This is a great solution to a problem that seems to becoming more prevalent. Reminder to devs that bolted on third party scripts should not be in the critical path. Meaning, if you are doing something like capturing a click event in a Google analytics handler and blocking the redirect until you’ve tracked the click - you’re going to have a bad time. Many tracking scripts are designed for this and will gracefully/silently fail via something like an array push mechanism but I’ve encountered the opposite as well.
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects - but it’s also helped me build more resilient applications that work just as well for people who don’t have trackers enabled.
I’ve gotta turn it off a lot for various client projects
As a web dev I'm running into a lot of security products dorking up web projects and processes these days. It seems to be increasing.
I've got customers with security software or other privacy related tools that are constantly 'trying' to do the right thing ... but just become support ticket overhead for me.
It's ULTRA frustrating at this point.
I've run into several customers now whose email scanners not just block emails arbitrary, but also follow links (fine by me) ... and even SUBMIT A FORM (NOT ok). Presumably to avoid some malware delivery, but now they've submitted something to us on a one time use form...
So just sending them an email means their software submits accept or decline options on a form (with our without the email reaching them) and we get a ton of "but I didn't get the email and I didn't decline anything".
Meanwhile the end customer is too technically behind the ball to entirely understand what is going on, and some ultra aggressive IT admin just keeps doing it. If you have a lot of customers it just seems to never end.
I kinda want to abandon email because of it but there's not a lot of good options.
Other issues include some unknown software installed by someone's kid (their IT guy) that blocks rando boring API calls ... the list never seems to end.
I support these privacy / security initiatives 100%, we don't do any insidious tracking or anything like that, but it is starting to hit entirely innocuous stuff.
Read this and replace "web" with "desktop" and large parts are still spot on, wrt virus scanners and the likes. We work on a product of which the installation is a bit complicated because it needs to install a bunch of other things. 95% of the time that fails the reason is some overly active security tool which messes up (the other 5% mainly machines which haven't been updated for years) To the point that we've started wondering if we wouldn't just start requiring dedicated machines or at least without any of that software, or even just ship PCs with the application pre-installed as it would likely turn out cheaper. Unfortunately that is not really an option as a web dev, so that situation is even worse..
I develop desktop apps that are run exclusively virtualized, and don't really have to deal with either set of problems. From a developer perspective I'd say it's a pretty sweet spot, as you get the best of both worlds to some extent.
Granted, communicating with any type of hardware on the users machine is a major challenge. We've had to spend significant effort just troubleshooting printer issues. If you need low latency, virtualization is likely a non-starter.
The upshot is that the latency between our apps and the application server/database (hosted in the same domain) is much lower than for a conventional web app.
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects
When you get enough established paying clients, consider firewalling work gear from home gear.
My client work computers are not my personal computers. My client computers have their own router that is separate from my personal router. At one time I had my personal internet on cable, and my clients on DSL, but unfortunately that's not possible where I am now.
I get a lot of peace of mind from knowing the two are isolated from one another. The only thing they share is a desk. But when work time is done, client laptops go into the closet. Helps with the work-home balance, which is harder working from home.
Any particular reason you don't just use VLANs? It sounds like you're describing a textbook case for them. Nearly any routing software should have a firewall too and the whole point is handling layer 3. Even for purely your own stuff segmenting off various devices into their own subnets can still be handy. If you want you even with a single WAN connection you could do something like get a cheap $5/mo VPS|droplet|etc, run wireguard on it, then route all traffic from a given VLAN through it. That'd give you similar WAN isolation.
Because the router I own is better than the router I don't own.
Further, everything you describe is a bunch of complexity I don't need in my life. My time is too valuable to spend fiddling with configurations every time some piece of kit does a software update.
The way I do it, I plug a wireless router into one ISP, and a different wireless router into another ISP, and I'm done with it. Simple and clean. I'd rather spend my time with my family than "handling layer 3."
Appreciate the reply and everyone has their own circumstances. But it doesn't sound like you've actually considered it or know anything about it which I guess is the basic answer to my question.
