS-over-HTTPs direct to base, except for the corporate intranet version. They just need to work out how to deal with wifi captive portals.
  - dTal 7y ago
    The problem is two mutually incompatible use cases: 1) trusted endpoint / untrusted network (laptop in a coffee shop) 2) untrusted endpoint / trusted network (chromecast/alexa/other corporate zombie on your home network) Which category a given scenario falls under depends on who you ask - to Google, Chromecast is in the first category. I don't know if it's possible to design a system that somehow always favors the rights of the individual.
    - pjc50 7y ago
      > I don't know if it's possible to design a system that somehow always favors the rights of the individual. This is why people keep objecting to technological solutions to social problems. Adblocking is a stopgap technological solution (although very effective at the moment); properly protecting the rights of the individual requires a social and legal process.
      - mi100hael 7y ago
        I disagree. Technical solutions are largely preferable. Political solutions are feeble and can be changed on a whim. If the NSA has the capability to sniff vast amounts of network traffic, encrypting that traffic is a much stronger defense than telling the NSA they aren't allowed to deploy the capability for the time being. If Chrome insists on using its own DNS or removing the adblocking API for add-ons, one can just use another browser like Firefox that has the desired technical capabilities. Managing DNS lookups and HTTP requests are not "stopgap" solutions, they are basic functionality that any one entity can't eradicate.
- lern_too_spel 7y ago
  Chrome's future crippled adblocking support is still more powerful than pi-hole.
- jerf 7y ago
  Conceivably we could take a harder line on this, if we get a little deeper into the routing. We could make it so we only whitelist IP addresses outbound if we saw them come back through our DNS server, and network block everything else. Then if you bypass my DNS server, you don't get to talk to the Internet, unless you directly pick an address that something else has whitelisted that way. I'm thinking about this, and feeling like the PiHole is a nice start, and I mean that sincerely, not sarcastically or dismissively, but what we need is a whole-house reverse firewall with that sort of capabilities, including everything the PiHole already does. If you did TLS interception, you could also pretty much implement uMatrix at the household level, for instance.
  - Piskvorrr 7y ago
    Interesting, interesting. Note that long DNS TTLs will break this: your DNS server needs to hand out artificially short TTLs so that clients will keep re-querying (within the local network).
    - jerf 7y ago
      I was also considering going the opposite direction and given extremely long permissions to the IP in question, i.e., longer than any practical DNS TTL. In general, I'm not too worried about a good IP becoming bad, and if an IP can be both "good" and "bad" this way I'm not going to block it with this technique anyhow. It'd be a potential hole, but if this non-existent project got to the point that it was being that directly targeted, that'd only mean we got pretty successful to even get to that point. :) I should probably make an explicit point that I left implicit; I'm interested in anyone popping up and telling me "Hey, this thing exists already and it's http://..." http://...". (I find myself wondering if I finally found my Rust project...)
tbirrell 7y ago
I keep meaning to set one up one of these days. Does anyone know what effect a Pi-hole has on internet speed? I play a few games where latency is a big deal, and don't really want to artificially throttle my internet.
- dopylitty 7y ago
  It shouldn't have any impact on internet speed as it only comes into the picture for DNS requests. It doesn't sit in line with your internet traffic.
  - x38iq84n 7y ago
    It helps a great deal for web browsing. Having a DNS cache on LAN at 1ms reach speeds up browsing noticeably.
- mewfree 7y ago
  It actually has a positive impact on the Internet speed! Your DNS results are cached locally so the latency is very low, plus blocking ads at the DNS level means you're not even downloading the ad creatives, resulting in a higher speed as well.
- NoNotTheDuo 7y ago
  Echoing other posters. I had the same concern about throttling internet, but realized that your traffic doesn't flow through the pi-hole, just DNS requests (and those are cached). I've noticed no throttling.
- samfriedman 7y ago
  Mine is both the DNS resolver and the DHCP server, due to limitations on my router, and I haven't noticed any big problems with latency/speed.
jdlyga 7y ago
Is it easy to disable adblocking on sites that won't work with adblockers? I like to have the option to disable adblocking in my toolbar. For example, certain bank websites, business websites, etc.
- samhh 7y ago
  Yes, there are both manual whitelists and blacklists. There are also easily accessible options for disabling the adblocker permanently or temporarily, in the latter case on a timer of your choosing e.g. for 5 minutes.
- blantonl 7y ago
  Yes, pihole has an easy to use Web interface that allows you to whitelist individual sites. You can also disable adblocking for 5 minutes, or 10 minutes, or until you tell it to start blocking again.
- logosmonkey 7y ago
  you can add them to your whitelist. It's available through the web interface.
- swozey 7y ago
  People here are gushing amazing over pihole but I don't find it that amazing in the least. In fact what you're describing is one of the most annoying parts of it. I still use it and I did donate to it but it's hardly without it's annoyances. In fact if I didn't already own one I wouldn't build another. There isn't a chrome extension or anything to white list a site quickly. You have to go back into the interface, login, and whitelist, go back and load the page then you'll find that you needed to whitelist a few subdomains/cdns as well. This is really fun when you've got all your devices using the Pihole for DNS and you can't load something on your phone/TV and need to run to your laptop to deal with it. If you just got your pihole you probably threw in a bunch of community generated lists and you'll find a good amount of stuff you do visit gets blocked. You can get to Google but not Google drive, so you whitelist it. And you do this over and over again until you finally get annoyed because you just want to make a car payment so you permanently disable it for 5 minutes, or 60 minutes if you've gotten annoyed enough. Sometimes weeks will go by and you'll forget you even had it disabled at all. FWIW, I also don't use NoScript because I find it incredibly annoying. This is one step further from the NoScript annoyance because you have to go into the webUI and make your changes. If you don't mind NoScript you'll probably be fine with Pihole. Or if you have the time to curate and pick lists that fit exactly within your browsing habits.
bilal4hmed 7y ago
With all the fervor around ad-blocking what I fail to see is how do you propose those sites that you visit, read their content to make money ? Are you willing to pay every site you visit or encourage them to put up pay walls ??
- yulaow 7y ago
  Do not use tracking ads. I whitelist any site which is not using tracking/profiling ads.
- jto1218 7y ago
  you can pretty easily whitelist those sites.
  - aw3c2 7y ago
    Pi-Hole is a very simple DNS based blocker. You can not whitelist ad providers on a origin basis.
    - ztoben 7y ago
