Pi-hole 5.0 - <AUTHOR> https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/#page-content <comment><USER2> PSA: A RPi running Pi-hole is not a fire-and-forget item. The networked software on it, including pi-hole, sometimes has security holes discovered and exploited, and has to be kept up to date. See eg [https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi...](https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi- hole-remote-code-execution/) & [https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491...](https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491_dnsmasq_vulnerability_and_pihole/) & [https://www.cvedetails.com/vulnerability- list.php?vendor_id=...](https://www.cvedetails.com/vulnerability- list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=16&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411) (afaik Pi-hole is built on dnsmasq)

<comment><USER3> Setting up automatic updates is probably a good idea.

<comment><USER4> Can you recommend a good way to make sure the Pi and Pi-hole are always up to date? I imagine a simple cron with pihole -up is not sufficient?

<comment><USER5> I run this on a cron to auto update PiHole:

        #!/bin/sh

        LOG_FILE=/var/log/update_pihole.log

        echo "Starting upate" >> $LOG_FILE
        date >> $LOG_FILE
        pihole -up >> $LOG_FILE
        pihole -g >> $LOG_FILE

        exit 0

</comment></comment></comment></comment><comment><USER6> Pi-hole is very easy to set up, and it works so well you can basically forget about it from that point on. Blocking ads is nice, but it's also a huge boon for privacy. I run uBlock origin on all my browsers, but Pi-hole still blocks 30-50% of requests on my network. It's also really nice to be able to glance at the logs and get an idea of what's going on on your network, or if there's any unusual activity.

I'm especially excited to see CNAME inspection. I was tired of trying to figure out what domains like "xuenl4v1szy8g.cloudfront.net" were doing.

<comment><USER7> >I'm especially excited to see CNAME inspection. I was tired of trying to figure out what domains like "xuenl4v1szy8g.cloudfront.net" were doing.

Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.

<comment><USER8> Some ad agencies starting asking hosters to add a CNAME record to one of their domains.

Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com.

As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money!

So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad- subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad- subdomain.dastx.me`.

When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more.

What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

This CNAME method is also a huge security issue, but I'm not gonna go into that.

<comment><USER9> > This CNAME method is also a huge security issue, but I'm not gonna go into > that.

I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

<comment><USER10> That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?

<comment><USER11> Yep, that combined with an orphaned DNS record

</comment></comment></comment></comment></comment></comment><comment><USER12> I just realised that if your router runs OpenWrt, you can install PiHole (an equivalent of, rather) directly onto your router by installing the following packages [1]

        dnsmasq
        adblock
        luci-app-adblock

You may also need

        libustream-mbedtls

Just tried it, works great. With a few small lists, the amount of blocked DNS requests is floating at around 30%.

[1]: [https://openwrt.org/docs/guide-user/services/ad- blocking](https://openwrt.org/docs/guide-user/services/ad-blocking)

<comment><USER13> [https://command.honestsec.com](https://command.honestsec.com) sounds promising... looks like the system includes a secure router with secured double layer dns filtering (local at source and upstream resolver).

</comment></comment><comment><USER14> Alternatively for MAX_lazyness and convenience I've been using [https://nextdns.io](https://nextdns.io), does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

<comment><USER7> Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole?

Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option?

[0] [https://nextdns.io/privacy](https://nextdns.io/privacy)

<comment><USER15> No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi- hole in the cloud yourself unless.

Pricing wise it's over 2 years worth of service for the price of an original Pi, a good SD card and a case.

The only circumstances where Pi Hole is unquestionably superior is if you are on a network that redirects all DNS requests there are still some ISPs that do that however if you are on such network you probably want to either get off it ASAP or use a VPN.

<comment><USER16> FWIW, pihole is not tied to any particular hardware. For example:

[https://github.com/pi-hole/docker-pi-hole](https://github.com/pi-hole/docker- pi-hole)

<comment><USER17> Yeah that docker is great! Though it lags behind a bit, it's still on 4.2.2.

<comment><USER18> v5.0 image was released minutes after the main v5.0 release. I've personally not tried :latest, but I am told that works. I prefer to use named tags

<comment><USER17> I don't think it's live on latest. I just did a fresh pull again (I did it a couple hours ago too) but I don't see the new bar graphs nor the local DNS option.

Edit: Oops I didn't wipe the container. Works now!

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> My pihole blocks about 20% of queries. I have noticed literally 0 changes in my internet or computer using experience since installing it.

It's baffling how much useless telemetry and other crap there is, slowing internet down and wasting cpu cycles.

<comment><USER20> There's one thing i noticed: When I click on a twitter link, the first request goes via twitter analytics and gets blocked. I have to click it again, the second time it doesn't go to twitter analytics and the request goes through.

</comment></comment><comment><USER21> > Much more efficient memory use.

This is more impressive than it sounds. My pihole currently uses about 25MB of RAM with over half a million blocked domains and around 20 clients.

<comment><USER22> I'm curious what lists you're using that gets you to 500k blocked domains?

<comment><USER23> [https://dbl.oisd.nl](https://dbl.oisd.nl) has about a million. Using it with minimal whitelisting for about a year, works fine

</comment></comment></comment><comment><USER24> Pi-hole on Apple Watch - just ran up a quick proof of concept. Would there be any use/interest in this?

[https://www.reddit.com/r/pihole/comments/gathus/pihole_on_ap...](https://www.reddit.com/r/pihole/comments/gathus/pihole_on_apple_watch_just_ran_up_a_quick_proof/)

<comment><USER6> That's pretty neat! Do you plan on open sourcing it? I'm hesitant to trust an application with my pi-hole api token (and with it, all of my browsing/network data).

<comment><USER24> It's not my project. I am using it from within Test Flight. It is great for non-technical people who just need to temporarily disable Pi-Hole in order to get some sort of functionality to work that wouldn't otherwise.