Because the router I own is better than the router I don't own.
That's obviously not necessarily true. By this logic all upgrades for all time are pointless. Why get a better CPU/GPU/SSD? "The CPU/GPU/SSD I own is better than the CPU/GPU/SSD I don't own" after all. Except it's not, hence the interest in upgrading.
Further, everything you describe is a bunch of complexity I don't need in my life.
Your setup sounds much, much more complicated actually.
My time is too valuable to spend fiddling with configurations every time some piece of kit does a software update.
This isn't actually a thing. If anything, a core reason for using VLANs is precisely being able to just have any system at all and plug it in/join network and have it all be isolated and routing the right place with zero configuration.
The way I do it, I plug a wireless router into one ISP, and a different wireless router into another ISP, and I'm done with it. Simple and clean.
Sounds complex and PITA, not least because it requires multiple ISPs and associated infrastructure, billing, tech support if needed, dealing with any security issues in their bottom barrel AIOs, etc. It's not free either, dual ISPs at least around here could easily add $400-1200/year. That's real money, even at the low end it's more money than a basic quality switch+router would cost.
I’ve noticed a trend that when visiting the homes of network engineers and sysadmins who have some custom network setup, the wifi is more likely to be broken than the average person who has something off-the-shelf like a Google Wifi puck.
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects
I have a family member who works in marketing and am regularly asked to either turn off the pihole or add a new URL to the ignored list for exactly this reason.
The easiest way around this is to install a secondary browser (or use a profile in firefox, but that is cumbersome) for work. They could use a different DNS provider in that browser. I use Brave for this and Firefox for my private stuff.
Or they could ask their employer to pay for a VPN services that comes with DNS. Your family member will then have an easy to understand and easy to spot (VPN is ON) way to 'go into work mode' and out of it for private.
Or you could have a nice router, like Ubiquiti EdgeRouterX, that is cheap and can create multiple networks. You pin the "marketing enabled" device to a different network without pihole as DNS for their device.
It would be interesting if Firefox could release two nearly identical browsers: Firefox Home, and Firefox Work. The only difference between the two is the name and the color of the icon.
With both programs in their computers, or both apps on their phones, people could more easily isolate the two phases of life, without going through all the rigamarole of profiles.
You've really just described profiles, Firefox just needs to make them easier to use like Chrome. On Chrome they're easier to find, allow you to configure the profile icon, and give you the option to create a desktop shortcut to the profile. Mobile is probably more tricky.
You can use containers, but those only apply to cookies, etc, everything else, settings, add-ons, etc, will be the same. Different profiles allow for different sets of add-ons, bookmarks, settings, etc.
As a person who has been using NoScript or the equivalent for years now, I appreciate this. It also helps out your clients. Instead of a blank page or a broken one, I would now presumably see a functioning page. While they may not get any ad revenue through me, I can't buy their product if they don't let me on the site. Or review it, or tell people about it, etc. There would be a chance now that I would come away from their website with a positive impression instead of hitting the back button and trying the next search result or just writing them off completely.
If you care about privacy at all, the web is a very broken place.
Blocking events until they are handled by the tracker's event queue is quite a common problem when using PiHole. It would be nice if those event handlers were registered using Google Tag Manager as it would mean that those event handers would never be registered if trackers are blocked.
By the way, I use VPN to bypass PiHole when I encounter these problems. It's a lot less hassle than switching the sinkhole off/on.
I’m unable to use my banks app because the tracker being blocked causes an error that fails very loudly and blocks login. I refuse to whitelist it in pihole.
Comments
This is a great solution to a problem that seems to becoming more prevalent. Reminder to devs that bolted on third party scripts should not be in the critical path. Meaning, if you are doing something like capturing a click event in a Google analytics handler and blocking the redirect until you’ve tracked the click - you’re going to have a bad time. Many tracking scripts are designed for this and will gracefully/silently fail via something like an array push mechanism but I’ve encountered the opposite as well.
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects - but it’s also helped me build more resilient applications that work just as well for people who don’t have trackers enabled.
