It apprears that NextDNS has removed No Google, No Facebook, and other blocklist without notifying users. One person said the NSA blocklist was also down. The company had made no responses to complaints on the community server when I checked earlier. Crickets…
I noticed Android and Linux being unable to access the app and web interface to confirm connections, starting some time on November 4th. I was able to switch DNS providers on Android and switch back, after which NextDNS seemed to work. On Linux however, systemd confirmed it was enabled but it went right to google’s webpage with no block.
If you’re on NextDNS, go check your domain filters ASAP. I switched to RethinkDNS, and it’s been decent so far. What is everyones preferred solution?
From their git closed tickets:
NSA: https://github.com/nextdns/blocklists/pull/105
Google and Facebook:
https://github.com/nextdns/blocklists/issues/235
From the git activity (diff linked in case anyone wants to copy and paste):
Google and Facebook: https://github.com/nextdns/blocklists/compare/8e36cfa267930a7dba8e27b0501e199c8a02b0b3...439d8b5a053aab0f93a7ad4341798ebfd1f17a0b
If anyone wants to check whether their filtering is actually working rather than trusting the dashboard: test a domain that should be blocked with
digornslookupagainst the resolver directly, and run a DNS leak test with the VPN on and off. If the blocked domain still resolves, the list isn’t being applied.For alternatives, the usual split: Quad9 if you only want malware blocking and a non-profit behind it, ControlD or Mullvad DNS for hosted filtering, and AdGuard Home, Pi-hole or Technitium if you want the lists under your own control. Whatever you pick, pin it with DNS-over-HTTPS or DoT so the OS or router can’t silently fall back to the ISP.
I use Technitium. It has tons of features that I’m not experienced enough to mess with, plus it does recursive DNS and blocking like pihole.
What is everyones preferred solution?
Bet your ass I will now!
Best practice is to host 2 PiHole instances, if 1 DNS sinkhole fails you can fallback to another one (Primary & Secondary DNS Server) that way you don’t lose internet access.
Certainly read and try to interpret the documents as best as you can, I suggest going the Docker Compose route for hosting as it’s quite straight forward and a great tool to learn if you want to selfhost other software, fiddle around with 1 DNS sinkhole before you jump head first into getting the second one up though.
FYI it works on anything. I hosted it on a Raspberry Pi 1B (the very first one, it’s slow shite), and now I host it on an Orange Pi Zero. It’s not as slow, but it’s not too powerful either. Both devices are plenty for this project.
Recently, someone hosted it on a ESP32 or something. Not giving the link, simply because I don’t know which one is the genuine one. I use the project for close to a decade and it’s just works, mostly.
I shifted to ControlD long time ago and have been very satisfied. Also it is a Canada company instead of a US company.
My Pihole couldn’t reach all the old NextDNS blocklists I subscribe to a few days ago. Makes sense now.
Bummer! Thanks for the heads up.
We should be able to manually enter them all. We should save them while we still can.
I just fork all the repos of lists I use in github and created a repo for my personal blocklist and blacklist and have my AGH pull from those. That way they keep updated, if one of them fucks up I can always go back a version (same thing if any of them disappear). It’s been working great.
This is a privacy Lemmy group, why are people using a third party DNS server? There is Adgaurd Home, I do not use it I tried it but did not like it more than the alternative but I hear people like it. There is also Pi-Hole, I do use this and I have finally tuned it. I actually have pihole’s one for primary DNS and one for secondary DNS.
*edit: I should appologize I should really have noticed the pihole was my gateway service into self hosting and privacy. It took years for me to notice how additing the simple ad blocking was and than some movements for me to start moving more services to self hosted. I just realized it has only been months that I have set up my firewall, and now I just cannot believe I have ever lived without it.
why are people using a third party DNS server?
“I finished the marathon, why are people still running?”
Because not everyone is on the same part of the journey as you. Hopefully you apply this concept more widely…
“I am a fucking genius. Let me teach these fuckers how it’s done and save humanity once and for all”.
That doesn’t work, makes you look like a prick, and you are not helping anyone.