      They didn't say whitelist ad providers, they said sites. Which you can do with pi-hole.
      - supergauntlet 7y ago
        How does a DNS blocker know what requests are caused by what site? It's a stateless protocol.
        ztoben 7y ago
        Yeah, that was a misunderstanding on my part. I suppose for their whitelist/blacklist to work with regex matching the ads would have to be served from a similarly named domain. Like facebook.com vs ads.facebook.com, and you'd have to whitelist *facebook.com. And if they were getting ads externally you'd have to whitelist those ads for every site that you visit.
ChikkaChiChi 7y ago
Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!
- bungie4 7y ago
  Agreed, I combined this with Cloudflare's DNS service (1.1.1.1). A great combo.
  - brianpayne2 7y ago
    What are the advantages of using Cloudflare's DNS as opposed to say Google DNS or your ISP? Tracking?
    - ChikkaChiChi 7y ago
      Speed.
    - segfaultbuserr 7y ago
      Due to the architecture of DNS, DNS is not end-to-end encrypted. There is a potential solution (djb's DNSCurve), but it will not be deployed. As a result, let's do an assessment. Using Google DNS, self-hosted resolver, or your ISP's DNS: NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Using CloudFlare's DNS w/ DNS-over-HTTPS: only NSA (via a NSL or subpoena), Cloudflare and CloudFlare's upstream can track and see your requests. And I guess 10%-20% of the domain names already use CloudFlare, so for some domain, it's end-to-end encrypted, nobody but NSA and CloudFlare can track you. Even better, Cloudflare is experimenting with peering to upstreams (e.g. Facebook) using private encrypted connections, so the point-to-point encryption ratio would be even higher in the future. Therefore, using CloudFlare is a net positive. But one also needs to consider its second-order effect: is giving CloudFlare more leverage over the Internet infrastructure in the long run an acceptable choice over unencrypted DNS? I guess everyone has a different opinion.
kdot 7y ago
A router that I can install Pi-hole and host a VPN on would be a dream.
- stu2010 7y ago
  Most MIPS or ARM router CPUs are significantly underpowered to handle OpenVPN, and high-end routers are expensive now. If you're intending to use OpenVPN, you could easily justify a basic x86 pfSense or linux router: https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/ https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...
- rufius 7y ago
  If your run a NAS on your network that has some extra horsepower, most of them can run containers now. I run both pi-hole and my own DNS server inside my network as containers on the NAS. I then have my router configured to default to the pi-hole and then the DNS server. Advantage of my own DNS server is it exclusively resolves using DNS-over-TLS so my queries are private. Final fallback for resolution is 1.1.1.1 but based on logs my setup hasn’t hit the fallback. I imagine you could also use a container to host VPN.
- glup 7y ago
  Not just a dream, but a reality: https://www.pfsense.org/ https://www.pfsense.org/. (pfBlockerNg rather than pi-hole, but I think those are equivalent in functionality; someone correct me if I'm wrong)
- yegle 7y ago
  You don't need to run pihole and VPN from your router. With port forwarding you can use your home lab to do both.
otachack 7y ago
I love pi-hole. It's very passive and easy to use. My only issue was when the pi hosting it went down for whatever reason and I didn't know immediately, so I thought my ISP connection went down. I just had to restart the pi to get it going again. It's only happened once in around 6 months. And it's running on one of my older pi!
- cptskippy 7y ago
  Specify a secondary DNS server to avoid your network going down due to a DNS failure. The downside to this will be that you won't know if the Pi-Hole instance goes down other than possibly seeing Ads.
ronjouch 7y ago
Also, owners or routers able to run OpenWRT (which is actively maintained and in great shape since the merge with LEDE), you have access to several packages providing the same technical solution (DNS-based blocking). As far as I know, the most common and maintained is https://github.com/openwrt/packages/tree/master/net/adblock/files https://github.com/openwrt/packages/tree/master/net/adblock/... . Super easy to install, full-featured, lots of lists to pick from, auto-updates lists, no need for an additional device, and you will benefit from router features produced by the openwrt community and maybe unavailable in your router proprietary firmware. Much recommended. If that sounds attractive and it sounds like a good opportunity to change your crumbling unpatched router, the question "what's today's good cheap router running openwrt without trouble?" is frequently answered by https://www.reddit.com/r/openwrt/ https://www.reddit.com/r/openwrt/ :) .
- creeble 7y ago
  Curious about anyone's experience with adblock for OpenWRT. I use Pi-hole now, and it works great. The one feature that I use quite a lot is the ability to disable it for a short period of time -- when I'm shopping for something, Google ads are sometimes actually useful! I'd say I use that feature about once a month. That's the sum value of advertising for me.
  - ronjouch 7y ago
    OpenWRT's adblock package has a "Suspend" button too. Also, domain whitelisting.
  - teddyc 7y ago
    OpenWRT ships with dnsmasq. You just need to edit /etc/hosts to have all the unwanted domains resolve to 0.0.0.0 I like to get my host list from https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
  - Abishek_Muthian 7y ago
    That's interesting, Where do you see relevant Google Ads while shopping; is it on some product review blogs? Did you check the 'Shopping' tab of Google search?
Jake_Z 7y ago
if only pi-hole could block the in-app ads that served from the same host :( sneaky youtube, the ads are becoming more and more
leeoniya 7y ago
have a nanopc-t4 laying around that i wanna try for a pi-hole + opnsense install. looks like i'll need to add a usb3 ethernet card unless i want to live with 50% the line speed and putz around with tagged vlans using a single nic...although 50% of 1GBit is a lot more throughput than i can get through my isp. anyone have this type of setup?
xchip 7y ago
Anyone doing a pi-hole version for android? We all have an old phone that could be used instead of a rpi.
- dijit 7y ago
  The issue with that is that WiFi is a lot higher latency than Ethernet (even rPi Ethernet which goes over USB) and DNS is one of those things that hurts a bit with higher latency.
  - snazz 7y ago
    You’re right, but there’s nothing stopping you from installing Pi-hole in Termux, I would think, aside from having to run a DNS resolver as a normal user and doing some messy DNS and network configuration. It’d probably be easier to set up by hand than to use Pi-hole.
philjackson 7y ago
Love the name and the product looks amazing.
deleted 7y ago
[deleted]
HugoDaniel 7y ago
The pages you use the most serve some ads from their own domain. E.g. Youtube et. al. Also beware as most ads in your phone apps come from ad intermediaries that are either dynamic or constantly change. Pi-Hole is a cool project but please take in consideration those two when using it. We are far from the 90's in ad-tech.
- IceWreck 7y ago
