169
Self-Hosting a DNS Sinkhole is really important
(www.wired.com)
Unbound on OPNsense ftw
The last time I opened the Wired site was like 10 years ago, it's still telling me "You’ve read your last free article." See you in 2036 ig
Tells me that too. Then I copy the url into my readeck instance and it pulls the article for me and gives me a better reading experience.
“You’ve read your last free article.”
Do they know how ominous that sounds? It reads like they got mad at my freeloading and sent out a hitman.
Or they know the date and time of your very natural death...
You've read your last free article. We suggest going to the doctor for a full workup. Screen for everything. Get a will drawn up. Hug your kids.
Hug your kids
...while you still can.
Ha. Here's the direct source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
This reads like a dystopian fever dream, fuck me.
Literally none of that should be surprising for people who have a basic understanding of how the WWW works.
Which, I'm starting to realize, is a depressively low fraction of the general population. I was taught this in middle school, for fuck's sake.
load more comments
(2 replies)
What is a DNS sinkhole and how is it related to the content of the article? Didn't seem to mention DNS
What is a DNS sinkhole
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its "blocklist" then it returns a value of 0.0.0.0 (or some other customizable value including NXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.
Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
how is it related to the content of the article?
The article indicated that the malicious spyware was transmitted through viewable ads on the target's mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
This sounds like AdGuard Home is an example?
Tldr; pi-hole
Thank you, that kind of explanation exactly what i was hoping for!
Unfortunately a lot of the magnificent 7 of advertisers have caught on to this and will serve ads dynamically in many of their platforms.
I've heard that before but I haven't seen an ad in years. But I'm probably not the norm. Between userscripts, ad-removing frontends like invidious and choosing services like Lemmy over the competition, you can pretty safely remove ads from most platforms. Of course, Jellyfin helps 😂
Yeah, they've done this on this one particular site that I like to read, one old (hilarious) celebrity blogger who made a new home on [redacted]. [redacted] is pure shit. I dunno exactly what they're doing but the ads they serve up are largely local rather than third party - and they're served up so aggressively the site is all but unreadable on my phone. So ads are crazy in-your-face despite having adblock on the phone itself and a Pi-Hole! Just to keep reading the guy I like I had to set up a shortcut that loads it in reader view to bypass all the bullshit and fuck knows how long that will last before they somehow figure out how to block reader view.
Edit: I probably shouldn't be giving them ideas, lol.
I saw the domain before you edited it lol. I went to the site and have zero ads on mobile, although I did have an empty placeholder in one spot where the ads would have been.
Make sure the following domains are blocked on your pihole:
html-load.cc
githack.com
cdn.statically.io
revcontent.com
pub.network
Then, make sure you have these two lines as entries on your mobile adblocker:
/ad-shield/e/*$script,third-party
/cdn-cgi/zaraz/*
If there is a specific url you'd like me to look at, feel free to message me.
Edit to add: even better than the individual domains, to add https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt as a list and then just include the githack.com domain. Pihole supports adblock syntax, so you'll be fine with this.
I did this, and you're right - no ads. 👍 Thanks a bunch, I've saved your comment so if I run into one of these again I may hit you up!
Provide the URL to your AI chat and ask it to print out the article for you.
no
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| AP | WiFi Access Point |
| DNS | Domain Name Service/System |
| PiHole | Network-wide ad-blocker (DNS sinkhole) |
| VPN | Virtual Private Network |
4 acronyms in this thread; the most compressed thread commented on today has 14 acronyms.
[Thread #134 for this comm, first seen 17th Oct 2026, 01:50] [FAQ] [Full list] [Contact] [Source code]
I like technitium. Way better than pi hole.
In what way(s)?
The main way is it has a built in recursive DNS server so you don’t have to duct tape Pi Hole and Ubound together
I never understood pihole in the first place. It's just a fancy web interface you do never look at if the thing does its job quietly in the background. And unbound alone is perfectly able to use blocklists with one line of configuration (and an onliner script to convert the common lists into the right format).
