Pi-hole is great, but it cannot block all kinds of ads since it relies on DNS redirection. YouTube ads are notorious for this, for example

Yeah and its functionality is also being eroded by apps using things like DoH.

I use both but I don't think the network level blocking will work forever.

Please don't use DoH as an evil advertising bogeyman. It's a huge win in the fight against censorship and surveillance, and everything that it lets advertisers do can be equally done by hardcoding an IP address in the app instead.

Well, it does break pihole.

And I already use trusted DNS providers (over TLS) so it's not really an issue. My provider can't see my DNS lookups. Also, in the EU providers are not allowed to use deep packet inspeciton so they only know your queries if you use their own DNS.

Hardcoding an IP is really difficult to do for adtech providers for 2 reasons:

1) They usually subcontract to cloud providers that don't guarantee IPs

2) It breaks SNI (Server Name Indication), also heavily used on cloud services

There's better ways to do secure DNS than DoH, like DoT (DNS over TLS)

I like secure DNS but I still want my own server to be the middleman. With DoH this isn't easily possible, especially on mobile due to the root CA issue. DoH is normally implemented using a major player like CloudFlare. Sure, they promise not to look at it. But the phrase "Don't be evil" still is pretty fresh in my mind.

But anyway, it's a moot point. Even if we could block DoH somehow (we can't due to certificate pinning and Android no longer allowing to add a global root CA since Android 7), app providers could just implement their own lookup system or something. Whether we like DoH or not it's here to stay.

> Well, it does break pihole.

Sure, but that's only because your computer can't distinguish your Pi-hole blocking DNS to block ads from an evil ISP blocking DNS to censor you. And if your device supports DoH, can't you just point it to one of the many publicly-available DoH servers, or set up a DoH server on your Pi-hole and then point at that?

> It breaks SNI (Server Name Indication), also heavily used on cloud services

They can just hardcode the IP in the hosts file, not in the client program. Then SNI will still work normally.

> There's better ways to do secure DNS than DoH, like DoT (DNS over TLS)

Then the people who want to do censorship and surveillance will all just block port 853. It's a feature that DoH is hard to distinguish from other HTTPS traffic.

> I like secure DNS but I still want my own server to be the middleman. With DoH this isn't easily possible, especially on mobile due to the root CA issue.

Can't you set up your own DoH server with its own domain name, get a Let's Encrypt certificate for it, then point your mobile device at that?

> DoH is normally implemented using a major player like CloudFlare. Sure, they promise not to look at it. But the phrase "Don't be evil" still is pretty fresh in my mind.

Isn't the alternative that your ISP is definitely looking at it?

> Can't you set up your own DoH server with its own domain name, get a Let's Encrypt certificate for it, then point your mobile device at that?

Yes. But what’s the angle here? You trust “ISP(s) hosting your DoH server” but not “ISP providing phone connection?”

Might be a legitimate reason for that, but ultimately as with all these discussions it’s just a matter of who you’d rather give the data to.

And your ISP will still be able to see from SNI for the most part so… it boils down to “my ISP can see anyway (via SNI), should I also let someone else see (DoH provider)?”

> Yes. But what’s the angle here? You trust “ISP(s) hosting your DoH server” but not “ISP providing phone connection?”

Your own DoH server could just do the filtering you want and then hand off the work to another real DoH server like Cloudflare's.

> Might be a legitimate reason for that, but ultimately as with all these discussions it’s just a matter of who you’d rather give the data to.

True, but in most of the USA, your ISP is the least trustworthy choice for who to give your data to.

> And your ISP will still be able to see from SNI for the most part so… it boils down to “my ISP can see anyway (via SNI), should I also let someone else see (DoH provider)?”

So let's hurry up and deploy eSNI/ECH everywhere.

> Then the people who want to do censorship and surveillance will all just block port 853. It's a feature that DoH is hard to distinguish from other HTTPS traffic.

Not an issue here in the EU. Alternative DNS is not blocked. Providers sometimes block the pirate bay but they're never obliged to block alternative DNS and they're not allowed to anyway as they're not allowed to do Deep Packet Inspection.