One idea that I want to explore is to create an Alexa Skill to temporarily disable Pi-Hole. This has probably been done already.

<comment><USER25> I don't have a link handy but someone mentioned in an HN comment a few days ago that they created a "shortcut" on iOS that simply hits the Pi-hole URL to temporarily disable blocking.

Seemed like a great way to handle that problem -- especially for the non- technical people on your network.

</comment></comment></comment></comment><comment><USER26> I prefer blocking ads by browser extension for PC/iOS and device local MiTM solution (like AdGuard) for Android because these solutions can block more precisely and easier to unblock things permanently or temporary, compared to DNS server solution like Pi-hole or NextDNS. Why choose DNS solution? I suspect the reasons are maybe like for lower resource usage (especially for smartphones), works for smart device like TV.

<comment> matt-attack Content Blockers only work in Safari. There are a host of other apps that I use that are susceptible to ads and tracking. (e.g. Apple News, Apollo (reddit app), hacker news apps, etc. )

<comment><USER27> MiTM solutions work for other apps too.

</comment></comment></comment><comment><USER28> I like Pi-hole, but

pi@pihole:~ $ pihole -up

      [i] Checking for updates...
      [i] Pi-hole Core:     up to date
      [i] Web Interface:    up to date
      [i] FTL:              up to date
      [] Everything is up to date!

pi@pihole:~ $ pihole -v

      Pi-hole version is v4.4 (Latest: v5.0)
      AdminLTE version is v4.3.3 (Latest: v5.0)
      FTL version is v5.0 (Latest: v5.0)

<comment><USER29> Were you on the beta?

Try this pihole checkout master

<comment><USER28> Thanks for the suggestion, it's neat that pihole maintains a git repo like this. I didn't get a chance to try it out though, I just installed from scratch.

</comment></comment></comment><comment><USER30> Is there a way to quickly disable/re-enable pihole for the network?

With AdGuard DNS or uBlock Origin I still get into situations where occasionally they break a site completely and I have to temporarily disable the plugin (or switch to cell tower dns) to get the site working, so I'd want a quick way out of pi-holing traffic as well

<comment><USER31> > Is there a way to quickly disable/re-enable pihole for the network?

Bookmark the following URL

      http://pi.hole/admin/api.php?disable=120&auth=PWHASH

Replace PWHASH with the value of your WEBPASSWORD in setupVars.conf

      cat /etc/pihole/setupVars.conf | grep 'WEBPASSWORD=' | cut -c13-

and '120' with the number of seconds you want to disable the Pi-hole filtering for.

<comment><USER32> Thank you, I've been needing to do this frequently.

<comment><USER33> What kind of sites, if you don't mind sharing?

I've been using pi-hole for 4 years now and I can remember two situations when I had to disable it - and one of those was cloudflare's fault (PS4 cloud saves don't work with 184.108.40.206 DNS)

<comment><USER20> If you download minecraft mods they are often hosted behind some forced ad- showing website (ad-fly or something). That can be a problem with pi-hole.

</comment></comment></comment></comment></comment><comment><USER34> I get a "This connection is not private warning" when trying to read this.

<comment><USER6> [https://web.archive.org/web/20200510233013/https://pi- hole.n...](https://web.archive.org/web/20200510233013/https://pi- hole.net/2020/05/10/pi-hole-v5-0-is-here/)

</comment></comment><comment><USER35> Per client blocking is clearly the biggest change. I am excited about this.

<comment><USER36> What is the use case of per client blocking?

<comment><USER37> Blocking Facebook stuff on every device except my wife's phone.

<comment><USER38> Why not just tell your DHCP server to give her the regular DNS servers? Is this situation where she wants ad blocking but still wants to use FB?

<comment><USER39> Not OP, but in my case, most of my VLANs can't perform DNS requests to WAN. Only the pi.hole server is able to do that (and other devices in the DMZ).

Reasoning: appliances like Chromecast/Apple TV/whatever will often ignore DHCP DNS settings if it doesn't resolve, and they'll reach out to 126.96.36.199/220.127.116.11 directly.

</comment></comment></comment></comment></comment><comment><USER40> Is the cert on pi-hole.net broken for anyone else? It's returning a cert for CN = *.sucuri.net

<comment><USER41> Yeah

<comment><USER40> HN hug of death maybe.

</comment></comment></comment><comment><USER42> Pi-Hole has made my home browsing experience so much better since setting it up. Minimal resource overhead, maximum results - and if you care about stats those are available too but I just turned all logging off.

Now if it could just filter out YouTube ads...

<comment><USER43> > Now if it could just filter out YouTube ads...

Ive heard that the problem is that the native YT apps come with a big list of IP addresses for the ad servers, instead of doing lookups.

<comment><USER44> If true, it would be pretty easy to grab those ip addresses from the binary and add them to a firewall.

A firewall is a little more than what I would trust to a raspberry pie, though...

</comment></comment></comment><comment><USER10> I set up pihole on docker on Windows and it worked great until I rebooted and then the pihoke server (both ports 53 and 80) was unreachable from outside docker even though docker claimed to be forwarding the ports.

So I switched to AdGuard DNS on my devices.

<comment><USER45> Had the container started up?

</comment></comment><comment><USER20> Looks good! Is anyone else getting this during the update?

        [i] Target: https://hosts-file.net/ad_servers.txt
        [] Status: Connection Refused
        [] List download failed: no cached list available

Looking at the query log, I see a fairly large amount of requests 24/7 by my Xiaomi robot vacuum and my Xiaomi desk LED Desk Lamp. I've blocked both of them. Is there any way of disabling the wifi on the desk light completely? Right now i've connected the lamp to my Wifi and blocked it at the router to prevent it from starting its own WiFi network.