  Yes, this isn't the ultimate solution, but what you said is an overstatement. The biggies like YouTube, Facebook, Instagram, etc serve ads from their own domains, but almost everything else uses an ad network which can be blocked. > most ads in your phone apps come from ad intermediaries I don't know about the intermediaries you are talking about, but all the ad-ridden proprietary mobile apps that I use (the ones that don't self host ads) are blocked by DNS based ad blockers. The one thing that these DNS based ad blockers can't do however, is block in page annoyances which is why using an extension like uBlock Origin is still necessary.
  - HugoDaniel 7y ago
    It depends on the ad unit in question. Ad-tech is a very tricky world with a ton of meanders and intermediaries/mediators. Anyway good luck with that if the app is using a mediator from a big known name as it will likely block all of their services as well.
- Jake_Z 7y ago
  for those constantly changing ones, like youtube, we could grep all the youtube's ads-serving DNS.. see details here https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtube/253/11 https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtub... it worked pretty well
deleted 7y ago
[deleted]
BrentOzar 7y ago
File this away for the holidays, too: Pi-holes and NAS backup devices make good gifts. I know it doesn’t sound very sentimental, but the first time I showed my relatives what the Internet looks like without ads, I think those were the strongest hugs I ever got from family members.
- ris 7y ago
  Are these devices maintained by someone or are they sitting there running years-old crumbling stacks?
philjackson 7y ago
I've just tried it via the install script they provide and it was amazing. Took me through a simple checklist of stuff automating everything it could and giving me nice Curses interfaces for stuff where it needed me. Up and running within 5 mins!
dokka 7y ago
Pi-hole is fantastic and I will gladly donate to them.
jackallis 7y ago
i am very much intrigued by this, atleast from consumer prespective. I am completed noob, is it "simple" enought to set up?
- baseballdork 7y ago
  You'll need to be able to install Raspbian, run the install script, give it a static ip address and configure your router to use that ip address as its DNS server.
misiti3780 7y ago
Anyone else seeing: [] Root user check \e[1;32m.;;,. .ccccc:,. :cccclll:. ..,, :ccccclll. ;ooodc 'ccll:;ll .oooodc .;cll.;;looo:. \e[1;31m.. ','. .',,,,,,'. .',,,,,,,,,,. .',,,,,,,,,,,,.... ....''',,,,,,,'....... ......... .... ......... .......... .......... .......... .......... ......... .... ......... ........,,,,,,,'...... ....',,,,,,,,,,,,. .',,,,,,,,,'. .',,,,,,'. ..'''.\e[0m [] OS distribution not supported
WalterSobchak 7y ago
Previous discussion from a few months ago: https://news.ycombinator.com/item?id=19258717 https://news.ycombinator.com/item?id=19258717
- deleted 7y ago
  [deleted]
OrgNet 7y ago
Couldn't apps start hard coding DNS servers to avoid pi-holes?
- Nas808 7y ago
  Some already do (Chromecast, Google Home devices).
jwr 7y ago
Is this available as a Synology package I could install on my Synology NAS?
- drwagner 7y ago
  Not directly but, depending on your Synology model, you can install it via Docker. I've been using it in that fashion and has been extremely stable.
jrgoj 7y ago
Interesting. How would this integrate into a network running DNS Resolver (i.e. Unbound) in pfSense?
nutbutter 7y ago
https://www.lostinablackhole.com/ https://www.lostinablackhole.com/
Theizestooke 7y ago
Apparently it blocks some domains necessary for the Washington Post articles to load. Whitelisting washingtonpost.com doesn't remove the adblock notice :(
- neuronic 7y ago
  Can you check which domains don't resolve using dev tools and check if they are on the pi-hole block lists?
someexgamedev 7y ago
Why hasn't anyone, or pi-hole themselves, made a public DNS that does this? Pass everything not on the blocklist thru to 1.1.1.1. The fact that this requires special hardware, bash commands, etc is severely limiting the audience. The more people blocking ads the quicker the internet changes. Edit: thanks for the replies!
- vengefulduck 7y ago
  AdGuard DNS does something like this.
- jamesog 7y ago
  They have: nextdns.io There was discussion a few days ago: https://news.ycombinator.com/item?id=20012687 https://news.ycombinator.com/item?id=20012687
  - jqueryin 7y ago
    I'm slightly concerned about routing my traffic through a non-major player in Anycast when I don't control the routing or software. I'd be worried it's quite an easy target for someone to do some DNS hijacking or packet sniffing. There's a certain level of trust when I use 1.1.1.1 or 8.8.8.8. I'm unwilling to take the risk for this solution. I'm not sure what would help in the trust department to legitimize a solution like this.
    - jamesog 7y ago
      This is why you should use their DNS-over-TLS or DNS-over-HTTPS service instead of standard DNS. Route hijacks can happen to anyone, even Cloudflare or Google. If anything they're more likely to be targetted than a smaller player like Nextdns.
      - jqueryin 7y ago
        The difference is one has a dedicated security team and the other does not.
F00Fbug 7y ago
If you're running some type of hypervisor (ESXi, Proxmox, etc.), you can create a tiny VM running Debian and load Pi-hole on it. No need for extra hardware and wires.
- nawtacawp 7y ago
  I use ESXi and one of the VMs is pfSense. pfSense has an additional software package called pfBlocker, which is highly configurable and just plan awesome for blockings ads/trackers/etc for the LAN. pfSense has tons of other options - I setup a vLAN and all of my IoT devices are segregated onto it. That way they can't interact with the rest of the devices on the LAN.
  - F00Fbug 7y ago
    Yep... my pfSense is virtualized, too. I need to get pfBlocker configured, but pi-hole works so well, I'm too lazy to do anything about it! I'm also working on an IoT VLAN - that Ring doorbell is a chatty Kathy!
- whalesalad 7y ago
  I run mine on exactly that: a Dell R720 sitting on a rack next to my desk from within a Debian 9 virtual machine inside ESXi. I actually want to do the opposite: transition this to dedicated hardware (like a Pi, but worried about performance) that is a little less noisy. This is shockingly quiet for a 2U but I am a stickler for silence. Some pix: https://imgur.com/a/0xwcfNN https://imgur.com/a/0xwcfNN
40four 7y ago
Pi-hole is fantastic! I run it on my Rockpro64 at home. Previous discussions => https://news.ycombinator.com/item?id=19258717 https://news.ycombinator.com/item?id=19258717 https://news.ycombinator.com/item?id=13857887 https://news.ycombinator.com/item?id=13857887
drhayes9 7y ago
I'm running pi-hole in a docker container on an Intel NUC; no need for an actual-factual Raspberry Pi. Works great.
pixelbath 7y ago
Given how Google has, literally this morning, informed me that they're discontinuing text-only AdSense units, I can't think of a more appropriate time.
zaroth 7y ago
I haven’t tried Pi-Hole yet but this was the impetus I needed to decide to set it up tonight. I commented on a different post last night, that I was a bit shocked and saddened to see their Patreon is only pulling in $1,700/mo. Do they have another significant revenue stream? Is it just too much hassle to bother signing up to Patreon to commit to even $1/mo? Do they have something on the Admin panel where users can click to pay directly? I’m not judging, I don’t even have a Patreon account. I’m curious how such an apparently crucial and useful piece of software — one that no doubt is responsible for providing millions of dollars of value to its users, and perhaps blocking tens of millions of dollars in ads — how can the project be sustainable after 53 releases and 2,700 issues on Github while pulling in less than $24k/yr?
- pjc50 7y ago