> Isn't the alternative that your ISP is definitely looking at it?

No, this is not allowed in the EU. They can see it if you use their DNS. Otherwise not.

I understand the feature that hiding the DNS traffic among other HTTPS traffic brings, but this is mainly a feature in countries without strong privacy laws. For me I would prefer to separate the traffic so I can control it myself.

And really if I'm in a country with such invasive censoring I would prefer to use a VPN and avoid their prying eyes altogether. DNS is only part of the equation. IP endpoints still tell them a lot. Especially on IPv6 as there's no more need for SNI.

I'm just not sure if it's a good idea to obfuscate core protocols of the internet, just to avoid an issue in certain countries that is not very well solved by this anyway. At the same time I have to give up a lot of valuable statistics, troubleshooting data and validation about whether apps do as they claim.

However like I said I can't stop an app doing this, precisely for the reason it's obfuscated. I won't use it on my own network however.

> Can't you set up your own DoH server with its own domain name, get a Let's Encrypt certificate for it, then point your mobile device at that?

I don't want to bother with getting public domain names and validate their IP with Let's Encrypt just because I want to use them internally. The renewal process is really complex for something that doesn't have a public IP and I don't want to have my internal DNS available on the internet (it also contains local domain names only available on my LAN and P2P VPN)

In fact encrypting that traffic on the local segment doesn't really add any value for me. I just encrypt the outbound part (from the pihole) with DoT.

> They can just hardcode the IP in the hosts file, not in the client program. Then SNI will still work normally.

How would that work? I control my host file. Apps can not mess with it. Not on my computer and not on my phone.

It's great that you live somewhere where you don't have to worry about any of these things, but a lot of us aren't so lucky.

> And really if I'm in a country with such invasive censoring I would prefer to use a VPN and avoid their prying eyes altogether.

Those countries block VPNs.

> Especially on IPv6 as there's no more need for SNI.

I can foresee CloudFlare offering a single-IPv6 shared endpoint for the sole purpose of making eSNI/ECH remain effective.

> At the same time I have to give up a lot of valuable statistics, troubleshooting data and validation about whether apps do as they claim.

Can't you get this information directly off of your endpoint device, whether or not the traffic is encrypted over the network?

> How would that work? I control my host file. Apps can not mess with it. Not on my computer and not on my phone.

I was thinking more about IoT appliances when I wrote that. For programs on your phone or computer, they can tell their TLS library to use whatever SNI you want, so even if they did hardcode the IP in the client program, SNI could still include the right hostname.

DoH itself is fine.

But to win against “surveillance” you need to make a smart, conscious decision about who you want to give your browsing history to.

For me, I’d rather my ISP sees my DNS, than all that data is sent to some American mega-corp keen to hoover up every last datapoint about me they can.

My ISP can for the most part look at HTTPS SNI field and see all the domains I access anyway. So switching to say, Google DoH, only means that now Google have that list as well as my ISP.

> some American mega-corp keen to hoover up every last datapoint about me they can

That's a really good description of both Comcast and Verizon. Not so much of Cloudflare though - they seem to actually care about people's privacy.

> My ISP can for the most part look at HTTPS SNI field and see all the domains I access anyway. So switching to say, Google DoH, only means that now Google have that list as well as my ISP.

Isn't this just an argument to hurry up and get eSNI/ECH rolled out everywhere?

Absolutely reason to promote ECH.

Sure Cloudflare are better than those other big US ISPs.

But for those of us in the EU, where such practices are illegal, we may want to think twice about giving our data to Cloudflare (who are subject to requests from US govt for instance.)

Even in the EU, couldn't there still be a privacy benefit? Set aside for a minute what's legal and illegal, and just consider what entities are capable and incapable of. By using a DoH provider (that sees what domains your client IP is looking up) other than your ISP (that knows that your client IP goes with your real-life identity), there's now no single entity capable of associating your real-life identity with which domains you've looked up.

What's DoH?