<comment><USER6> I'm not familiar with the desk lamp, but take a look at Valetudo for your vacuum.

[https://github.com/Hypfer/Valetudo](https://github.com/Hypfer/Valetudo)

</comment></comment><comment><USER46> haha, just got around to setting up my pi-hole again this weekend... I was wondering why it didn't install 5.0

Just jumped onto it and kicked off a "pihole -up" and off it goes upgrading beautifully.

pihole is a massively underrated project.

</comment><comment><USER47> does anybody know how to properly secure the the DNS server from replay attacks with iptables.

i have a pihone running on a cheap vps on internet, but i connect to it with a vpn and that's draining my smartphone battery. i want to be able to change only the dns settings and point to my pi-hole. but at that time the recommendation was to not run the dns part on the internet because it could be used for dns replay attacks. i found some iptables rules on the net at time but was not sure are they ok. i did not want the ip address blacklisted because i was running some other services on that server.

<comment><USER6> The official documentation includes a tutorial on how to use pi-hole with OpenVPN. This section describes how to use the VPN for only DNS requests:

[https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/](https://docs.pi- hole.net/guides/vpn/only-dns-via-vpn/)

A Wireguard setup would probably be even less resource intensive if you know how to set it up (there's no official tutorial for Wireguard).

Do not open your pi to the internet, I doubt the iptables rules would be sufficient to protect it.

<comment><USER48> > _...there's no official tutorial for Wireguard_

To run a split wireguard-tunnel to a DNS server, add its IP to the _allowed- IPs_ list: [https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun...](https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/)

If you're on an Android phone, apps like Blokada (plain old DNS), Nebulo (DoH and DoT), Intra (DoH) can split tunnel traffic to a DNS server of your choice. Note that, Android 9+ supports DoT, out of the box. Look for the _Private DNS_ setting.

</comment></comment></comment><comment><USER49> I have no connection to NextDNS other than as a very satisfied user, but my Pi-hole got decommissioned a few weeks ago as a result of my discovery of NextDNS.

I also run their DNS53-to-DoH proxy on a small VM and that VM's IP is the first DNS server in the DNS server list included with DHCP leases (with NextDNS's public IPs as the second and third, losing host-level granularity/logging if the VM is down for whatever reason).

</comment><comment><USER50> Donated once to this fantastic project. I have it running on a VPS+wireguard+firewall and all devices configured to use it even when I am out and about and using the mobile. It performs well enough that all of my family is on it now as well. It's chugging along fine on a 3$ a month VPS and accessible only when logged in via wireguard.

Wireguard is working so well, that I am now thinking of starting up additional services for the family to use. Voip/Filestore, pic library etc etc... all firewalled of course.

</comment><comment><USER51> Can someone please explain how exactly does this work? So I have an ubuntu system. Is it ok to just install it in my local system alone and use it? Or should I be doing something to connect to a modem or something? I currently use my phone as the hotspot for my computer.

If I install it say in a remote server in digital ocean, how can I use my phone/computer to use pi hole?

Still a noob when it comes to networking so any help is appreciated thanks :)

<comment><USER52> Not an expert with PiHole other than having set-up one myself not so long ago.

It is a DNS server. Basically whatever you put into DNS Server list on your device (some host on local network, some host with public IP) - your device will send DNS queries to THAT host.

More often than not, you will configure your router to hand out your local devices these DNS servers via DHCP.

So that answers the question: you can host it on local network or use remote server (given you have public IP and can open port 53/UDP). If you don't have firewall there, you will probably be configuring host local firewall to allow using DNS from hosts@home. It may get complicated if you have a dynamic address for your home router.

</comment></comment><comment><USER53> Server is down, right? Not for this case (which I assume is caused by the HN effect) but one downside of this kind of blockers (I also use uBlock in the browser) is that when something doesn't work well in a website, I'm never confident that it's because the site is broken and not because my blockers are breaking it :-)

I know, you can just disable the blocker and try again, but doing so from my phone is not very convenient...

</comment><comment><USER54> Docker image broke for sometime back and its one of the projects that doesn't fix bugs before implementing new features: [https://github.com/pi-hole/docker- pi-hole/issues/559](https://github.com/pi-hole/docker-pi-hole/issues/559)

Good luck guys!

</comment><comment><USER55> Woohoo been waiting for this for months.

I host pihole on a home server in a docker container and spend 5 mins a month just updating it. No other administration. Definitely use it to get rid of trackers and ads.

(I should add that I also pay for about dozen publications/newspapers that I read frequently in lieu of not seeing ads)

<comment><USER56> Look at Watchtower [0] to keep your containers up to date automatically.

[0] [https://containrrr.github.io/watchtower/](https://containrrr.github.io/watchtower/)

</comment></comment><comment><USER57> Just did a `pihole -up` from 4.x and it went off without a hitch. Love the UX of the entire Pihole stack!

</comment><comment><USER58> Does it support blocking YouTube ads yet? I mean the short video ads that interrupt the videos

<comment><USER45> No they come from the same domain as the video that you are trying to watch. If you want to block YouTube ads, then use uBlockOrigin.

<comment><USER59> I though they had multiple domains instead for most ads? As seen here (however this is 4 years ago) - [https://discourse.pi-hole.net/t/how-do-i-block-ads-on- youtub...](https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtube/253)

If this is still true, this pi hole update might solve those ads at least?

</comment></comment></comment><comment><USER60> Cross-posting from my comment on Reddit's /r/Linux

I'm a little disappointed that they seem to be very uninterested on how to get it working on "unsupported" configurations

My x86 gateway currently runs on Gentoo (PFsense kept having random crashing issues) and it's something I'd love to add to it

as far as I can tell all Pi-Hole needs is

\- Lighttpd + PHP (web management portal)

\- DNSMASq (DNS)

\- DHCPD (DHCP)

\- git (blocklist updates?)