  > only pulling in $1,700/mo. This is an astonishingly huge amount of money for an open source project to raise directly from its users. Most open source projects get basically nothing.
- deleted 7y ago
  [deleted]
creeble 7y ago
Can you tell from the command line what version Pi you're running? I think mine's an original B+, but not sure. I typically get sub-millisecond DNS resolution (presumably from cache). >root@pihole:~# uptime > 17:02:51 up 587 days, 22:34, 1 user, load average: 0.03, 0.03, 0.05
- jrace 7y ago
  cat /proc/cpuinfo
asveikau 7y ago
I was looking at their github repo and couldn't immediately see where pihole gets its block lists, just a very large soup of shell scripting that seems to make a lot of assumptions about your Linux distro. Anybody familiar with this code able to point out where it does the "interesting" work?
sneak 7y ago
Pi-hole users should know that in the default configuration it allows your ISP to reconfigure your blocklists at will due to lack of authentication: https://github.com/pi-hole/pi-hole/issues/2704 https://github.com/pi-hole/pi-hole/issues/2704
mikepasek 7y ago
Ad blocking via DNS is relatively easy right now because a content provider like CNN.com will use a domain like “ads.evil-surveillance-media.com” to load their ads into your browser. But what happens if all these companies switch to just using their own domain to load ads? If the ads as well as the content BOTH come from CNN.com then there will be no easy way to filter the ads out. This will be the next stage in this war between ads and adblockers.
- nerdponx 7y ago
  I'm already seeing this happen in some cases. Or they serve it from an opaque CDN alongside the functional site code.
- Lxr 7y ago
  This. Router-level blocking will become impossible without intercepting https, and endpoint blocking also gets harder.
- matoro 7y ago
  This has been warned about for a while now and it's not actually terribly difficult for sites to implement. Why don't they? Simple - click fraud. The ad networks don't trust the sites to accurately report click numbers, so they insist on running their own code. For this reason, the number of truly first-party ads will be limited for a long while.
- ben509 7y ago
  Adblocker plugins already do content-level filtering because of this, not just for ads but various tracking and other annoyances. I do that for the sites that have the banner that hides if you scroll down, but pops out the moment you scroll one pixel back, or sites that put up "please don't leave me" modals the moment your cursor strays out of the window.
- uponcoffee 7y ago
  With the prevelence of ad blocking tech, the question becomes why haven't they already? The answer being that content providers can't be trusted to self report metrics that determine how much advertises pay. At least not for pay per view/client/etc models. The people that self select themselves from viewing advertisements might be doing advertisers a favor. They're perhaps less likely to make purchases based on impressions//click ads on purpose; per dollar, ad campaigns might be more effective without said people.
nerdponx 7y ago
I assume, like everything else, Pi-Hole usage can be detected and used to fingerprint users?
rolltiide 7y ago
can this block Hulu ads and maintain access?
ancaster 7y ago
Does anyone have a recipe for using pihole via OpenVPN using docker? I'm using this[1] but I'm surprised there isn't something more official/baked. [1] https://github.com/mr-bolle/docker-openvpn-pihole https://github.com/mr-bolle/docker-openvpn-pihole
- ampsonic 7y ago
  I just set this up yesterday, was quite easy. https://hub.docker.com/r/linuxserver/openvpn-as/ https://hub.docker.com/r/linuxserver/openvpn-as/
LocalPCGuy 7y ago
I haven't moved mine off of the Pi personally, but I've read positive reports of people using Digital Ocean or similar to host PI-Hole. That could also, in theory, allow it to be used while remote or for mobile devices.
- deleted 7y ago
  [deleted]
ampsonic 7y ago
I have set up a Siri Shortcut on my phone so that I can disable the blocking for 5 minutes very easily. Highly recommended if you have family members that occasionally need something unblocked.
- ekblom 7y ago
  How does one acquire this kind of magic?
bmedwar 7y ago
content is blocked in non-browser locations, such as ad-laden mobile apps and smart TVs
llamataboot 7y ago
I love the pi-hole, but I can't seem to figure out how to get resolving of .local hostnames back when I use it. Like, I can no longer ping my media server at media.local, I have to use the exact IP address. Not a deal breaker, but annoying.
- whalesalad 7y ago
  Make sure Pihole has your local DHCP/DNS server setup as the first resolver. So it will check your router for example before checking externally. Then again, you might be using Pihole as your DHCP server? Explain your setup some more and I can add more details.
- StreamBright 7y ago
  Yes, there are few things like that. I think this project is a good start but needs some features like local zone support (being the authoritative NS for you local domain).
- foxyv 7y ago
  If you point the PiHole Upstream DNS to your router's DNS (Or whatever DNS server is hosting the .local domains) it should resolve .local hostnames again. I think by default it uses 8.8.8.8 or 8.8.4.4 https://discourse.pi-hole.net/t/change-upstream-dns-server-ip/7808/2 https://discourse.pi-hole.net/t/change-upstream-dns-server-i...
  - llamataboot 7y ago
    Thanks! I've tried that, but then got switched around with what was pointing where. DNS is definitely a part of the stack that still confuses me, despite on the surface seeming somewhat simple!
- programmarchy 7y ago
  I thought .local names used mDNS. Not sure why pi-hole would interfere with that.
patentatt 7y ago
Pro-tip: pi-hole will eat SD cards in a rpi if you enable logging. Use industrial flash (e.g., seissbit) to avoid a headache every six months.
- Teledhil 7y ago
  If you don't care about persistent logs, you can mount the /var/log directory on tmpfs. For example, add to your /etc/fstab: tmpfs /var/log tmpfs nosuid,nodev 0 0
ycombonator 7y ago
I run pihole on Raspberry Pi with recommended block lists and it’s been an absolute pleasure. Raspberry Pi runs with a static IP I changed DNS settings the devices I want to go through pihole.
mavsman 7y ago
I like Pi-hole but it ended up causing more trouble than it was worth for me. First, certain streaming websites would fail and it was too much trouble to try to find the URL to whitelist. Then after I had disabled it from the Pi-hole interface everything was fine but it wasn't actually active. No problem...until I forgot my router was using it as a DNS server and I moved and didn't set my Pi up yet. Then it took me a couple weeks going back and forth with Comcast to find out that my router was still pointing to a DNS server that wasn't running. Somehow my FireTV bypassed the bad DNS server at one point (still no idea how this happened cause my router was routing all traffic through the IP for pi-hole) and that made me realize that I can get data from Comcast somehow so maybe it really was my router.
javipas 7y ago
I was planning on installing this on my RPi3B but I wonder due to its low compute power could result in a somewhat slower experience in my home network. Could anyone comment on what his experience has been in this case?
hosteur 7y ago
I love the idea of pi-hole. However, I run my own local DNS server already. And my DNS server is actually serving some local domains for various servers, etc. on the network. Can I in any way get the list of domains to block from the pi-hole project and use them in my own regular Bind DNS server?

