rndomsrmn
Joined 9 years ago
Karma
62
Submissions
21
Member since
Nov 2
Recent submissions
Comment · 5 years ago
Comment · 5 years ago
https://github.com/notracking/hosts-blocklists
Use this for network wide blocking of all sorts of virtual garbage. Not only for safari, but all your locally connected devices.
Comment · 5 years ago
You can get even better coverage with the NoTracking lists (dnsmasq/unbound or dnscrypt-proxy) https://github.com/notracking/hosts-blocklists
They focus not only on tracking but also malware prevention, where possible via dns filtering.
Pi-Hole still does not properly support wildcard filtering, only via regex but that is not really efficient (requires tons of resources).
Comment · 5 years ago
You might want to consider checking for hosts listed in https://github.com/notracking/hosts-blocklists
This is an excellent merged blocklist, with public whitelist (oisd is fully closed, no insight in what is whitelisted and why, also causing more false positives..)
Comment · 6 years ago
Also a ref to: https://github.com/notracking/hosts-blocklists
They have a public whitelist and updates are pushed on a daily basis.
Comment · 6 years ago
See: https://github.com/notracking/hosts-blocklists#dns-over-http... how Mozilla deals with this.
For Chrome this feature seems not to be implemented, making it harder to control your DNS behavior in your own network. (see Q&A at the bottom of the page) https://sites.google.com/a/chromium.org/dev/developers/dns-o...
Comment · 6 years ago
It is possible to use this feature 'in' Pi-Hole, see: https://github.com/notracking/hosts-blocklists/wiki/Install-...
Comment · 6 years ago
Dnsmasq 'address=' function is just a substr() call, which is as fast as 'normal' hostname blocking (host == "adhost.com"). No regex magic is required there.
You are not able to block something like 'ads.%.adhost.com', but only (prepending wildcard) '%.ads.adhost.com', which in practice will cover almost all scenarios where random subdomains are used by adhosts.
Comment · 6 years ago
regex is _extremely_ resource inefficient and should not be used with large sets of rules. Dnsmasqs domain redirecting feature (address=/adhost.com/#) is not supported by pihole.
Is there any other way to wildcard block full domains in Pi-Hole?
Look for example in your list: d41.co, admaster.com.cn, mixmarket.biz chances are extremely slim that all (current) hostnames of those type of domains are currently being blocked.
Comment · 6 years ago
dnscrypt-proxy is already supporting CNAME blocking and full domain based blocking (*.adhost.com), something that is still missing in Pi-Hole.
Comment · 6 years ago
A dnscrypt-proxy setup with https://github.com/notracking/hosts-blocklists/tree/master/d... goes a long way!
For anything that is not blockable on DNS level one should use uBlock Origin from Gorhill.
Comment · 6 years ago
try hosting your own dnscrypt-proxy in combination with https://github.com/notracking/hosts-blocklists. That will turn off most trackers on your entire network.
Comment · 7 years ago
You will know on forehand what the fixed DOH servers will be, how else would you be able to locate them?
If for example they will use the 1.1.1.1 DOH instance, you can simply redirect all localnet 1.1.1.1 (80/53) traffic to your own local (DOH)DNS(masq).
Besides that there must be a fallback option for network admins, since using dns filtering and localnet dns is very common in enterprise. Firefox implemented a canary domain, specifically designed for this purpose, see: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
Comment · 7 years ago
uBlock and uMatrix are a perfect addition to a setup with a dns based filtering system, though by themselves alone do not provide a solution for all use cases. Think smarttv's, consoles, IOS devices, apps, etc. Basically anything that is not android firefox browser or a desktop browser.
Additionally having DNS filtering in place will also prevent information leakage in case something goes wrong with one of your browser plugins.
Comment · 7 years ago
Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list).
Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-di...
Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route all DOH traffic to your local DOH instance.
DNSCrypt-proxy (and even pihole these days I believe) are actually capable of blocking forwarded CNAME requests. Setting up such system for network wide adblocking is not complicated at all, see: https://github.com/notracking/hosts-blocklists/wiki/Install-...