As a web dev I'm running into a lot of security products dorking up web projects and processes these days. It seems to be increasing.
I've got customers with security software or other privacy related tools that are constantly 'trying' to do the right thing ... but just become support ticket overhead for me.
It's ULTRA frustrating at this point.
I've run into several customers now whose email scanners not just block emails arbitrary, but also follow links (fine by me) ... and even SUBMIT A FORM (NOT ok). Presumably to avoid some malware delivery, but now they've submitted something to us on a one time use form...
So just sending them an email means their software submits accept or decline options on a form (with our without the email reaching them) and we get a ton of "but I didn't get the email and I didn't decline anything".
Meanwhile the end customer is too technically behind the ball to entirely understand what is going on, and some ultra aggressive IT admin just keeps doing it. If you have a lot of customers it just seems to never end.
I kinda want to abandon email because of it but there's not a lot of good options.
Other issues include some unknown software installed by someone's kid (their IT guy) that blocks rando boring API calls ... the list never seems to end.
I support these privacy / security initiatives 100%, we don't do any insidious tracking or anything like that, but it is starting to hit entirely innocuous stuff.
Read this and replace "web" with "desktop" and large parts are still spot on, wrt virus scanners and the likes. We work on a product of which the installation is a bit complicated because it needs to install a bunch of other things. 95% of the time that fails the reason is some overly active security tool which messes up (the other 5% mainly machines which haven't been updated for years) To the point that we've started wondering if we wouldn't just start requiring dedicated machines or at least without any of that software, or even just ship PCs with the application pre-installed as it would likely turn out cheaper. Unfortunately that is not really an option as a web dev, so that situation is even worse..
I develop desktop apps that are run exclusively virtualized, and don't really have to deal with either set of problems. From a developer perspective I'd say it's a pretty sweet spot, as you get the best of both worlds to some extent.
That's an interesting point, but I'm not sure how well this works for e.g. communication with low latency harware?
Granted, communicating with any type of hardware on the users machine is a major challenge. We've had to spend significant effort just troubleshooting printer issues. If you need low latency, virtualization is likely a non-starter.
The upshot is that the latency between our apps and the application server/database (hosted in the same domain) is much lower than for a conventional web app.
What crazy-tier security software automatically SUBMITS A FORM on incoming emails? Please tell me so I know to avoid it at all costs.
How does this not break large parts of the existing web, ex. 80+% of password reset mechanisms?
Being an indie dev with a pihole setup has been tough - I’ve gotta turn it off a lot for various client projects
When you get enough established paying clients, consider firewalling work gear from home gear.
My client work computers are not my personal computers. My client computers have their own router that is separate from my personal router. At one time I had my personal internet on cable, and my clients on DSL, but unfortunately that's not possible where I am now.
I get a lot of peace of mind from knowing the two are isolated from one another. The only thing they share is a desk. But when work time is done, client laptops go into the closet. Helps with the work-home balance, which is harder working from home.
Any particular reason you don't just use VLANs? It sounds like you're describing a textbook case for them. Nearly any routing software should have a firewall too and the whole point is handling layer 3. Even for purely your own stuff segmenting off various devices into their own subnets can still be handy. If you want you even with a single WAN connection you could do something like get a cheap $5/mo VPS|droplet|etc, run wireguard on it, then route all traffic from a given VLAN through it. That'd give you similar WAN isolation.
Any particular reason you don't just use VLANs?
Because the router I own is better than the router I don't own.
Further, everything you describe is a bunch of complexity I don't need in my life. My time is too valuable to spend fiddling with configurations every time some piece of kit does a software update.
The way I do it, I plug a wireless router into one ISP, and a different wireless router into another ISP, and I'm done with it. Simple and clean. I'd rather spend my time with my family than "handling layer 3."
Appreciate the reply and everyone has their own circumstances. But it doesn't sound like you've actually considered it or know anything about it which I guess is the basic answer to my question.
That's obviously not necessarily true. By this logic all upgrades for all time are pointless. Why get a better CPU/GPU/SSD? "The CPU/GPU/SSD I own is better than the CPU/GPU/SSD I don't own" after all. Except it's not, hence the interest in upgrading.