472 points by DanielRibeiro 7y ago

[tinfoilhat] Given that Chrome now became Google's weapon against adblocking, how long until it starts refusing to use Pi-hole specifically? https://news.ycombinator.com/item?id=20044430 https://news.ycombinator.com/item?id=20044430 [/tinfoilhat]

imglorp 7y ago
How would a web browser know which DNS it's using? You set your DNS preference to point to the PI-hole and it should behave like any other DNS server. I guess it could attempt to resolve some spam domain like doubleclick.net and if it was incorrect it could complain...
- dbg31415 7y ago
  https://www.xda-developers.com/fix-dns-ad-blocker-chrome/ https://www.xda-developers.com/fix-dns-ad-blocker-chrome/
- pricecomstock 7y ago
  Sure, but what's to stop any application from choosing some other DNS to use? There was a bit of controversy about FireFox doing exactly that. https://yro.slashdot.org/story/18/08/05/2353249/security-researchers-express-concerns-over-mozillas-new-dns-resolution-for-firefox https://yro.slashdot.org/story/18/08/05/2353249/security-res...
- voidmain0001 7y ago
  While you're at it, add Blokada to your Android device and it too will eliminate the need for uBlock Origin or Ghostery in Chrome on Android since it's operating outside of the browser's sandbox. Or use Firefox on Android and continue using the ad block plugins it provides. Hopefully Firefox doesn't go away anytime soon...
- NetBeck 7y ago
  They could force Chrome to use Google's DNS over HTTPS.
  - deleted 7y ago
    [deleted]
- Nux 7y ago
  There is a clear and definite trend of taking DNS out of the user's control, see all the hype with DNS over HTTPS etc etc. Firefox is working on using DoH (opt-in at the beginning, but who knows) from "select" providers. Chrome has a similar switch, surely. Same with Android 9, opt-in DoH, but maybe it'll become opt-out or no-opt in the future. In the name of privacy and security of course, but with the totally unintended side effect of users unable to dodge ads via DNS/hosts. Interesting, no?
  - wang_li 7y ago
    > There is a clear and definite trend of taking DNS out of the user's control, see all the hype with DNS over HTTPS etc etc. It seems absurd that these companies are blurring the line between software and malware. Software vendors are going to have to start paying for the bandwidth they use on networks against the will of the network operator.
  - deleted 7y ago
    [deleted]
  - ktm5j 7y ago
    The argument you are making is a huge stretch.. Cloudflare is one of the bigger driving forces for DoH and they have nothing to do with ad revenue. Claiming that DoH is some sneaky way to get rid of things like pi-hole is just ridiculous.
    - Nux 7y ago
      DoH in itself is not sneaky, no more than ping is. The push to centralise DNS resolution in the hands of a few questionable actors is and this is what is happening. Cloudflare for example would absolutely love to know what you're up to all day; and because they can now correlate data from their "omnipresent" WAF with the data from 1.1.1.1 they could get some interesting information... And believe you me, they're not sending it to /dev/null.
      - kasey_junk 7y ago
        Cloudflare makes a pretty specific statement against what you are saying: "1.1.1.1 does not mine any user data. Logs are kept for 24 hours for debugging purposes, then they are purged." Are you claiming they are lying?
- e-moe 7y ago
  some of their products already have hardcoded Google DNS. see https://www.reddit.com/r/googlehome/comments/8917ci/google_home_mini_using_its_own_dns_addresses_are/ https://www.reddit.com/r/googlehome/comments/8917ci/google_h...
dogecoinbase 7y ago
It already does. This is the purpose of putting a DNS-over-HTTPS resolver into the browser, so you can't bypass it with local resolvers.
- spaceribs 7y ago
  Couldn't I sign my own pi-hole and add the certificate to my phone/computer?
  - mkl 7y ago
    No use if e.g. Chrome hardcodes Google's servers and ignores the system ones.
    - TrinaryWorksToo 7y ago
      Could you hardcode the ip addresses in your own NAT?
      - yjftsjthsd-h 7y ago
        This is, in fact, already sometimes necessary since there are things that will hard code 8.8.8.8.
- handzbagz1 7y ago
  So you block access to Google's DNS (except for your local DNS server) on your router. And so the arms race continues.
pjc50 7y ago
This is the dark side of DNS-over-HTTPs: it prevents the network operator from changing what is received by browsers. Sometimes this is legitimate, as in Pi-hole. Paul Vixie got very upset when he discovered that his chromecast bypasses local DNS settings to go directly to Google: https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671 I wouldn't be surprised if soon Chrome defaults to DNS-over-HTTPs direct to base, except for the corporate intranet version. They just need to work out how to deal with wifi captive portals.
- dTal 7y ago
  The problem is two mutually incompatible use cases: 1) trusted endpoint / untrusted network (laptop in a coffee shop) 2) untrusted endpoint / trusted network (chromecast/alexa/other corporate zombie on your home network) Which category a given scenario falls under depends on who you ask - to Google, Chromecast is in the first category. I don't know if it's possible to design a system that somehow always favors the rights of the individual.
  - pjc50 7y ago
    > I don't know if it's possible to design a system that somehow always favors the rights of the individual. This is why people keep objecting to technological solutions to social problems. Adblocking is a stopgap technological solution (although very effective at the moment); properly protecting the rights of the individual requires a social and legal process.
    - mi100hael 7y ago
      I disagree. Technical solutions are largely preferable. Political solutions are feeble and can be changed on a whim. If the NSA has the capability to sniff vast amounts of network traffic, encrypting that traffic is a much stronger defense than telling the NSA they aren't allowed to deploy the capability for the time being. If Chrome insists on using its own DNS or removing the adblocking API for add-ons, one can just use another browser like Firefox that has the desired technical capabilities. Managing DNS lookups and HTTP requests are not "stopgap" solutions, they are basic functionality that any one entity can't eradicate.
lern_too_spel 7y ago
Chrome's future crippled adblocking support is still more powerful than pi-hole.
jerf 7y ago
Conceivably we could take a harder line on this, if we get a little deeper into the routing. We could make it so we only whitelist IP addresses outbound if we saw them come back through our DNS server, and network block everything else. Then if you bypass my DNS server, you don't get to talk to the Internet, unless you directly pick an address that something else has whitelisted that way. I'm thinking about this, and feeling like the PiHole is a nice start, and I mean that sincerely, not sarcastically or dismissively, but what we need is a whole-house reverse firewall with that sort of capabilities, including everything the PiHole already does. If you did TLS interception, you could also pretty much implement uMatrix at the household level, for instance.
- Piskvorrr 7y ago
  Interesting, interesting. Note that long DNS TTLs will break this: your DNS server needs to hand out artificially short TTLs so that clients will keep re-querying (within the local network).
  - jerf 7y ago
    I was also considering going the opposite direction and given extremely long permissions to the IP in question, i.e., longer than any practical DNS TTL. In general, I'm not too worried about a good IP becoming bad, and if an IP can be both "good" and "bad" this way I'm not going to block it with this technique anyhow. It'd be a potential hole, but if this non-existent project got to the point that it was being that directly targeted, that'd only mean we got pretty successful to even get to that point. :) I should probably make an explicit point that I left implicit; I'm interested in anyone popping up and telling me "Hey, this thing exists already and it's http://..." http://...". (I find myself wondering if I finally found my Rust project...)

tbirrell 7y ago

I keep meaning to set one up one of these days. Does anyone know what effect a Pi-hole has on internet speed? I play a few games where latency is a big deal, and don't really want to artificially throttle my internet.

dopylitty 7y ago
It shouldn't have any impact on internet speed as it only comes into the picture for DNS requests. It doesn't sit in line with your internet traffic.
- x38iq84n 7y ago
  It helps a great deal for web browsing. Having a DNS cache on LAN at 1ms reach speeds up browsing noticeably.
mewfree 7y ago
It actually has a positive impact on the Internet speed! Your DNS results are cached locally so the latency is very low, plus blocking ads at the DNS level means you're not even downloading the ad creatives, resulting in a higher speed as well.
NoNotTheDuo 7y ago
Echoing other posters. I had the same concern about throttling internet, but realized that your traffic doesn't flow through the pi-hole, just DNS requests (and those are cached). I've noticed no throttling.
samfriedman 7y ago
Mine is both the DNS resolver and the DHCP server, due to limitations on my router, and I haven't noticed any big problems with latency/speed.

jdlyga 7y ago

Is it easy to disable adblocking on sites that won't work with adblockers? I like to have the option to disable adblocking in my toolbar. For example, certain bank websites, business websites, etc.

samhh 7y ago
Yes, there are both manual whitelists and blacklists. There are also easily accessible options for disabling the adblocker permanently or temporarily, in the latter case on a timer of your choosing e.g. for 5 minutes.
blantonl 7y ago
Yes, pihole has an easy to use Web interface that allows you to whitelist individual sites. You can also disable adblocking for 5 minutes, or 10 minutes, or until you tell it to start blocking again.
logosmonkey 7y ago
you can add them to your whitelist. It's available through the web interface.
swozey 7y ago
People here are gushing amazing over pihole but I don't find it that amazing in the least. In fact what you're describing is one of the most annoying parts of it. I still use it and I did donate to it but it's hardly without it's annoyances. In fact if I didn't already own one I wouldn't build another. There isn't a chrome extension or anything to white list a site quickly. You have to go back into the interface, login, and whitelist, go back and load the page then you'll find that you needed to whitelist a few subdomains/cdns as well. This is really fun when you've got all your devices using the Pihole for DNS and you can't load something on your phone/TV and need to run to your laptop to deal with it. If you just got your pihole you probably threw in a bunch of community generated lists and you'll find a good amount of stuff you do visit gets blocked. You can get to Google but not Google drive, so you whitelist it. And you do this over and over again until you finally get annoyed because you just want to make a car payment so you permanently disable it for 5 minutes, or 60 minutes if you've gotten annoyed enough. Sometimes weeks will go by and you'll forget you even had it disabled at all. FWIW, I also don't use NoScript because I find it incredibly annoying. This is one step further from the NoScript annoyance because you have to go into the webUI and make your changes. If you don't mind NoScript you'll probably be fine with Pihole. Or if you have the time to curate and pick lists that fit exactly within your browsing habits.