Because you have to mess with it all the time. It’s easier to get in and get out to make changes with the nice interface. It’d be different if it was set it and forget it but realistically it’s not.
It’s a more complete dns server. You can more easily do dns over https, set up zones, and custom dns entries are a lot easier imo.
In summary it’s more focused on being dns, the ad blocking is a feature on top. You also don’t have to manually configure unbound for recursive dns like you do pi hole. Etc etc
Oh. I guess if you just want dead simple ad blocking, pi hole is still the way
If you just want simple ad blocking you don't actually need pi hole for it's web interface you don't ever look at once it runs. Unbound alone can do the job with minimal configuration.
Nowadays I even changed my setup to dnsproxy, which doesn't even need any config. It's just a handful parameters when you start it. And it does all the filtering for my home network as well as providing DoH access for when I'm not at home and connected from somewhere else.
I'd prefer Adguard Home. Does the same thing but also supports encrypted DoT/DoQ/DoH upstreams. And the UI looks a bit neater for me
load more comments
(3 replies)
Yeah but what you will eventually find, if reliability matters at all to you, is that the pihole isn't the best for this. For one, many run on an SD card, which isn't really stable long-term (I started here and had to fix it due to SD card corruption quite a few times). Second, you don't have a backup. DNS not running when your machines depend on it equals an immediate outage across ALL devices (as long as you have it configured at your router level, which you should be doing, right?).
Technitium (and others) solve this problem gracefully.
I started with pihole (ad blocking) and unbound (recursive DNS), and that was a pain to set up properly.
Moved do technitium (which offers all of these in one package) plus the ability to natively cluster a second instance (so you have a backup load balanced instance for this critical service)
The best part is that setting it up if you have an old laptop or desktop running docker is incredibly simple. I had two nodes up and running clustered in less than 15 minutes. Took less time than setting up one pihole.
If you don't have docker it may take more time, but that's the slippery slope of setting up a homelab and running services like this.
My Pi hole has been up and solid for about a decade now, so not sure “isn’t really stable long term” is landing
Thank you for the in-depth explanation, Technitium sounds really involved. I just plunked down a pi hole, turned it on, and it’s been working for years and years. I’ll keep this in mind though if I ever want to drive myself nuts with networking
Good for you, many don't have the same experience. Technitium is easier to set up in my experience, but you do you if it works for you. That's the benefit of having free choices.
Just to be clear, I'm not trying to sell you or anyone on technitium over pihole or pihole+unbound, they're all free and I don't work for them or anything. However, as someone that has gone through this journey with all of them, I'll never go back to pihole, especially with the features technitium has and the importance of DNS to my home lab plus the incredible ease of setup.
No backup with PiHole?
PiHole can run redundant if you want. Does Technitium do this differently? Or more easily?
Technitium does this incredibly easily. I fiddled with pihole and unbound for so long to get them to coexist properly, and pihole alone before that. The pihole part was easy although unreliable on a raspberry pi due to the sd card. It was better once I added an ssd to the pi, but it didn't have recursive DNS. Adding unbound and getting them configured properly and coexisting properly wasn't an easy task. Technitium has all of this in one package and was trivial to set up one or more clustered nodes. You don't need anything to ensure they both work together, the clustering feature does this incredibly easily. One goes down? No prob, I see a discord alert from uptime kuma letting me know. When it comes back up cluster mgmt syncs everything and they load balance again.
My current setup has an uptime of 210 days, and likely would be longer if it weren't for a power outage.
It really is so simple, I'd suggest everyone try it out. You can always change it back if you don't like it. And, like the pihole, you can load curated block lists.
load more comments
(1 replies)
load more comments
(1 replies)
Is Adguard Home still a good option for this kind of thing?
load more comments
(3 replies)
Love blocky. Seems like it flies under the radar.
view more: next ›
this post was submitted on 16 Oct 2026
169 points (97.2% liked)
Selfhosted
62987 readers
1659 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS