rndomsrmn
Re:Cname / DNS based third party tracking
on Monday March 01, 2021 @04:11AM (#26300914)
Websites that use CNAME to forward their main domain to some tracking company, basically give their entire domain away, I don't see how that is a good secure way to track your users..
DNSCrypt-proxy (and even pihole these days I believe) are actually capable of blocking forwarded CNAME requests. Setting up such system for network wide adblocking is not complicated at all, see: https://github.com/notracking/hosts-blocklists/wiki/Install-...
Re:We rendered a million web pages to find out what makes the web slow
on Tuesday January 26, 2021 @05:19PM (#25921727)
https://github.com/notracking/hosts-blocklists
Use this for network wide blocking of all sorts of virtual garbage. Not only for safari, but all your locally connected devices.
Re:Firefox 85 cracks down on supercookies
on Tuesday January 26, 2021 @04:39PM (#25921389)
You can get even better coverage with the NoTracking lists (dnsmasq/unbound or dnscrypt-proxy) https://github.com/notracking/hosts-blocklists
They focus not only on tracking but also malware prevention, where possible via dns filtering.
Pi-Hole still does not properly support wildcard filtering, only via regex but that is not really efficient (requires tons of resources).
Re:URL shorteners set ad tracking cookies
on Monday January 04, 2021 @06:03AM (#25629796)
You might want to consider checking for hosts listed in https://github.com/notracking/hosts-blocklists
This is an excellent merged blocklist, with public whitelist (oisd is fully closed, no insight in what is whitelisted and why, also causing more false positives..)
Re:All-in-One DNS block list
on Saturday June 06, 2020 @11:57AM (#23440038)
Also a ref to: https://github.com/notracking/hosts-blocklists
They have a public whitelist and updates are pushed on a daily basis.
Re:Google rolls out DNS-over-HTTPS support in Chrome 83
on Wednesday May 20, 2020 @06:55AM (#23245401)
See: https://github.com/notracking/hosts-blocklists#dns-over-http... how Mozilla deals with this.
For Chrome this feature seems not to be implemented, making it harder to control your DNS behavior in your own network. (see Q&A at the bottom of the page) https://sites.google.com/a/chromium.org/dev/developers/dns-o...
Re:The opt-out illusion: how we have acquiesced to losing our privacy
on Tuesday March 10, 2020 @10:49AM (#22535891)
It is possible to use this feature 'in' Pi-Hole, see: https://github.com/notracking/hosts-blocklists/wiki/Install-...
Re:The opt-out illusion: how we have acquiesced to losing our privacy
on Tuesday March 10, 2020 @10:07AM (#22535537)
Dnsmasq 'address=' function is just a substr() call, which is as fast as 'normal' hostname blocking (host == "adhost.com"). No regex magic is required there.
You are not able to block something like 'ads.%.adhost.com', but only (prepending wildcard) '%.ads.adhost.com', which in practice will cover almost all scenarios where random subdomains are used by adhosts.
Re:The opt-out illusion: how we have acquiesced to losing our privacy
on Tuesday March 10, 2020 @09:51AM (#22535423)
regex is _extremely_ resource inefficient and should not be used with large sets of rules. Dnsmasqs domain redirecting feature (address=/adhost.com/#) is not supported by pihole.
Is there any other way to wildcard block full domains in Pi-Hole?
Look for example in your list: d41.co, admaster.com.cn, mixmarket.biz chances are extremely slim that all (current) hostnames of those type of domains are currently being blocked.
Re:The opt-out illusion: how we have acquiesced to losing our privacy
on Tuesday March 10, 2020 @09:44AM (#22535373)
dnscrypt-proxy is already supporting CNAME blocking and full domain based blocking (*.adhost.com), something that is still missing in Pi-Hole.
Re:Sensor Tower owns ad blocker and VPN apps that collect user data
on Tuesday March 10, 2020 @09:10AM (#22535102)
A dnscrypt-proxy setup with https://github.com/notracking/hosts-blocklists/tree/master/d... goes a long way!
For anything that is not blockable on DNS level one should use uBlock Origin from Gorhill.
Re:How many users block Google analytics? (2017)
on Sunday March 01, 2020 @07:45AM (#22456651)
try hosting your own dnscrypt-proxy in combination with https://github.com/notracking/hosts-blocklists. That will turn off most trackers on your entire network.
Re:Remove almost all online garbage using Dnsmasq
on Monday November 18, 2019 @08:32AM (#21564136)
You will know on forehand what the fixed DOH servers will be, how else would you be able to locate them?
If for example they will use the 1.1.1.1 DOH instance, you can simply redirect all localnet 1.1.1.1 (80/53) traffic to your own local (DOH)DNS(masq).
Besides that there must be a fallback option for network admins, since using dns filtering and localnet dns is very common in enterprise. Firefox implemented a canary domain, specifically designed for this purpose, see: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
Re:Remove almost all online garbage using Dnsmasq
on Monday November 18, 2019 @05:43AM (#21563267)
uBlock and uMatrix are a perfect addition to a setup with a dns based filtering system, though by themselves alone do not provide a solution for all use cases. Think smarttv's, consoles, IOS devices, apps, etc. Basically anything that is not android firefox browser or a desktop browser.
Additionally having DNS filtering in place will also prevent information leakage in case something goes wrong with one of your browser plugins.
Re:Remove almost all online garbage using Dnsmasq
on Monday November 18, 2019 @05:39AM (#21563243)
Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list).
Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-di...
Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route all DOH traffic to your local DOH instance.
Re:Remove almost all online garbage using Dnsmasq
on Sunday November 17, 2019 @04:28PM (#21560151)
You can also redirect those public dns servers on you router to your local Dnsmasq server with iptables.
Re:Remove almost all online garbage using Dnsmasq
on Sunday November 17, 2019 @04:24PM (#21560134)
Pihole does not make use of dnsmasq's build in option to block entire domains (address=/ads.com/::). This list is also optimized because hostnames that match a domain filter are not included, reducing the size a lot.
Re:DNS servers that offer privacy and filtering
on Wednesday February 06, 2019 @08:51AM (#19095018)
Or setup your own very lightweight filtering and caching DNS at home using Dnsmasq and https://github.com/notracking/hosts-blocklists/
Re:Pi-Hole: Why You Need a Network-Wide Ad-Blocker
on Tuesday August 07, 2018 @05:24PM (#17710961)
Or https://github.com/notracking/hosts-blocklists that uses a dnsmasq feature to block full domains.
Re:November Workshop: Running the Pi-hole Network-wide Ad-blocker, and...
on Thursday November 02, 2017 @04:06AM (#15608631)
Or you just use a very basic dnsmasq installation and make use of a list like: https://github.com/notracking/hosts-blocklists that allows you to also block full domains.
Been using this list for several months now without any issues.
Besides that, it's worth reading in to dnsmasq's configuration in more detail, in the end pi-hole is just a preconfigured dnsmasq installation with a user interface to manage hostname based blocklists.