There was a single github issue tracker where someone got it working fairly easily (essentially saying "please install package X/Y/Z" during setup) which was closed by the developer as "only two people have asked about Gentoo"

I know Gentoo is fairly niche as far as distributions go, but seeing popular software moving away from "here's how to compile/install it" to "here's a docker container/here's what "we" support" is very disheartening

<comment><USER61> I've made this exact argument before, but it was unpopular. I maintain that if your software distrubution model is writing ISO files to SD cards, it's about as retarded as piping `curl` into `bash`.

I too run a Gentoo server at home (fist bump), and I'm running `dnsmasq` for filtering and caching, and `stubby` for DNS-over-TLS, and I run this beauty of a cron job every morning:

        curl -s --compressed -o /var/lib/dnsmasq/hostnames.txt https://raw.githubusercontent.com/notracking/hosts-blocklists/master/{hostnames.txt,domains.txt} | sed -e '/::/d' -e 's/0.0.0.0//g' -e '/thepiratebay/d' > /var/lib/dnsmasq/domains.txt && rc-service dnsmasq restart

<comment><USER62> The result of this looks a bit mixed up. Are you sure that sedding 0.0.0.0 works? There are some spammers who include 0.0.0.0 in the domain name for example. I used positional splitting with awk to do the same. That worked very well.

<comment><USER61> The `sed` turns this

        address=/example.com/0.0.0.0

into

        address=/example.com/

...which makes dnsmasq return NXDOMAIN instead of 0.0.0.0. I think that's more correct.

<comment><USER62> What about 0.0.0.0.nastydonain.com?

<comment><USER61> Yes, I should fix `sed` to only match end-of-line.

</comment></comment></comment></comment></comment></comment><comment><USER63> Is there any value in Pi-hole for people already running Unbound with a bunch of adblock blacklists ? With OPNsense, it is a three-click setup.

Found one feature: per-client blocking. Anything else ?

<comment><USER6> I run Unbound alongside Pi-Hole. I'm not familiar with all the features of OPNsense, but pi-hole is convenient because it

\- automatically updates the block lists each week

\- supports regex filters

\- has a admin web interface which makes it easy to view statistics and filtering log, edit the whitelist/blacklist, etc.

<comment><USER63> Integration of Unbound in OPNsense has the basics - the web interface lets one edit access lists, blacklists etc. but no statistics dashboard or sophisticated log processing. It supports lists with regex though.

Updating automatically requires a cron job, which has to be added by the administrator using the GUI - adding it automatically is a future feature.

</comment></comment></comment><comment><USER64> I've always planned on building a free DNS using pi-hole. Any comments on this? Will you use it? (I understand privacy is an issue, how to better address this?)

</comment><comment><USER65> Dear Pi-hole devs & maintainers: thank you very much !

</comment><comment><USER66> I run my pihole within LXD on my home server, found it much easier than to maintain another device. Also much more responsive.

</comment><comment><USER67> Literally 1/3 of my traffic is blocked by Pi-Hole as it's tracking/ad crap. That's impressive stuff!

</comment><comment><USER68> Which docker image do I use on raspberry pi 1 B? None of them seems to work, all crash on step `[20] pihole exited 267.`

</comment><comment><USER69> I had setup Pi-hole and it was blocking something like 66% of my internet traffic which amounted to ads and spyware.

A couple of days later, it just mysteriously stopped working and I couldn't for the life of me figure out why. My theory is that AT&T detected my blocking and blocked my internet as a result. Is that too much of a tin foil hat theory? How can I know for sure?

I don't know too much about computer networking, only the basics.

</comment><comment><USER41> Per client blocking looking fab.

...I've got some sketchy IOTs that I've been meaning to lock down a little more.

</comment><comment><USER70> I have never used this but how does it block ads on https pages? Or am I misunderstanding pi-hole?

<comment><USER71> Browsing sites served over HTTPS still requires querying a DNS server to figure out what IP address to connect to. Pi-hole acts as a DNS server and returns invalid results when asked for the IP of a blocked site. Ads are served from a separate domain from content, so they can be blocked without affecting the content.

<comment><USER70> Oh great point. Thanks for the explanation.

</comment></comment></comment><comment><USER72> I host pihole on Digital Ocean. Updated DNS on all my home clients. Smooth and adfree

<comment><USER73> I do it on a PoE powered raspberry pi. Minimal effort, zero maintenance, no fees other than the initial purchase.

<comment><USER74> Do you use a PoE switch for this?

<comment><USER73> I use a ubiquiti switch. I've decided to build my network with PoE in mind and one central location to power it all, backed up by a UPS.

</comment></comment></comment></comment><comment><USER75> So, what's the easiest way to install this on a Comcast household network?

<comment><USER76> I have Comcast. I did it with this guide: [https://willdrevo.com/blocking-ads- with-pihole-mac-os-x-ipho...](https://willdrevo.com/blocking-ads-with-pihole- mac-os-x-iphone-raspberry-pi/)

<comment><USER75> Thanks. I'll take a look at it.

</comment></comment></comment><comment><USER77> Good place to ask: in addition to setting up pi-hole or [https://nextdns.io/](https://nextdns.io/), what browser or device based blockers should be used?

Anyone have the run down on Adblock plus Privacy badger UBlock origin Etc??

</comment><comment><USER78> Does anyone know if pi-hole lets you see per-client bandwidth usage?

<comment><USER79> It can't. There pihole only sees your DNS requests, not any other traffic, so it can't tell if you pulled 100 KB or 100 GB from that domain you just looked up.

It does show you DNS requests counts and such per device, but that's a poor proxy for bandwidth.

</comment></comment><comment><USER80> But don't new browsers and Android use their own DNS servers?!

<comment><USER45> Yes, but you can change them.

