- cross-posted to:
- cybersecurity@infosec.pub
- security@lemmy.ml
- cross-posted to:
- cybersecurity@infosec.pub
- security@lemmy.ml
You must log in or # to comment.
The last time I opened the Wired site was like 10 years ago, it’s still telling me “You’ve read your last free article.” See you in 2036 ig
Ha. Here’s the direct source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
This reads like a dystopian fever dream, fuck me.
Literally none of that should be surprising for people who have a basic understanding of how the WWW works.
Which, I’m starting to realize, is a depressively low fraction of the general population. I was taught this in middle school, for fuck’s sake.
I guessed that an Israeli company would be behind this, and I was right. Am I antisemite?
Thank you sir, the posted article is paywalled
“You’ve read your last free article.”
Do they know how ominous that sounds? It reads like they got mad at my freeloading and sent out a hitman.
Or they know the date and time of your very natural death…
You’ve read your last free article. We suggest going to the doctor for a full workup. Screen for everything. Get a will drawn up. Hug your kids.
Tells me that too. Then I copy the url into my readeck instance and it pulls the article for me and gives me a better reading experience.
Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.
I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.
Na I have regular DNS and I can’t read from wired for years too
Unbound on OPNsense ftw
I switched to pihole. Just found it… easier.
I started on pihole, then the devs messed it all up and made it complicated, so I started using unbound on OPNsense and holy poop was it so much easier for me. But I mean as long as everyone is using something, that’s what really matters. Don’t let these corporations take even an inch
I love Unbound bro. Gives a neat list of the noisest domains which I can quickly add to my list if I don’t need that site 😌
Absolutely. Remember to enable a cron job in the OpnSense - System > Settings > cron to update the Blocklists. Otherwise you are likely out of date.
Just moved to an OPNsense network. Setting up unbound was so nice and simple. Much preferred over pihole.
Agreed. I used pihole initially when I was first learning networking, but when I got a dedicated machine and installed OPNsense, I learned how much easier so many things can be.
The downside is OPNsense is it’s information light, and a bit inscrutable lol I’m having an issue with my WAN dhcp going offline, seems to be happening on a cadence. My modem is fine, connection is valid. Rebooting the OPNsense box fixes it. Losing my mind a bit but I’ll figure it out 🙃
Try setting a tunable of:
net.link.ether.inet.max_age = 540
By default FreeBSD sets a 20 minute ARP maximum age while many ONT’s set a 9 minute maximum age. This will show up as performance issues initially then cause other issues.
Also Realtek NIC’s are notorious for issues with FreeBSD, so if you are using one replacing it with an Intel one is highly recommended.
I believe it was the realtek NIC and some settings offloading to the hardware I set during troubleshooting. Installed the Realtek driver in the plugins and changed those settings and so far no instability! Thank you for the tunable suggestion though I will also be checking that out!
No problem.
Be sure to set a cron job for updating the DNS Blocklists, running scrubs, smart tests, and trim if you are using a ssd.
I am working on a way to do snapshots for the system as well for super simple restores that are automatically created. Before an update you WILL want to have a snapshot available. Once snapshots are automated I will probably start doing automatic updates. It basically creates a system similar to how an immutable OS works, if something goofs you can simply roll back to a previous working state and pause updates. I previously had a script I setup via a cron job but the system removed the job during an update.
These are huge! Thank you for the suggestions I will get to implementing all of these. The only thing I’ve done so far similar to what’s in this list is backing up to my git repo, which is very nice. Every setting change gets committed. Is that different than snapshotting?
Nowadays the internet is pretty much unusable without ad blockers/dns sinkholes
Love blocky. Seems like it flies under the radar.
What is a DNS sinkhole and how is it related to the content of the article? Didn’t seem to mention DNS
What is a DNS sinkhole
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its “blocklist” then it returns a value of
0.0.0.0(or some other customizable value includingNXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
how is it related to the content of the article?
The article indicated that the malicious spyware was transmitted through viewable ads on the target’s mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
Tldr; pi-hole
This sounds like AdGuard Home is an example?
Unfortunately a lot of the magnificent 7 of advertisers have caught on to this and will serve ads dynamically in many of their platforms.
I’ve heard that before but I haven’t seen an ad in years. But I’m probably not the norm. Between userscripts, ad-removing frontends like invidious and choosing services like Lemmy over the competition, you can pretty safely remove ads from most platforms. Of course, Jellyfin helps 😂
Thank you, that kind of explanation exactly what i was hoping for!
Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I’m building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I’m curious whether it broke smart TVs or apps that phone home hard.
The problem with tarpitting is that apps will try to download the ads before showing you the content, and you will be more annoyed than before
DNS blockers work so why would I need your solution? I dont care if the sites try to reconnect cause the connection wont work nonetheless
deleted by creator
I have a finally tuned pihole that offers different blocking for different vLANs on my home network and VPNs, I would not trust a third party for ad blocking. However you do you.
I was watching SomeOrdanryGamers video on this and his pihole did not block all the ads on an ad infected site, but mine could. I have used canyoublockit many times to stress test my system, wish there was something newer though.
Trust it, no.
Is it better than nothing, yes.
Listen, some folks can afford to build and dedicate time and resources to making a pi-hole for their network.
Those who can’t need to know there are alternatives, some are better than others, I’m just sharing information.
I meant no shade, I know it takes a lot of work to do everything I have done for security/ad blocking.
Thanks for the tip. I can’t find pricing on the NextDNS site. Is it free?
Don’t think I have the spoons for things like PiHole.
Edit: found it via web search https://nextdns.io/pricing
