Unbound on OPNsense ftw
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point DNS Domain Name Service/System PiHole Network-wide ad-blocker (DNS sinkhole) VPN Virtual Private Network
4 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #134 for this comm, first seen 17th Oct 2026, 01:50] [FAQ] [Full list] [Contact] [Source code]
The last time I opened the Wired site was like 10 years ago, it’s still telling me “You’ve read your last free article.” See you in 2036 ig
“You’ve read your last free article.”
Do they know how ominous that sounds? It reads like they got mad at my freeloading and sent out a hitman.
Or they know the date and time of your very natural death…
You’ve read your last free article. We suggest going to the doctor for a full workup. Screen for everything. Get a will drawn up. Hug your kids.
Hug your kids
…while you still can.
Ha. Here’s the direct source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
This reads like a dystopian fever dream, fuck me.
Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.
I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.
Na I have regular DNS and I can’t read from wired for years too
What is a DNS sinkhole and how is it related to the content of the article? Didn’t seem to mention DNS
What is a DNS sinkhole
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its “blocklist” then it returns a value of
0.0.0.0(or some other customizable value includingNXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
how is it related to the content of the article?
The article indicated that the malicious spyware was transmitted through viewable ads on the target’s mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
Tldr; pi-hole
Unfortunately a lot of the magnificent 7 of advertisers have caught on to this and will serve ads dynamically in many of their platforms.
Yeah, they’ve done this on this one particular site that I like to read, one old (hilarious) celebrity blogger who made a new home on [redacted]. [redacted] is pure shit. I dunno exactly what they’re doing but the ads they serve up are largely local rather than third party - and they’re served up so aggressively the site is all but unreadable on my phone. So ads are crazy in-your-face despite having adblock on the phone itself and a Pi-Hole! Just to keep reading the guy I like I had to set up a shortcut that loads it in reader view to bypass all the bullshit and fuck knows how long that will last before they somehow figure out how to block reader view.
Edit: I probably shouldn’t be giving them ideas, lol.
I saw the domain before you edited it lol. I went to the site and have zero ads on mobile, although I did have an empty placeholder in one spot where the ads would have been.
Make sure the following domains are blocked on your pihole:
html-load.cc githack.com cdn.statically.io revcontent.com pub.networkThen, make sure you have these two lines as entries on your mobile adblocker:
/ad-shield/e/*$script,third-party /cdn-cgi/zaraz/*If there is a specific url you’d like me to look at, feel free to message me.
Edit to add: even better than the individual domains, to add
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txtas a list and then just include thegithack.comdomain. Pihole supports adblock syntax, so you’ll be fine with this.
I’ve heard that before but I haven’t seen an ad in years. But I’m probably not the norm. Between userscripts, ad-removing frontends like invidious and choosing services like Lemmy over the competition, you can pretty safely remove ads from most platforms. Of course, Jellyfin helps 😂
I like technitium. Way better than pi hole.
This is the way
In what way(s)?
The main way is it has a built in recursive DNS server so you don’t have to duct tape Pi Hole and Ubound together
It’s a more complete dns server. You can more easily do dns over https, set up zones, and custom dns entries are a lot easier imo.
In summary it’s more focused on being dns, the ad blocking is a feature on top. You also don’t have to manually configure unbound for recursive dns like you do pi hole. Etc etc
An ONT failure has me fiddling with my network this weekend and I might do this. Pihole is okay but having more power would be great.
Oh. I guess if you just want dead simple ad blocking, pi hole is still the way
Yeah but what you will eventually find, if reliability matters at all to you, is that the pihole isn’t the best for this. For one, many run on an SD card, which isn’t really stable long-term (I started here and had to fix it due to SD card corruption quite a few times). Second, you don’t have a backup. DNS not running when your machines depend on it equals an immediate outage across ALL devices (as long as you have it configured at your router level, which you should be doing, right?).
Technitium (and others) solve this problem gracefully.
I started with pihole (ad blocking) and unbound (recursive DNS), and that was a pain to set up properly.
Moved do technitium (which offers all of these in one package) plus the ability to natively cluster a second instance (so you have a backup load balanced instance for this critical service)
The best part is that setting it up if you have an old laptop or desktop running docker is incredibly simple. I had two nodes up and running clustered in less than 15 minutes. Took less time than setting up one pihole.
If you don’t have docker it may take more time, but that’s the slippery slope of setting up a homelab and running services like this.
I’d prefer Adguard Home. Does the same thing but also supports encrypted DoT/DoQ/DoH upstreams. And the UI looks a bit neater for me
AdGuard looks like a paid SaaS service though? No way am I paying for someone else running a device on my network, no friggin way
AdGuard Home is free. I’m running 2 redundant docker containers on separate hosts with adguard sync all for free.
Yup, I have it installed in my OPNSense and together they make a fucking fortress
Love blocky. Seems like it flies under the radar.
deleted by creator
I have a finally tuned pihole that offers different blocking for different vLANs on my home network and VPNs, I would not trust a third party for ad blocking. However you do you.
I was watching SomeOrdanryGamers video on this and his pihole did not block all the ads on an ad infected site, but mine could. I have used canyoublockit many times to stress test my system, wish there was something newer though.
Trust it, no.
Is it better than nothing, yes.
Listen, some folks can afford to build and dedicate time and resources to making a pi-hole for their network.
Those who can’t need to know there are alternatives, some are better than others, I’m just sharing information.
I meant no shade, I know it takes a lot of work to do everything I have done for security/ad blocking.
Thanks for the tip. I can’t find pricing on the NextDNS site. Is it free?
Don’t think I have the spoons for things like PiHole.
Edit: found it via web search https://nextdns.io/pricing
It’s free for a limited number of queries per month. Generally enough for one device (depending on personal usage, obviously). Edit: It’ll still function as DNS after that limit, you just won’t get ad blocking and whatnot.
Mullvad has a free ad-blocking DNS you can use, too. I recommend the “base” version: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
Thanks very much for the explanation. I’ve installed NextDNS in my phone now and will do other devices as I get to them.
I don’t recommend Mullvad, and I appeal to everyone to stop recommending them. The monies they receive directly funds fascism and is responsible for serious harm to society and erosion of democracy.
FYI you can point your home router to NextDNS and quickly get whole-house coverage that way. This is good for things like smart tvs, Roku/android boxes, kindles etc.
Installing directly on your phone & laptop is best for devices that will travel outside of your home network.
Oh, that’s fantastic advice. Thank you!
Please know this service will be ending next month.
Well crud. Thanks for the heads-up. First I’ve heard.
Sounds like Quad9 doesn’t actually do ad blocking, so that’s not much of a replacement.
Quad9 is a crap choice though 😥
Is Adguard Home still a good option for this kind of thing?
Yes, from what I understand. They are using ad services from the big ad companies, and because capitalism sucks they are completely fine with selling the spots.
if you do not have a system to VPN into your home I would suggest get a firewall (preferably one you can install openWRT of opnSense on) and VPN into your LAN when away from home.
My TPlink omada router has Wireguard built in, so I use WG tunnels on my mobile devices to tunnel home where my PiHole (soon to be replaced by Technitium) blocks ads and malicious content.
My flint2, came with OpenWRT, but I installed a vanilla OpenWRT onto it it handles my many different wifi APs, all my vLANs, and a couple VPNs. I have a finally tuned pihole setup, I could not imagine changing it, I was watching this video by SomOrdinaryGamer so I went to the site he made an example of and I got no ads with just my pihole.