bilal4hmed 7y ago

With all the fervor around ad-blocking what I fail to see is how do you propose those sites that you visit, read their content to make money ? Are you willing to pay every site you visit or encourage them to put up pay walls ??

yulaow 7y ago
Do not use tracking ads. I whitelist any site which is not using tracking/profiling ads.
jto1218 7y ago
you can pretty easily whitelist those sites.
- aw3c2 7y ago
  Pi-Hole is a very simple DNS based blocker. You can not whitelist ad providers on a origin basis.
  - ztoben 7y ago
    They didn't say whitelist ad providers, they said sites. Which you can do with pi-hole.
    - supergauntlet 7y ago
      How does a DNS blocker know what requests are caused by what site? It's a stateless protocol.
      - ztoben 7y ago
        Yeah, that was a misunderstanding on my part. I suppose for their whitelist/blacklist to work with regex matching the ads would have to be served from a similarly named domain. Like facebook.com vs ads.facebook.com, and you'd have to whitelist *facebook.com. And if they were getting ads externally you'd have to whitelist those ads for every site that you visit.

ChikkaChiChi 7y ago

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

bungie4 7y ago
Agreed, I combined this with Cloudflare's DNS service (1.1.1.1). A great combo.
- brianpayne2 7y ago
  What are the advantages of using Cloudflare's DNS as opposed to say Google DNS or your ISP? Tracking?
  - ChikkaChiChi 7y ago
    Speed.
  - segfaultbuserr 7y ago
    Due to the architecture of DNS, DNS is not end-to-end encrypted. There is a potential solution (djb's DNSCurve), but it will not be deployed. As a result, let's do an assessment. Using Google DNS, self-hosted resolver, or your ISP's DNS: NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Using CloudFlare's DNS w/ DNS-over-HTTPS: only NSA (via a NSL or subpoena), Cloudflare and CloudFlare's upstream can track and see your requests. And I guess 10%-20% of the domain names already use CloudFlare, so for some domain, it's end-to-end encrypted, nobody but NSA and CloudFlare can track you. Even better, Cloudflare is experimenting with peering to upstreams (e.g. Facebook) using private encrypted connections, so the point-to-point encryption ratio would be even higher in the future. Therefore, using CloudFlare is a net positive. But one also needs to consider its second-order effect: is giving CloudFlare more leverage over the Internet infrastructure in the long run an acceptable choice over unencrypted DNS? I guess everyone has a different opinion.

kdot 7y ago

A router that I can install Pi-hole and host a VPN on would be a dream.

stu2010 7y ago
Most MIPS or ARM router CPUs are significantly underpowered to handle OpenVPN, and high-end routers are expensive now. If you're intending to use OpenVPN, you could easily justify a basic x86 pfSense or linux router: https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/ https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...
rufius 7y ago
If your run a NAS on your network that has some extra horsepower, most of them can run containers now. I run both pi-hole and my own DNS server inside my network as containers on the NAS. I then have my router configured to default to the pi-hole and then the DNS server. Advantage of my own DNS server is it exclusively resolves using DNS-over-TLS so my queries are private. Final fallback for resolution is 1.1.1.1 but based on logs my setup hasn’t hit the fallback. I imagine you could also use a container to host VPN.
glup 7y ago
Not just a dream, but a reality: https://www.pfsense.org/ https://www.pfsense.org/. (pfBlockerNg rather than pi-hole, but I think those are equivalent in functionality; someone correct me if I'm wrong)
yegle 7y ago
You don't need to run pihole and VPN from your router. With port forwarding you can use your home lab to do both.

otachack 7y ago

I love pi-hole. It's very passive and easy to use. My only issue was when the pi hosting it went down for whatever reason and I didn't know immediately, so I thought my ISP connection went down. I just had to restart the pi to get it going again. It's only happened once in around 6 months. And it's running on one of my older pi!

cptskippy 7y ago
Specify a secondary DNS server to avoid your network going down due to a DNS failure. The downside to this will be that you won't know if the Pi-Hole instance goes down other than possibly seeing Ads.

ronjouch 7y ago

Also, owners or routers able to run OpenWRT (which is actively maintained and in great shape since the merge with LEDE), you have access to several packages providing the same technical solution (DNS-based blocking). As far as I know, the most common and maintained is https://github.com/openwrt/packages/tree/master/net/adblock/files https://github.com/openwrt/packages/tree/master/net/adblock/... . Super easy to install, full-featured, lots of lists to pick from, auto-updates lists, no need for an additional device, and you will benefit from router features produced by the openwrt community and maybe unavailable in your router proprietary firmware. Much recommended. If that sounds attractive and it sounds like a good opportunity to change your crumbling unpatched router, the question "what's today's good cheap router running openwrt without trouble?" is frequently answered by https://www.reddit.com/r/openwrt/ https://www.reddit.com/r/openwrt/ :) .

creeble 7y ago
Curious about anyone's experience with adblock for OpenWRT. I use Pi-hole now, and it works great. The one feature that I use quite a lot is the ability to disable it for a short period of time -- when I'm shopping for something, Google ads are sometimes actually useful! I'd say I use that feature about once a month. That's the sum value of advertising for me.
- ronjouch 7y ago
  OpenWRT's adblock package has a "Suspend" button too. Also, domain whitelisting.
- teddyc 7y ago
  OpenWRT ships with dnsmasq. You just need to edit /etc/hosts to have all the unwanted domains resolve to 0.0.0.0 I like to get my host list from https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- Abishek_Muthian 7y ago
  That's interesting, Where do you see relevant Google Ads while shopping; is it on some product review blogs? Did you check the 'Shopping' tab of Google search?

Jake_Z 7y ago

if only pi-hole could block the in-app ads that served from the same host :( sneaky youtube, the ads are becoming more and more

leeoniya 7y ago

have a nanopc-t4 laying around that i wanna try for a pi-hole + opnsense install. looks like i'll need to add a usb3 ethernet card unless i want to live with 50% the line speed and putz around with tagged vlans using a single nic...although 50% of 1GBit is a lot more throughput than i can get through my isp. anyone have this type of setup?

xchip 7y ago

Anyone doing a pi-hole version for android? We all have an old phone that could be used instead of a rpi.

dijit 7y ago
The issue with that is that WiFi is a lot higher latency than Ethernet (even rPi Ethernet which goes over USB) and DNS is one of those things that hurts a bit with higher latency.
- snazz 7y ago
  You’re right, but there’s nothing stopping you from installing Pi-hole in Termux, I would think, aside from having to run a DNS resolver as a normal user and doing some messy DNS and network configuration. It’d probably be easier to set up by hand than to use Pi-hole.

philjackson 7y ago

Love the name and the product looks amazing.

deleted 7y ago

[deleted]

HugoDaniel 7y ago

The pages you use the most serve some ads from their own domain. E.g. Youtube et. al. Also beware as most ads in your phone apps come from ad intermediaries that are either dynamic or constantly change. Pi-Hole is a cool project but please take in consideration those two when using it. We are far from the 90's in ad-tech.