</comment></comment><comment><USER81> Neat app, not using it though due to lack of quality control in the blocklists. Are there any changes yet to the quality control of the blocklists used, or is the author still copying lists from the internet without scrutiny?

</comment><comment><USER82> Ok, I give, what is a "gravity database"?

<comment><USER56> Pi-Hole maintains a gravity list (list of domains to block), which is constructed from all the block lists to which you subscribe (public lists), along with your whitelist. [0]

[0] [https://discourse.pi-hole.net/t/does-pi-hole-keep-the- lists-...](https://discourse.pi-hole.net/t/does-pi-hole-keep-the-lists- updated/13224/2)

</comment></comment><comment><USER83> When i uninstalled it broke my linux dns, keeps getting changed to localhost automatically. And om not expert enough on linux to fix it.

</comment><comment><USER84> "Javascript is required. Please enable javascript before you are allowed to see this page."

Required to read the text of the announcement. No. Required to make donations via Stripe. Yes.

RSS does not require Javascript. Looks like the full text announcement.

[https://pi-hole.net/feed/](https://pi-hole.net/feed/)

Alternatively:

       echo 22.214.171.124 pi-hole.net >> /etc/hosts

<comment><USER84> Looks like they fixed the issue.

The above is no longer needed to avoid the Sucuri interstitial page.</comment></comment>


Ask HN: Best coding keyboard? - <AUTHOR>

I've seen the Happy Hacking Keyboard (http://en.wikipedia.org/wiki/Happy_Hacking_Keyboard). It has the CTRL in the right, UNIX-style place (where other keyboards have the CAPS LOCK key). It also features Fn-key access to function keys and arrow keys near the home row. That's pretty close to my dream keyboard.
I'll describe my perfect keyboard, maybe you guys can point me to something close:
1)Apple style flat keyboard 2)No numblock, function keys via Fn-1..0 like Happy Hacking Keyboard 3)UNIX-style CTRL key instead of CAPS, like HHK 4)Fn-hjkl for arrow keys (VIM movement) 5)Backspace/del works like on the Mac keyboard 6)Preferrably programmable in some way, to try out new combinations 7)Quiet, no loud clicking
Anyone know something like this? <comment><USER2> How about an Apple flat wireless keyboard using the built-in Keyboard Mapping preferences panel to map caps lock to control?

Works great for me.

<comment><AUTHOR> I don't like wireless, as I find it very spotty. I've mapped the CAPS to CTRL. But the other stuff is pretty hard - mapping the arrow keys to the home row, for example, which the HHK does (not VIM, which I'd prefer, but close, on the [;'/ keys when depressing Fn). Getting rid of all the function keys and the some of the other stuff is mostly a bonus.

<comment><USER2> I guess I never use the arrow keys, being a 40-years-of-emacs oldster. Control/meta keys all the way. ;-)</comment></comment></comment>


Tip: Want to be more productive? Don't file your email  - <AUTHOR> http://boxfreeit.com.au/Productivity/tip-want-to-be-more-productive-dont-file-your-email.html

<comment><USER2> I only create folders for my emails when I am forced to use Outlook - like on- site at my current main customer. The search functionality of outlook simply sucks, I can't find anything using it. At my own computers, where I use decent email clients, I never create folders.</comment>


Simplify Your Home or Business Address with Zippie (getzippie.com) - <AUTHOR>

Zippie is an app for iPhones and Androids, and Simplify any Home or Business address into short,easy to remember texts called ZippieCodes.
Use ZippieCodes to manage and share your locations and find directions to any address faster!
During Online shopping users can enter Zippie Codes instead of Shipping or Billing Address.
Zippie(getzippie.com) is on AppStore. Check it out.
Here is the explainer video : https://www.youtube.com/watch?v=yQqqKyGCA3o <comment><USER2> I like this feature as it solves a real life problem. Imagine using a short code wherever we fill out those forms online instead of typing the long format.

</comment><comment><USER3> IPhones and Androids? Where's the Android link, please? I don't see it on getzippie.com and I can't find it in Play.

</comment><comment><AUTHOR> @kseistrup : Had to pulldown the app from AppStore due to some security issues.

</comment><comment><USER4> Great stuff !</comment>


Computers dream to be your friend - <AUTHOR> http://blog.epoqueapp.com/2014/07/05/computers-dream-to-be-your-friend/

<comment><AUTHOR> Wondering...to get to this 'goal' of completely ubiquitous tech we need improved things like battery life, natural language processing and....?</comment>


How To Write Unmaintainable Code - <AUTHOR> http://home.tamk.fi/~jaalto/course/coding-style/doc/unmaintainable-code/

<comment><USER2> from page... zOMG this is evil!

CODE THAT MASQUERADES AS COMMENTS AND VICE VERSA

Include sections of code that is commented out but at first glance does not appear to be.

          for ( j=0; j < array_len; j +=8 )
          {
             total += array[j+0];
             total += array[j+1];
             total += array[j+2]; /* Main body of
             total += array[j+3]; * loop is unrolled
             total += array[j+4]; * for greater speed.
             total += array[j+5]; */
             total += array[j+6];
             total += array[j+7];
          }

Without careful attention , would you notice that three lines of code are commented out?

<comment><USER3> Or you could just use virtually any IDE with comment highlighting. Quite a few of patterns mentioned are either mitigated or defeated by good IDE.

<comment><USER4> if by IDE you mean an editor, you don't need an IDE to have syntax highlighting.

</comment></comment></comment><comment><USER5> I like this one:

Object oriented programming is a godsend for writing unmaintainable code. If you have a class with 10 properties (member/method) in it, consider a base class with only one property and subclassing it 9 levels deep so that each descendant adds one property. By the time you get to the last descendant class, you'll have all 10 properties. If possible, put each class declaration in a separate file. This has the added effect of bloating your INCLUDE or USES statements, and forces the maintainer to open that many more files in his or her editor. Make sure you create at least one instance of each subclass.

