Re:OpenSnitch is a GNU/Linux port of the Little Snitch appli...
by ignoramous on Saturday February 01, 2020 @12:57AM
(#22208988)
> I'm not confident enough to "roll my own"
For local net, setting up pi-hole is do-able, whilst setting it up over a VPN involves a bit of additional tooling.
A 100% uptime DNS on public internet is tricky, but if you're okay with just DoH [0], the https://workers.dev free-tier would you give you a 100% uptime "anycast", low-latency DoH enough for a single device's worth of queries for a month. At $5, you'd have enough for a 100 devices.
I've one setup with adblock forwarding queries to 1.1.1.1 and I see e2e latencies as low as 50ms regardless of location. This setup is a bit involved: You'd need to convert blocklists (the one I use has a million entries) to either a long-string, custom LZ-compress it (~6 MiB) [1] and do a boyer-moore needle-haystack search on it for incoming questions (v8's native String#index impl uses a variant of boyer-moore) [2], or use a json-map at a cost of higher RAM usage but blazing-fast lookups (~25 MiB), or use succinct radix-trees for optimal RAM usage (~1.5 MiB) but relatively slower lookups, or use bloom-filters with low false-positive but fast membership queries at extremely frugal RAM usage (~200 KiB) [3].
That said, the simplest way to ad-block would be to point the workers instance to adguard-doh.
For local net, setting up pi-hole is do-able, whilst setting it up over a VPN involves a bit of additional tooling.
A 100% uptime DNS on public internet is tricky, but if you're okay with just DoH [0], the https://workers.dev free-tier would you give you a 100% uptime "anycast", low-latency DoH enough for a single device's worth of queries for a month. At $5, you'd have enough for a 100 devices.
I've one setup with adblock forwarding queries to 1.1.1.1 and I see e2e latencies as low as 50ms regardless of location. This setup is a bit involved: You'd need to convert blocklists (the one I use has a million entries) to either a long-string, custom LZ-compress it (~6 MiB) [1] and do a boyer-moore needle-haystack search on it for incoming questions (v8's native String#index impl uses a variant of boyer-moore) [2], or use a json-map at a cost of higher RAM usage but blazing-fast lookups (~25 MiB), or use succinct radix-trees for optimal RAM usage (~1.5 MiB) but relatively slower lookups, or use bloom-filters with low false-positive but fast membership queries at extremely frugal RAM usage (~200 KiB) [3].
That said, the simplest way to ad-block would be to point the workers instance to adguard-doh.
[0] https://news.ycombinator.com/item?id=21598413
[1] https://github.com/pieroxy/lz-string/
[2] https://stackoverflow.com/questions/5562297/fast-search-in-c...
[3] https://news.ycombinator.com/item?id=22017868