IceWreck 7y ago
Yes, this isn't the ultimate solution, but what you said is an overstatement. The biggies like YouTube, Facebook, Instagram, etc serve ads from their own domains, but almost everything else uses an ad network which can be blocked. > most ads in your phone apps come from ad intermediaries I don't know about the intermediaries you are talking about, but all the ad-ridden proprietary mobile apps that I use (the ones that don't self host ads) are blocked by DNS based ad blockers. The one thing that these DNS based ad blockers can't do however, is block in page annoyances which is why using an extension like uBlock Origin is still necessary.
- HugoDaniel 7y ago
  It depends on the ad unit in question. Ad-tech is a very tricky world with a ton of meanders and intermediaries/mediators. Anyway good luck with that if the app is using a mediator from a big known name as it will likely block all of their services as well.
Jake_Z 7y ago
for those constantly changing ones, like youtube, we could grep all the youtube's ads-serving DNS.. see details here https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtube/253/11 https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtub... it worked pretty well

deleted 7y ago

[deleted]

BrentOzar 7y ago

File this away for the holidays, too: Pi-holes and NAS backup devices make good gifts. I know it doesn’t sound very sentimental, but the first time I showed my relatives what the Internet looks like without ads, I think those were the strongest hugs I ever got from family members.

ris 7y ago
Are these devices maintained by someone or are they sitting there running years-old crumbling stacks?

philjackson 7y ago

I've just tried it via the install script they provide and it was amazing. Took me through a simple checklist of stuff automating everything it could and giving me nice Curses interfaces for stuff where it needed me. Up and running within 5 mins!

dokka 7y ago

Pi-hole is fantastic and I will gladly donate to them.

jackallis 7y ago

i am very much intrigued by this, atleast from consumer prespective. I am completed noob, is it "simple" enought to set up?

baseballdork 7y ago
You'll need to be able to install Raspbian, run the install script, give it a static ip address and configure your router to use that ip address as its DNS server.

misiti3780 7y ago

Anyone else seeing: [] Root user check \e[1;32m.;;,. .ccccc:,. :cccclll:. ..,, :ccccclll. ;ooodc 'ccll:;ll .oooodc .;cll.;;looo:. \e[1;31m.. ','. .',,,,,,'. .',,,,,,,,,,. .',,,,,,,,,,,,.... ....''',,,,,,,'....... ......... .... ......... .......... .......... .......... .......... ......... .... ......... ........,,,,,,,'...... ....',,,,,,,,,,,,. .',,,,,,,,,'. .',,,,,,'. ..'''.\e[0m [] OS distribution not supported

WalterSobchak 7y ago

Previous discussion from a few months ago: https://news.ycombinator.com/item?id=19258717 https://news.ycombinator.com/item?id=19258717

deleted 7y ago
[deleted]

OrgNet 7y ago

Couldn't apps start hard coding DNS servers to avoid pi-holes?

Nas808 7y ago
Some already do (Chromecast, Google Home devices).

jwr 7y ago

Is this available as a Synology package I could install on my Synology NAS?

drwagner 7y ago
Not directly but, depending on your Synology model, you can install it via Docker. I've been using it in that fashion and has been extremely stable.

jrgoj 7y ago

Interesting. How would this integrate into a network running DNS Resolver (i.e. Unbound) in pfSense?

nutbutter 7y ago

https://www.lostinablackhole.com/ https://www.lostinablackhole.com/

Theizestooke 7y ago

Apparently it blocks some domains necessary for the Washington Post articles to load. Whitelisting washingtonpost.com doesn't remove the adblock notice :(

neuronic 7y ago
Can you check which domains don't resolve using dev tools and check if they are on the pi-hole block lists?

someexgamedev 7y ago

Why hasn't anyone, or pi-hole themselves, made a public DNS that does this? Pass everything not on the blocklist thru to 1.1.1.1. The fact that this requires special hardware, bash commands, etc is severely limiting the audience. The more people blocking ads the quicker the internet changes. Edit: thanks for the replies!

vengefulduck 7y ago
AdGuard DNS does something like this.
jamesog 7y ago
They have: nextdns.io There was discussion a few days ago: https://news.ycombinator.com/item?id=20012687 https://news.ycombinator.com/item?id=20012687
- jqueryin 7y ago
  I'm slightly concerned about routing my traffic through a non-major player in Anycast when I don't control the routing or software. I'd be worried it's quite an easy target for someone to do some DNS hijacking or packet sniffing. There's a certain level of trust when I use 1.1.1.1 or 8.8.8.8. I'm unwilling to take the risk for this solution. I'm not sure what would help in the trust department to legitimize a solution like this.
  - jamesog 7y ago
    This is why you should use their DNS-over-TLS or DNS-over-HTTPS service instead of standard DNS. Route hijacks can happen to anyone, even Cloudflare or Google. If anything they're more likely to be targetted than a smaller player like Nextdns.
    - jqueryin 7y ago
      The difference is one has a dedicated security team and the other does not.

F00Fbug 7y ago

If you're running some type of hypervisor (ESXi, Proxmox, etc.), you can create a tiny VM running Debian and load Pi-hole on it. No need for extra hardware and wires.

nawtacawp 7y ago
I use ESXi and one of the VMs is pfSense. pfSense has an additional software package called pfBlocker, which is highly configurable and just plan awesome for blockings ads/trackers/etc for the LAN. pfSense has tons of other options - I setup a vLAN and all of my IoT devices are segregated onto it. That way they can't interact with the rest of the devices on the LAN.
- F00Fbug 7y ago
  Yep... my pfSense is virtualized, too. I need to get pfBlocker configured, but pi-hole works so well, I'm too lazy to do anything about it! I'm also working on an IoT VLAN - that Ring doorbell is a chatty Kathy!
whalesalad 7y ago
I run mine on exactly that: a Dell R720 sitting on a rack next to my desk from within a Debian 9 virtual machine inside ESXi. I actually want to do the opposite: transition this to dedicated hardware (like a Pi, but worried about performance) that is a little less noisy. This is shockingly quiet for a 2U but I am a stickler for silence. Some pix: https://imgur.com/a/0xwcfNN https://imgur.com/a/0xwcfNN

40four 7y ago

Pi-hole is fantastic! I run it on my Rockpro64 at home. Previous discussions => https://news.ycombinator.com/item?id=19258717 https://news.ycombinator.com/item?id=19258717 https://news.ycombinator.com/item?id=13857887 https://news.ycombinator.com/item?id=13857887

drhayes9 7y ago

I'm running pi-hole in a docker container on an Intel NUC; no need for an actual-factual Raspberry Pi. Works great.

pixelbath 7y ago

Given how Google has, literally this morning, informed me that they're discontinuing text-only AdSense units, I can't think of a more appropriate time.