<comment><USER6> They must of got that idea from Magento.

</comment></comment><comment><USER7>
        Underscore, a Friend Indeed
      Use _var and __var in identifiers.

Even better when it's sometimes __ and sometimes ___ - you can never tell which it is at a glance. (Python is great for this one!)

</comment><comment><USER8> A classic.

My favorite is "Properly-written code never fails, so exceptions are actually unnecessary."

<comment><USER9> A new one, somewhat related to exceptions:

"If you don't know what to do, just return null and pretend like nothing happened! This way you can put all the blame on the caller. Your code effectively becomes flawless!"

</comment></comment><comment><USER10> This should be translated in a few languages I can think of.

</comment><comment><USER6> I'm going to copy and paste this into any empty or default text README.md's I find in projects I'm assigned to work on. Perhaps Github should also post it as the default README.md for any new project.

</comment><comment><USER11> These are all great suggestions, because it's very often (always) that management assumes they know what your software does given the output.</comment>


RoboPizza Lands Stateside - <AUTHOR> http://www.roboticstrends.com/service_healthcare/article/robopizza_lands_stateside/

<comment><AUTHOR> I'll be excited if it also serves Earl Grey, hot.</comment>


Reclaiming Design Patterns 20 Years Later - <AUTHOR> http://blogs.tedneward.com/post/reclaiming-design-patterns/ <comment><USER2> > and written using the design philosophies of the time (stressing > inheritance, for example),

In fact the GoF book is famous for being one of the first to de-emphasize inheritance:

> "Favor 'object composition' over 'class inheritance'." (Gang of Four > 1995:20)

[https://en.wikipedia.org/wiki/Design_Patterns](https://en.wikipedia.org/wiki/Design_Patterns)

<comment><USER3> Came here to say this. I stopped reading at the second sentence.

<comment><USER4> I made it a sentence further, which contains "anything that has ever become a "movement" within this industry eventually disappoints and is burned at the public-relations stake when it fails to deliver"

Structured programming has not met that fate.

</comment></comment></comment><comment><USER5> >20 years ago, the "Gang of Four" published the seminal work on design patterns

How quickly we forget our history.

It was the seminal work on design patterns _in software._ But by 1996 Christopher Alexander, Sara Ishikawa, and Murray Silverstein had been writing about design patterns _in architecture_ for at least 28 years ('A Pattern Language Which Generates Multi-Service Centers', 1968).

And only 2 days ago this was on HN [https://news.ycombinator.com/item?id=11334395](https://news.ycombinator.com/item?id=11334395)

<comment><USER6> It's true that Alexander's design patterns inspired the software patterns that culminated in GoF, but the two have so little in common that it's misleading to think of them as related. The speech that you linked to, which he gave at OOPSLA in 1996 at the height of his influence on software people, is a very long, very polite disclaimer of any relation between the two. It's basically an extended version of McLuhan's "you know nothing of my work" line from Annie Hall.

If we were really trying to apply Alexander to software practice, we would be asking things like which designs create more wholeness or a greater image of beauty in the soul. We don't begin to have such a vocabulary in software; it's hard to even ask what it might mean without laughing. Certainly it has nothing to do with the Visitor pattern for traversing trees or whatnot.

Software design patterns are more comparable to the 19th century compendia of gear mechanisms that crop up on HN from time to time, though more poorly specified. The problem with software patterns (and why the 'movement' failed, IMO) is that either they're incoherent—in which case you can never be sure people are talking about the same things, which does not lead to clarity in design—or they're precise enough to implement programmatically, in which case humans shouldn't need to type them out in the first place.

<comment><USER7> I don't think that you have much experience with software if you really believe that developers and especially people who architect and engineer software do not ask such questions. We do, and the discussions do make it out into the wild from time to time. In particular we discuss these things in software involved with software interfaces, but even the discussions over the suitability of the relational database or the movement towards more functional programming languages touch on these themes.

Just like in building architecture, it is a struggle to think differently, to see new possibilities and new ways of doing things.

As the world changes, our context changes, and from time to time the change accumulates enough strength to become a new thing. We need to watch for those events because when the context changes, so should our patterns of design.

Read up on Engels 2nd law of dialectics The law of the passage of quantitative changes into qualitative changes and Aristotle's Paradox of the Heap.

Using patterns is not so terribly important. What is important is SEEING patterns, UNDERSTANDING patterns and CREATING new patterns.

<comment><USER8> The simplest response would be to point out that Alexander's Pattern Language was intended to (and did) have the effect of allowing ordinary people to design living and working spaces, in such a way that architects and builders could convert their designs directly into building plans.

But no ordinary person can design software with a couple Abstract Factories, a Bridge, and a Strategy. That there are so few design patterns in the original GoF book is a tip-off (there are so many in Alexander's book that the best way to read it is to open to a random page and read either direction).

The most devastating critique of the GoF pattern movement came from Norvig:

[http://norvig.com/design-patterns/](http://norvig.com/design-patterns/)

The GoF pattern language doesn't relate software's design back to its users. It relates Smalltalk to C++ programmers.

<comment><USER9> > Alexander's Pattern Language was intended to (and did) have the effect of > allowing ordinary people to design living and working spaces, in such a way > that architects and builders could convert their designs directly into > building plans

Although he found the same problem as software design patterns suffer from—people assuming the pattern language is a buffet, and adopting whichever they felt like. Attempting to correct for that later led to his The Nature of Order series, which hasn't had any significant effect on the programming community.

</comment></comment></comment></comment></comment><comment><USER7> Great idea. But it would be a mistake to start with GOF because GOF is not the beginning. I first encountered patterns reading Christopher Alexander's books, "A Pattern Language" and "The Timeless Way of Building". Although they were books about houses and other buildings, I was able to apply the ideas in building software on 80's minicomputers using Business Basic and COBOL.