DNS over HTTPS. It is a new(ish) way to do lookups that deals with the insecurity of most DNS setups (where packets are often neither signed nor encrypted) by hitting a resolver over https. Often the application will hard code the resolvers it intends on using, which leads people to believe it is adtech as it allows apps to bypass blocking by PiHole and the like. It, like most tech, can be used or abused.

I think that’s the fundamental change it brings.

Once the system, or network admin would set the DNS servers up and everything on the system would use those. There is no reason why that paradigm couldn’t continue and move to DoH.

The other change is that applications are now bypassing the system-configured DNS and sending requests (and thus data about what you are looking at,) where the application wants. The “centralisation” issue also comes into this. But again, the change from a system-level to per-app setting could happen with regular old plaintext DNS.

DoH is part of the discussion in both cases, which clouds the debate.

I don't think uBlock Origin can block YouTube ads either?

It can, and it does.

It does.

I don't want to block ads on every site I go to, and having an extension rather than a DNS sinkhole makes toggling between blocking and not blocking much simpler.

You can setup a link to disable pihole for a given number of seconds

I find both are needed. It is nice to see that I block a huge amount of data from getting used up by ads when pihole block it. And just in case it gets through ublock. ublock is usually ahead of the more sophisticated attacks.

How well does Pi-Hole work for people who aren't technical? My family member gets aggravated when ad blocking breaks a site for them

It’s probably not ideal tbh. You can whitelist stuff that’s blocked, but it involves logging into the admin console and whitelisting either manually or via a recently blocked request, easy enough for techies but I wouldn’t back it for non techies.

I use a fairly aggressive Pihole list that breaks stuff reasonably often, there may be less strict lists which are “safer” in this regard.

Some sites breaking was a complaint my wife had when I set all devices on our network to use the pi-hole.

To solve this I setup a Shortcut on her iPhone so she can simply say "hey siri, stop pi-hole" and it will turn off the pi-hole for 5 minutes using a simple web request. The pi-hole turns itself back on after 5 minutes.

A bookmark works just as well but she prefers to use Siri as she never remembers where the bookmark is lol. It is mostly on her phone anyway that something doesn't quite work right so Siri was the best solution.

I also have Wire Guard setup and our phones configured to connect to it always for mobile data and unknown wifi so all our connections are routed via our home internet connection and via the pi-hole. As I have stupidly fast home internet (10Gbit EPON with free.fr) it works fantastically.

Pihole frequently breaks online tv like Disney+ and Hulu when viewed on our Roku TV. Preload trackers or ads get stuck and the show will never start.

I’ve never used pihole, but I’m assuming you could whitelist the Roku’s local ip?

Of course you can.

I found the most frustration came from links in emails not working as intended. For some reason many companies, government agencies, and schools use metrics tracking on emails.

Pi-hole has a nice temporarily disable blocking feature on its dashboard to help in those cases. Simple click to whitelist is also available.

I never had a legitimate site breaks by pi-hole.

Pi-hole should be the easiest for family members, they don’t need to do anything at all.

On most sites, it simply leaves a blank space in where ad supposed to be.

If you want dns-level ad blocking, there's also nextdns.io. You can also use it outside of your home network. I'm on their free tier and very happy with them.

Mullvad VPN also has an adblock DNS server. I am not sure, but I think everyone can use it.

Although that's great too, uBlock has more features than just blocking requests to certain domains.

It is not better, because Pi-hole is limited to Dns based blocking.

Ublock origin can block much more content than a pi-hole…

So, use both.

That works if you're browsing from a fixed location.

By contrast, browser extensions work wherever you are -- at work, in a bus/train, in a hotel, etc.

one think that I dont like about pi-hole is its impossible to add exception to website I deliberately support.

No it isn't? It's entirely list based, it doesn't do anything without a domain being listed to block.

Even if a third-party list you've added blocks something you don't want to block, you have an overriding whitelist.

They mean allowing ads on aites they want to support.

Yes, I know? So don't block (or whitelist to override a third-party list in use) the sites you want to support?

What am I missing?

Ads are hosted by ad networks that appear on many sites.

Well sure if they're loaded directly that won't work, but it's hardly Pi-Hole's fault, what could it do?