zaroth 7y ago

I haven’t tried Pi-Hole yet but this was the impetus I needed to decide to set it up tonight. I commented on a different post last night, that I was a bit shocked and saddened to see their Patreon is only pulling in $1,700/mo. Do they have another significant revenue stream? Is it just too much hassle to bother signing up to Patreon to commit to even $1/mo? Do they have something on the Admin panel where users can click to pay directly? I’m not judging, I don’t even have a Patreon account. I’m curious how such an apparently crucial and useful piece of software — one that no doubt is responsible for providing millions of dollars of value to its users, and perhaps blocking tens of millions of dollars in ads — how can the project be sustainable after 53 releases and 2,700 issues on Github while pulling in less than $24k/yr?

pjc50 7y ago
> only pulling in $1,700/mo. This is an astonishingly huge amount of money for an open source project to raise directly from its users. Most open source projects get basically nothing.
deleted 7y ago
[deleted]

creeble 7y ago

Can you tell from the command line what version Pi you're running? I think mine's an original B+, but not sure. I typically get sub-millisecond DNS resolution (presumably from cache). >root@pihole:~# uptime > 17:02:51 up 587 days, 22:34, 1 user, load average: 0.03, 0.03, 0.05

jrace 7y ago
cat /proc/cpuinfo

asveikau 7y ago

I was looking at their github repo and couldn't immediately see where pihole gets its block lists, just a very large soup of shell scripting that seems to make a lot of assumptions about your Linux distro. Anybody familiar with this code able to point out where it does the "interesting" work?

sneak 7y ago

Pi-hole users should know that in the default configuration it allows your ISP to reconfigure your blocklists at will due to lack of authentication: https://github.com/pi-hole/pi-hole/issues/2704 https://github.com/pi-hole/pi-hole/issues/2704

mikepasek 7y ago

Ad blocking via DNS is relatively easy right now because a content provider like CNN.com will use a domain like “ads.evil-surveillance-media.com” to load their ads into your browser. But what happens if all these companies switch to just using their own domain to load ads? If the ads as well as the content BOTH come from CNN.com then there will be no easy way to filter the ads out. This will be the next stage in this war between ads and adblockers.

nerdponx 7y ago
I'm already seeing this happen in some cases. Or they serve it from an opaque CDN alongside the functional site code.
Lxr 7y ago
This. Router-level blocking will become impossible without intercepting https, and endpoint blocking also gets harder.
matoro 7y ago
This has been warned about for a while now and it's not actually terribly difficult for sites to implement. Why don't they? Simple - click fraud. The ad networks don't trust the sites to accurately report click numbers, so they insist on running their own code. For this reason, the number of truly first-party ads will be limited for a long while.
ben509 7y ago
Adblocker plugins already do content-level filtering because of this, not just for ads but various tracking and other annoyances. I do that for the sites that have the banner that hides if you scroll down, but pops out the moment you scroll one pixel back, or sites that put up "please don't leave me" modals the moment your cursor strays out of the window.
uponcoffee 7y ago
With the prevelence of ad blocking tech, the question becomes why haven't they already? The answer being that content providers can't be trusted to self report metrics that determine how much advertises pay. At least not for pay per view/client/etc models. The people that self select themselves from viewing advertisements might be doing advertisers a favor. They're perhaps less likely to make purchases based on impressions//click ads on purpose; per dollar, ad campaigns might be more effective without said people.

nerdponx 7y ago

I assume, like everything else, Pi-Hole usage can be detected and used to fingerprint users?

rolltiide 7y ago

can this block Hulu ads and maintain access?

ancaster 7y ago

Does anyone have a recipe for using pihole via OpenVPN using docker? I'm using this[1] but I'm surprised there isn't something more official/baked. [1] https://github.com/mr-bolle/docker-openvpn-pihole https://github.com/mr-bolle/docker-openvpn-pihole

ampsonic 7y ago
I just set this up yesterday, was quite easy. https://hub.docker.com/r/linuxserver/openvpn-as/ https://hub.docker.com/r/linuxserver/openvpn-as/

LocalPCGuy 7y ago

I haven't moved mine off of the Pi personally, but I've read positive reports of people using Digital Ocean or similar to host PI-Hole. That could also, in theory, allow it to be used while remote or for mobile devices.

deleted 7y ago
[deleted]

ampsonic 7y ago

I have set up a Siri Shortcut on my phone so that I can disable the blocking for 5 minutes very easily. Highly recommended if you have family members that occasionally need something unblocked.

ekblom 7y ago
How does one acquire this kind of magic?

bmedwar 7y ago

content is blocked in non-browser locations, such as ad-laden mobile apps and smart TVs

llamataboot 7y ago

I love the pi-hole, but I can't seem to figure out how to get resolving of .local hostnames back when I use it. Like, I can no longer ping my media server at media.local, I have to use the exact IP address. Not a deal breaker, but annoying.

whalesalad 7y ago
Make sure Pihole has your local DHCP/DNS server setup as the first resolver. So it will check your router for example before checking externally. Then again, you might be using Pihole as your DHCP server? Explain your setup some more and I can add more details.
StreamBright 7y ago
Yes, there are few things like that. I think this project is a good start but needs some features like local zone support (being the authoritative NS for you local domain).
foxyv 7y ago
If you point the PiHole Upstream DNS to your router's DNS (Or whatever DNS server is hosting the .local domains) it should resolve .local hostnames again. I think by default it uses 8.8.8.8 or 8.8.4.4 https://discourse.pi-hole.net/t/change-upstream-dns-server-ip/7808/2 https://discourse.pi-hole.net/t/change-upstream-dns-server-i...
- llamataboot 7y ago
  Thanks! I've tried that, but then got switched around with what was pointing where. DNS is definitely a part of the stack that still confuses me, despite on the surface seeming somewhat simple!
programmarchy 7y ago
I thought .local names used mDNS. Not sure why pi-hole would interfere with that.

patentatt 7y ago

Pro-tip: pi-hole will eat SD cards in a rpi if you enable logging. Use industrial flash (e.g., seissbit) to avoid a headache every six months.

Teledhil 7y ago
If you don't care about persistent logs, you can mount the /var/log directory on tmpfs. For example, add to your /etc/fstab: tmpfs /var/log tmpfs nosuid,nodev 0 0

ycombonator 7y ago

I run pihole on Raspberry Pi with recommended block lists and it’s been an absolute pleasure. Raspberry Pi runs with a static IP I changed DNS settings the devices I want to go through pihole.

mavsman 7y ago

I like Pi-hole but it ended up causing more trouble than it was worth for me. First, certain streaming websites would fail and it was too much trouble to try to find the URL to whitelist. Then after I had disabled it from the Pi-hole interface everything was fine but it wasn't actually active. No problem...until I forgot my router was using it as a DNS server and I moved and didn't set my Pi up yet. Then it took me a couple weeks going back and forth with Comcast to find out that my router was still pointing to a DNS server that wasn't running. Somehow my FireTV bypassed the bad DNS server at one point (still no idea how this happened cause my router was routing all traffic through the IP for pi-hole) and that made me realize that I can get data from Comcast somehow so maybe it really was my router.

javipas 7y ago

I was planning on installing this on my RPi3B but I wonder due to its low compute power could result in a somewhat slower experience in my home network. Could anyone comment on what his experience has been in this case?

hosteur 7y ago

I love the idea of pi-hole. However, I run my own local DNS server already. And my DNS server is actually serving some local domains for various servers, etc. on the network. Can I in any way get the list of domains to block from the pi-hole project and use them in my own regular Bind DNS server?