Good architecture should be independent of materials including programming language, even though Alexanders books put heavy emphasis on how choosing good materials allows one to effortlessly apply his Pattern Language to build great buildings.

Also, Alexander's books made it clear that patterns are not building blocks. You need to use creative thinking to be able to combine them into a cohesive design, even adjusting the patterns to fit the situation and documenting your own personal set of patterns.

Too much of the post-GOF use of patterns treats them like fixed building blocks that have to be put together the way the book says, and if you deviate from the book, then you are doing it wrong. I think that is a mistaken way of thinking. It can be useful for a new developer to get over their first couple of years of learning how to build software, but since it is a crutch, using patterns as rigid building blocks will not get you far.

</comment><comment><USER10> This is unfortunately nigh unreadable for me.

This is the original: [http://imgur.com/5FWqZ73](http://imgur.com/5FWqZ73)

This is a version without "font-family" CSS: [http://imgur.com/P9dFKb1](http://imgur.com/P9dFKb1)

(I'm on Chromium on Linux if it matters.)

<comment><USER11> On firefox also on linux reader mode is nice. Further nicer with Pentadactyl and toggling reader mode bound to rr.

Further its possible to style the reader mode with stylish. Example: [https://userstyles.org/styles/114669/firefox-reader- custom-w...](https://userstyles.org/styles/114669/firefox-reader-custom-width- multi-column) you can of course further customize it to allow you to say pick a more desirable font.

Page in reader mode: [http://i.imgur.com/uWrgtMm.png](http://i.imgur.com/uWrgtMm.png)</comment></comment>


How Did the Duck Hunt Gun Work? - <AUTHOR> http://mentalfloss.com/article/26875/how-did-duck-hunt-gun-work <comment><USER2> Little known fact: Duck hunt is a 2 player game.

 _Control pad - Used with Game A for second player to control duck's flight pattern._

Source: <http://www.atarihq.com/tsr/manuals/duckhunt.txt>

<comment><USER3> ...I thought everyone knew that. I certainly did that to mess with my friends/siblings as a kid.

<comment><USER2> I spent countless hours on that game as a kid and only found out about the 2 player option last year!

</comment></comment></comment><comment><USER4> That actually was better than I thought ... I had to double-check on Wikipedia (<http://en.wikipedia.org/wiki/Light_gun#Sequential_targets>) but I didn't know about the sequential-targets approach.

I guess that's because my first exposure to light gun tech was with Commodore hardware, that had already taken the leap to cathode ray timing. Nice to know.

The decline of lightgun tech with the introduction of flat-screen TV:s is something that sometimes makes me sad. The replacement "passive/dead- reckoning" techniques just don't feel as satisfying, or elegant.

On the other hand, keeping a tube TV around just to play Time Crisis is hard to motivate, too. :)

<comment><USER5> I always thought that Namco's GunCon controllers were the most interesting; rather than passively figure out the cathode ray timing, they tapped the video signal to actively read it. They're still the most accurate "light gun" controllers I've used.

<comment><USER6> "Figuring out" seems more active than "reading" to me. But of course being active is better than being passive in our culture, so the newer and better tech will always be labeled "active" no matter what it actually does.

</comment></comment></comment><comment><USER7> Sadly, the Duck Hunt gun doesn't work on some newer LCD/Plasma TV sets.

Some of the newer sets with fancier CPUs are doing all kinds of video processing work on the signal before clocking out the LCD pixels. The delay can sometimes be a couple of frames. While that's not enough to be noticeable or annoying when watching standard TV, it seems to be enough that the NES stops looking for the white video before it can be shown on-screen.

<comment><USER8> That's why rhythm games like Rock Band have an option to synch with the particular display you're using.

Guess the makers of Duck Hunt could hardly have anticipated the need. :)

<comment><USER9> The old analog vs. digital rivalry...

I was a teenager in the 80s when it dawned on me that, during a live broadcast, the electron beam in the CRT was literally being driven, in realtime and over radio, by the camera at the broadcast site. Of course, any respectable broadcaster also had tons of video processing equipment to sync those non-synchronized camera signals ... and to delay the actual transmission for whatever reason (censoring, etc.)

</comment></comment></comment><comment><USER9> "...you don't notice the blackout..."

Maybe _you_ don't, but I did. The screen flashed and you'd see the squares on- screen for that split second. I certainly wasn't fast enough to see the sequence of the squares, but I'd see them appear.

I'd be interested in more technical depth on this exact hardware. Specifically, was each square on-screen for a whole frame or did they draw one square per interleaved field?

<comment><USER10> Unfortunately, this article was weak on pretty much any technical details.

</comment></comment><comment><USER11> Was my television particularly slow? I noticed the blackened screen and white rectangles around the ducks as a kid, but the article says "you don't notice" the blackout and the white rectangles. Surely many of you noticed this as kids.

<comment><USER12> If I remember correctly, I saw it too. But it was kind of camouflaged to look like the effect of shooting the gun.

<comment><USER13> Yes, I seem to recall that there was a 'flash' effect when shooting but it never occurred to me it might be to do with the gun working - just thought it was intended for effect.

<comment><USER14> This is a testament to great design and engineering, turning around an otherwise ugly technical requirement to kind of a neat effect in itself :)

</comment></comment></comment></comment><comment><USER15> This is why I always thought my friends were stupid for sitting up really close to the T.V., whereas I could always beat them by going as far back as the wires would allow. I was widening the field of view, requiring me to be less accurate than at normal range.

<comment><USER16> You could be pointing at any flashing light source and get pretty good results. For example, an Apple II monitor showing TEXT: HOME: FLASH: FOR A = 1 TO 24 * 40: PRINT " ";: NEXT

<comment><USER17> Later games that supported the gun would either have multiple targets and check to see if you hit all of them in a single refresh cycle, or test between refresh cycles to see if you "hit" a non-existent target.