We have all come in here, and otherr places, asking for help from people that have already crossed the red sea, this is exactly what the OP and some others are doing.
As a community we’re supposed to help, thus giving back some of what was given (and may be given in the future) to us by others.
Seems like that’s an alien concept for you, uh?
Because we can’t implement every change at once. Just degoogling is tough as hell. I still have an account I use on a really old laptop for dealing with work and the gov just to appear conformist.
Then we have to change email, figure out vpn, find alternatives for everything under the sun, figure out what Linux we can live with and how to maintain it. What phone to buy, how to keep google away from it and Facebook from hiding under every damn thing too.
Going as fast as I can and still be sane. I’m tired boss.
There is no such thing as a perfect solution that also keeps you sane and reasonably able to function in this society of ours. I switched to Proton for mailing service and VPN, Qwant, DNS4EU and you will find people everywhere complaining that their choices are much better and whatnot. I don’t believe it matters that much, it’s more important to decouple from google and big techs in general.
Pihole was my first venture into privacy, and it was years ago. Of course I did not realize that is what it was at the time, I thought it was just ad blocking. I still have a google account for youtube, and I hate that I am using it but that is where the creaters are. I currently do not have anything strong enough to do the whole YouTube without the google thing yet, I hope to be getting a new to me Mac mini that I will install Debian on next week where I will try invedious but right now I have a pi 5 running librewolf with adguard and sponser block. Do not get me wrong it hurts me knowing I am taking money away from creators doing this but it makes me feel better knowing that the Google is not selling me.
I have my own domain that hosts emails I have a wildcard email address so I can give out random emails to people so that I could stop using Apple’s hide my email as I was slowly moving away from Apple already. When Trump got in for his second term and the boycott the US movement started I started self hosting a lot of services.
I in no way meant to implement everything at once, it has taken me years to get where I am. The pihole was just my gateway drug into doing stuff.
This is the way.
You should realize that your piholes call to 3rd party DNS servers unless you use something like unbound which queries root DNS servers.
And by the way, those root queries are unencrypted too.
I do use unbound with CIRA.
NextDNS works when you are not at home.
I use Tailscale on my devices and my servers with pi hole so that I can set them as my dns no matter where I am. Works pretty well and lets me access my other self-hosted services as well.
I think I recall Tailscale being a Microslop product with big tech single sign-on options. Assuming I can get past the MS thing, can we use a regular id/password instead of logging in with big tech accounts?
You could sign in/sign up with your email vs single sign on. I used an alias when I registered. That was some time ago so I’m not sure that’s still an option. I haven’t confirmed.
As far as I can tell, they are not a Microsoft product.
I’m not sure about the MS (which I hate as the next guy), but the point is, it’s what works. You can replace Tailscale with Headscale or NetBird, or even just WireGuard.
The last time I checked, it was not possible for some stupid reasons. I am trying to reduce reliance on them as well as I think its gonna get enshitified soon.
Is it true that Tailscale logs all of your IP addresses and usage timestamps?
It does. It is needed for the services provided inside the console where you manage your mesh. What they cannot see is what you’re actually doing, the content. If you don’t need the services that require that info, then Tailscale is probably more than you need and there are simpler (not easier) solutions.
I was wondering if I could partition my phone and run it, but I don’t want to risk screwing it up.
So does my pihole. You should never trust your ISPs firewall/modem/router, never ever. You should have a hardware firewall/router and than you can set up a VPN into your LAN.
Some ISPs require you to use their router, and their router may not be configurable to support custom DNS or VPN access. For users in that situation third-party DNS can make sense.
Looks like in this case our third party DNS could be compromised. Who knows if they sold our info or not? Third party DNS is the solution with no notice that service no longer works the same.
I’m about to set up Pi Hole with Unbound. F all this.
You won’t regret the move to Pi Hole. It can help protect you while you are figuring everything else out. It’s a long journey and doesn’t need to be perfect all at once. You’ll make mistakes along the way and once trusted providers will enshittify so it will always be a work in progress.