Your setup sounds much, much more complicated actually.
This isn't actually a thing. If anything, a core reason for using VLANs is precisely being able to just have any system at all and plug it in/join network and have it all be isolated and routing the right place with zero configuration.
Sounds complex and PITA, not least because it requires multiple ISPs and associated infrastructure, billing, tech support if needed, dealing with any security issues in their bottom barrel AIOs, etc. It's not free either, dual ISPs at least around here could easily add $400-1200/year. That's real money, even at the low end it's more money than a basic quality switch+router would cost.
I’ve noticed a trend that when visiting the homes of network engineers and sysadmins who have some custom network setup, the wifi is more likely to be broken than the average person who has something off-the-shelf like a Google Wifi puck.
They just claim it's broken.
I mean... I guess they could be intentionally inducing the flakiness and running into the network closet for dramatic effect.
If you got good enough router/access points, you could create separate VLANs for client vs private.
Thinking about it, I might just do that when I get back home :)
I have a family member who works in marketing and am regularly asked to either turn off the pihole or add a new URL to the ignored list for exactly this reason.
You can create groups in pihole and select which devices can bypass it. I'm not sure if you can assign specific lists per group, though
I believe you can!
https://docs.pi-hole.net/database/gravity/groups/
The easiest way around this is to install a secondary browser (or use a profile in firefox, but that is cumbersome) for work. They could use a different DNS provider in that browser. I use Brave for this and Firefox for my private stuff.
Or they could ask their employer to pay for a VPN services that comes with DNS. Your family member will then have an easy to understand and easy to spot (VPN is ON) way to 'go into work mode' and out of it for private.
Or you could have a nice router, like Ubiquiti EdgeRouterX, that is cheap and can create multiple networks. You pin the "marketing enabled" device to a different network without pihole as DNS for their device.
More wires. More gear. More complexity. More points of failure. Ugh.
This is exactly what I do.
Brave for work, Firefox for private.
It would be interesting if Firefox could release two nearly identical browsers: Firefox Home, and Firefox Work. The only difference between the two is the name and the color of the icon.
With both programs in their computers, or both apps on their phones, people could more easily isolate the two phases of life, without going through all the rigamarole of profiles.
You've really just described profiles, Firefox just needs to make them easier to use like Chrome. On Chrome they're easier to find, allow you to configure the profile icon, and give you the option to create a desktop shortcut to the profile. Mobile is probably more tricky.
I haven't gotten into the habit of using them, but I believe this is how the Multi-Account Containers add-on works.
You can use containers, but those only apply to cookies, etc, everything else, settings, add-ons, etc, will be the same. Different profiles allow for different sets of add-ons, bookmarks, settings, etc.
I use Firefox Developer Edition alongside regular firefox precisely for that purpose: https://www.mozilla.org/en-US/firefox/developer/
https://addons.mozilla.org/en-US/firefox/addon/multi-account...
You can set a skin or persona per profile, and they will look different.
You can use FF Developer Edition for work. I would do that, but I use FF for home and Edge at work.
As a person who has been using NoScript or the equivalent for years now, I appreciate this. It also helps out your clients. Instead of a blank page or a broken one, I would now presumably see a functioning page. While they may not get any ad revenue through me, I can't buy their product if they don't let me on the site. Or review it, or tell people about it, etc. There would be a chance now that I would come away from their website with a positive impression instead of hitting the back button and trying the next search result or just writing them off completely.
If you care about privacy at all, the web is a very broken place.
Blocking events until they are handled by the tracker's event queue is quite a common problem when using PiHole. It would be nice if those event handlers were registered using Google Tag Manager as it would mean that those event handers would never be registered if trackers are blocked.
By the way, I use VPN to bypass PiHole when I encounter these problems. It's a lot less hassle than switching the sinkhole off/on.
I’m unable to use my banks app because the tracker being blocked causes an error that fails very loudly and blocks login. I refuse to whitelist it in pihole.