</comment></comment></comment><comment><USER18> The cool thing is that the shot is in the wrong direction. It is the television that shoots a ray into the gun. Of course, there are no other way to do this, but it is fun to think about.

Raytracing is the same. The ray is cast in the "wrong" direction in order to figure out from where it came.

<comment><USER19> Technically ray tracing refers to both eye-based versus light-based ray tracing. Eye based is most often used because it tends to be faster excluding some minor effects like caustics that are easier to generate from the light source. Though complex scenes may benefit from bidirectional path tracing, which is a combination of both.

</comment></comment><comment><USER20> >the sci-fi ray gun-inspired Zapper

Actually, the design of the Zapper was heavily influenced by the High Standard .22 LR target pistol: <http://i.imgur.com/1i9hyvx.jpg>

</comment><comment><USER21> _Light guns hit home video game consoles with Shooting Gallery on the Magnavox Odyssey in 1972. Because the included shotgun-style light gun was only usable on a Magnavox television, the game flopped. The Nintendo Entertainment System (NES) Zapper then fell into the hands of American kids in October 1985..._

A light gun that worked with all TVs was also included with the Telstar Ranger console (a pong game console developed by Coleco and distributed by Sears) in 1977. The gun was used with the skeet games supported by the console and worked pretty well at a distance from about 4 ft (although tracking a large bouncing white block on a black screen was probably not that technically challenging).

<http://en.wikipedia.org/wiki/Telstar_%28game_console%29>

Incidentally, my brother and I had our Telstar Ranger gun (black plastic, very gun looking) confiscated by airport security when we, perhaps unwisely, tried to carry the console, paddles and gun in our carry-on.

</comment><comment><USER22> Here's a video of duck hunt paused a second before a shot.

[http://www.youtube.com/watch?v=-1NyIsZXeqU&feature=playe...](http://www.youtube.com/watch?v=-1NyIsZXeqU&feature=player_detailpage#t=30s)

If you click play and then pause and then hold down space it'll slow-mo the video and you'll see the white block on the black background that the article is talking about.

</comment><comment><USER23> my first 'hack' when I was 8yrs old: put a mirror in front of the game and shoot at it. total duck holocaust

</comment><comment><USER24> Here's an image of the internals of the Zapper: [http://www.todayifoundout.com/wp- content/uploads/2010/12/NES...](http://www.todayifoundout.com/wp- content/uploads/2010/12/NES-Zapper.jpg)

<comment><USER25> Is that a big copper counterweight in the handle? That'd never fly nowadays, copper's too expensive :)

</comment></comment><comment><USER26> Here is a video of Duck Hunt running on a cathode-ray oscilloscope <http://www.youtube.com/watch?v=HhvT2GMOMB8>

</comment><comment><USER27> Back in the early 80's I became the owner of an IBM light pen, IIRC salvaged from a 3270 terminal. By replacing the connector, I managed to get it to work with the CGA card in my IBM PC, which had a light pen connector and a couple of supporting registers.

When the pen was clicked against the screen, it notified the card when it saw the scanline, in a manner quite similar to the duck hunt gun described here. The position of the pen click could then be read from a register on the card.

</comment><comment><USER28> Anyone remember the orange one? I heard they changed it to orange after getting sued due to the grey one looking too "real" - any truth to that legend?

<comment><USER29> I am not sure if it was the case at the time, but I believe there are currently federal regulations that mandate that airsoft guns have to have a bright orange tip.

That is what this wikipedia article indicates anyway, though the section is rather poor: <http://en.wikipedia.org/wiki/Toy_weapon#Toy_weapon_laws>

<comment><USER30> It wasn't just Nintendo guns. I remember that all toy guns switched to ridiculous colors some time around 1988. If I recall correctly, it was a new safety law; the police didn't want to accidentally shoot some kid playing with a toy gun.

</comment></comment></comment><comment><USER31> I thought this game was quite easy to figure out.

I used to build a circuit board version using light sensitive diod and a flash light source.

I didnt make the laughing dog. :P

</comment><comment><USER32> I'm pretty sure at least one game used the horizontal refresh timing to distinguish targets rather than sequential targets; I think it was called "Gotcha!"

I don't know for sure that it used the H refresh, but it would often get targets that were horizontally aligned mixed up (i.e. you hit a different target than you were aiming at), which seems like pretty strong evidence for it.

</comment><comment><USER33> Reminds me of when I was watching William Gibson (Vancouver, early 90s(?)) recite a piece talking about "the glow of light pens [on some device]"... being of a generation that grew up w/ a Commodore 64, my understanding was that light pens _read_ light (and raster position), they don't emit light. I let Mr. Gibson go on in peace, though...

</comment><comment><USER34> For those that want the modern equivalent to relive your old time crisis, HOD, op-wolf days, (e.g. for mame cabinets), apparently the ones that use a dedicated infrared sensor (like the wii) are the most accurate (e.g. www.arcadeguns.com).

</comment><comment><USER35> I actually learned about this when I was trying to interface with a Cabellas Big Hunt orange shotgun I bought at the thrift store.

Sadly, this is not how the gun worked. It was the kind that works by measuring IR sensors.

</comment><comment><USER36> Surprised they didn't mention the original Duck Hunt nintendo game from 1976: <http://www.youtube.com/watch?v=YaUmcG3iors>

</comment><comment><USER37> I have wondered about this ever since I played Duck Hunt in the 90s! Feels great to finally have an answer!

</comment><comment><USER38> Best light gun game: Virtua Cop (Saturn)

<comment><USER39> I am completely biased, but I like Ready, Aim, Tomatoes! for the SEGA Menacer.</comment></comment>