<story><title>Cname cloaking, a disguise of third-party trackers</title><url>https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a</url></story><parent_chain><item><author>cheald</author><text>Use a Pihole + your adblocker of choice - defense in depth. It&amp;#x27;s easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I&amp;#x27;ve got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking &lt;i&gt;and&lt;/i&gt; DNS query encryption out to Cloudflare for the whole network, and it&amp;#x27;s really not all that hard to set up. (Edit: Here&amp;#x27;s the bash script I used. docker-compose would probably be better, but whatever. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;cheald&amp;#x2F;23da384908404b0757eadda74124a602&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;cheald&amp;#x2F;23da384908404b0757eadda74124a...&lt;/a&gt;)&lt;p&gt;If you&amp;#x27;re unwilling to do that, just set your DNS servers to the Adguard servers (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;adguard.com&amp;#x2F;en&amp;#x2F;adguard-dns&amp;#x2F;overview.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;adguard.com&amp;#x2F;en&amp;#x2F;adguard-dns&amp;#x2F;overview.html&lt;/a&gt;) and you get most of the same benefit, though obviously without the control that the Pihole offers you. On Android devices, you can go to Settings - &amp;gt; Wifi &amp;amp; Internet - &amp;gt; Private DNS and set  &amp;quot;Private DNS provider hostname&amp;quot; to dns.adguard.com (or your own exposed Pihole server, if you&amp;#x27;re so inclined) and get the same benefit when you&amp;#x27;re on LTE.</text></item></parent_chain><comment><author>linuxdude314</author><text>I don&amp;#x27;t think you understood the article.  Pihole or any blocking DNS server based on blacklists won&amp;#x27;t help here (thats the point).&lt;p&gt;By using random, frequently updating CNAME&amp;#x27;s it effectively defeats the mechanism Pihole uses.&lt;p&gt;You could still block IP addresses of the advertisers, but often time&amp;#x27;s they don&amp;#x27;t do BGP, so they aren&amp;#x27;t going to have blocks under the same ASN you can simply block.&lt;p&gt;It&amp;#x27;s a nuanced and challenging problem for sure.</text></comment>
<story><title>Cname cloaking, a disguise of third-party trackers</title><url>https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a</url></story><parent_chain><item><author>cheald</author><text>Use a Pihole + your adblocker of choice - defense in depth. It&amp;#x27;s easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I&amp;#x27;ve got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over-TLS, so I get adblocking &lt;i&gt;and&lt;/i&gt; DNS query encryption out to Cloudflare for the whole network, and it&amp;#x27;s really not all that hard to set up. (Edit: Here&amp;#x27;s the bash script I used. docker-compose would probably be better, but whatever. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;cheald&amp;#x2F;23da384908404b0757eadda74124a602&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;cheald&amp;#x2F;23da384908404b0757eadda74124a...&lt;/a&gt;)&lt;p&gt;If you&amp;#x27;re unwilling to do that, just set your DNS servers to the Adguard servers (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;adguard.com&amp;#x2F;en&amp;#x2F;adguard-dns&amp;#x2F;overview.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;adguard.com&amp;#x2F;en&amp;#x2F;adguard-dns&amp;#x2F;overview.html&lt;/a&gt;) and you get most of the same benefit, though obviously without the control that the Pihole offers you. On Android devices, you can go to Settings - &amp;gt; Wifi &amp;amp; Internet - &amp;gt; Private DNS and set  &amp;quot;Private DNS provider hostname&amp;quot; to dns.adguard.com (or your own exposed Pihole server, if you&amp;#x27;re so inclined) and get the same benefit when you&amp;#x27;re on LTE.</text></item></parent_chain><comment><author>leeoniya</author><text>sticking OPNSense on one of these [1] was probably the best LAN decision i&amp;#x27;ve made, besides a Synology backup NAS.&lt;p&gt;it acts as a pihole and a lot more (firewall, device vlan isolation, vpn termination, etc). i have these hosts files [2] loaded into its DNSmasq config.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.amazon.com&amp;#x2F;dp&amp;#x2F;B072ZTCNLK&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.amazon.com&amp;#x2F;dp&amp;#x2F;B072ZTCNLK&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;StevenBlack&amp;#x2F;hosts&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;StevenBlack&amp;#x2F;hosts&lt;/a&gt;</text></comment>