Nowadays the internet is pretty much unusable without ad blockers/dns sinkholes
this post was submitted on 16 Oct 2026
260 points (97.4% liked)
Selfhosted
63050 readers
1035 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I'm building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I'm curious whether it broke smart TVs or apps that phone home hard.
The problem with tarpitting is that apps will try to download the ads before showing you the content, and you will be more annoyed than before
DNS blockers work so why would I need your solution? I dont care if the sites try to reconnect cause the connection wont work nonetheless
Whats with that title? It doesn't say the word DNS, Sink, self or host in the article...
Whys it important to self host? I use ControlD and NextDNS and both have been great.
The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.
Or disable JavaScript
Well yes but no with html5 a lot of JavaScript functions are now possible with html alone so a number of stuff like click or core jacking or even SQL injections into local databases are now possible with html5 even with JavaScript disabled
Link?
This should be the top comment tbh
I only know the basics of networking, so I've been wondering why this "DNS-sinkhole" functionality can't simply be implemented directly in private routers (as some kind of blocklist) instead of adding a new device to your network. Do routers not support this for technical or security reasons?
The german router "FritzBox" recently did implement this.
A very rudimentary version of it but still.
Most consumer routers don't offer this functionality out of the box, likely because manufacturers don't consider it essential for most users. There's no major technical reason it couldn't be built in though. You can already set up DNS sinkholing with OPNsense or pfSense if you don't mind running and managing your own router.
Routers are usually hardware level optimized for throughput, filtering is inherently computationally expensive compared to routing (not crazy expensive just more than usually fits an FPGA), especially if you have to keep up multi-gigabit throughput
You could totally do it at the router, it would just become a more expensive piece of hardware and most people choose to cheap out
I doubt a DNS filter would noticeably increase CPU usage. We’re not talking about deep packet inspection here.
A Raspberry Pi 3b is adequate to run PiHole to do the job, or implementing AdGuard DNS.
However, these require a little skill and knowledge to implement.
Consumer routers aren’t built to do the job.
I love my Pihole. It blocks ads on my PCs, my iPads, our streaming devices, etc. It also blocks telemetry gathering by other device manufacturers.
The last time I opened the Wired site was like 10 years ago, it's still telling me "You’ve read your last free article." See you in 2036 ig
Ha. Here's the direct source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
Thank you sir, the posted article is paywalled
I guessed that an Israeli company would be behind this, and I was right. Am I antisemite?
This is a difficult question to answer. Antisemitism might be the one issue, the only one, regarding marginalisation, that people don't necessarily need more awareness of. I think we're all pretty aware to the extent to which we can help, and the extent to which it's gonna happen whether or not we do anything.
Those ads I see (in Kentucky) entangle Zionism with Judaism too tightly, the 'increased awareness' smells like a radio show my family used to listen to called "focus on the family". every Sunday there was story time, and the lesson of the story was usually "damn, if only these soft-hearted parents would learn that is okay to hit your kids, and is actually evidence that you love them with the REAL love." These ads have the same vibe, because evangelicals are making them, too.
If you want people to stop thinking conspiratorially then for gods sake call out obvious propaganda, you need an amount of nuance most apolitical people aren't willing to engage with in order to understand that it isn't necessarily 'the Jews" making all this pro-Zionist propaganda and shaming you for disagreeing with it.
this is a shit take I'm sure, what do i know, but if there are enough Jewish anti-Zionists in the world to do this, you are going to need to end your toxic relationship with evangelicals, they are stalking you. get the cultural equivalent of a restraining order (me asking you to employ a tool that probably doesn't exist)
sorry for the rant
This reads like a dystopian fever dream, fuck me.
Literally none of that should be surprising for people who have a basic understanding of how the WWW works.
Which, I'm starting to realize, is a depressively low fraction of the general population. I was taught this in middle school, for fuck's sake.
You were taught about zero-click mercenary spyware attacks in middle school? Neat.
No, we were taught about HTTP, the fundamentals of hypertext and how it gets rendered, how embedded code (Flash at the time; yes, I'm old) runs in the browser, and the concept of the digital footprint. The cybersecurity implications were obvious.
Actually, I have to correct myself. Some of this was taught in the 7th or 8th year of primary school, around ages 12-14. I was fortunate to be born in a country, at the right time, where the public education system was still worth something. My heart bleeds when I hear of what goes on across the ocean.
“You’ve read your last free article.”
Do they know how ominous that sounds? It reads like they got mad at my freeloading and sent out a hitman.
load more comments
(2 replies)
Tells me that too. Then I copy the url into my readeck instance and it pulls the article for me and gives me a better reading experience.
load more comments
(2 replies)
Unbound on OPNsense ftw
Absolutely. Remember to enable a cron job in the OpnSense - System > Settings > cron to update the Blocklists. Otherwise you are likely out of date.
I love Unbound bro. Gives a neat list of the noisest domains which I can quickly add to my list if I don't need that site 😌
Just moved to an OPNsense network. Setting up unbound was so nice and simple. Much preferred over pihole.
Agreed. I used pihole initially when I was first learning networking, but when I got a dedicated machine and installed OPNsense, I learned how much easier so many things can be.
The downside is OPNsense is it's information light, and a bit inscrutable lol I'm having an issue with my WAN dhcp going offline, seems to be happening on a cadence. My modem is fine, connection is valid. Rebooting the OPNsense box fixes it. Losing my mind a bit but I'll figure it out 🙃
Try setting a tunable of:
net.link.ether.inet.max_age = 540
By default FreeBSD sets a 20 minute ARP maximum age while many ONT’s set a 9 minute maximum age. This will show up as performance issues initially then cause other issues.
Also Realtek NIC's are notorious for issues with FreeBSD, so if you are using one replacing it with an Intel one is highly recommended.
I believe it was the realtek NIC and some settings offloading to the hardware I set during troubleshooting. Installed the Realtek driver in the plugins and changed those settings and so far no instability! Thank you for the tunable suggestion though I will also be checking that out!
No problem.
Be sure to set a cron job for updating the DNS Blocklists, running zcrubs, smart tests, and trim if you are using a ssd.
I am working on a way to do snapshots for the system as well for super simple restores that are automatically created. Before an update you WILL want to have a snapshot available. Once snapshots are automated I will probably start doing automatic updates. It basically creates a system similar to how an immutable OS works, if something goofs you can simply roll back to a previous working state and pause updates. I previously had a script I setup via a cron job but the system removed the job during an update.
What is a DNS sinkhole and how is it related to the content of the article? Didn't seem to mention DNS
What is a DNS sinkhole
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its "blocklist" then it returns a value of 0.0.0.0 (or some other customizable value including NXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.
Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
how is it related to the content of the article?
The article indicated that the malicious spyware was transmitted through viewable ads on the target's mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
This sounds like AdGuard Home is an example?
Tldr; pi-hole
Unfortunately a lot of the magnificent 7 of advertisers have caught on to this and will serve ads dynamically in many of their platforms.
I've heard that before but I haven't seen an ad in years. But I'm probably not the norm. Between userscripts, ad-removing frontends like invidious and choosing services like Lemmy over the competition, you can pretty safely remove ads from most platforms. Of course, Jellyfin helps 😂
load more comments
(7 replies)
load more comments
(1 replies)
view more: next ›