AI wrote the readme so it's unsurprising

Yeah, I think they have it backwards. As you say, regardless of how many entries you have locally, the collision risk comes from false positive hash matches not from worrying if the positive hashes collide.

> Two blocked domains with the same hash isn't a problem, they both need to be blocked.

This is a problem if the second one is actually a major useful domain. If HN and adserver have the same hash, you have a problem. This could be described as a false positive for HN.

> Where hash collisions matter is false positives, e.g. if hash(google.com) = hash(adserver.com)

This sounds like the same issue I describe above where you need to use Google but block adserver. Otherwise it's only a problem if you implemented allow lists, right? This is when you explicitly allow Google and implicitly allow adserver along with it because of the hash collision.

And make sure to read the reviews as there are apparently fraudulent versions out there that don't include the 4MB flash chip. That said I took a gamble on a bunch of $2 C3 super minis, and they've had surprisingly adequate signal strength for indoor applications, even in the basement. (-60's dBm)

Not necessarily relevant to the C3, but I have seen others claim the same for S3, only for me to discover the variant they had was the one that requires the external antenna. For official Espressiv modules, the only difference is the position of an 0201 (maybe 0402) resistor, so they physically look identical depending on how good your eyesight is and if you know what to look for. (The part number also differs - but reading that all the way is like reading the manual - most people don't.)

You can find instructions for making and soldering on a small antenna to the common "mini" dev board that reportedly helps quite a bit

Realistically, unless you're planning to manufacture a product, just get an S3.

Far more capable, barely and different in cost. Maybe higher power draw. But can run far more things, more capably.

You mean chip antenna (one that looks like a big SMD resistor)? Yes, they're garbage. But this is orthogonal to the chip itself.

Also, PCB antennas are reasonably good for most indoor situations.

yes and its such a important detail to have in later ESP projects. Having the ability to add antennas onto ESP-32 is a blessing-in-disguise that helps with more complex projects at a range later on

Do you host your lists somewhere you can share?

Tbh, for the ESP32-C3’s perf, an allow list would likely save RAM and CPU time.

"This solution would probably work better for that, I wonder if the good parts of the internet [read: www] would fit into a 140k list."

For almost two decades I have been using an "allowlist", in the beginning it was via authoritative DNS. When proxy software began supporting mapping the DNS data into memory, I eliminates the need to use DNS

I have enough historical DNS data to assess own needs and it's much smaller than 140k

The popular blocklists can be quite strange if one takes the time to peruse them

They include what appear to be some very "bad parts of internet (www)" that I doubt most users would ever visit. There is more in these files than only common ad and tracking domains. As such one could call them "bloated"

It begs the question of how these blocklist maintainers even know about these bad parts

IMHO, the greatest exposure to ubiquitous ads, tracking and telemetry is through use of third party resolvers (in real-time, immediately preceding associated HTTP requests), where some process on the user's computer can potentially look up _any_ domain

Pretending that one can anticipate every possible undesired lookup, e.g., via a "blocklist", is IMHO a high risk approach

But it's popular. To each his own

Every user is different. Relying on a "blocklist" that attempts to anticipate every possible undesired domain is not for me. By contrast, the "allowlist" approach has served me reliably for many years. It sometimes suprises me how well it continues to work year after year

Philosophically, IMO, the contrast between "allowlist versus blocklist" is the difference between (a) "going after what one wants" from the www versus (b) "avoiding what one doesn't want"

The quantity of (a) can be relatively small and manageable. But (b) only grows larger over time, a tsunami full of garbage

I've always thought "ad blocking" was a misnomer. Instead of "blocking" what we as users want to do is "not send requests" to ad/tracking/telemetry servers

The www (HTTP) works via requests and responses. Generally, users make requests and publishers (including advertisers) receive the requests and (usually) send responses. Users are generally not receiving requests and few users would consciously send requests (including POSTing their private data) to ad, tracking or telemetry servers. It is "developers" who are making these requests for ads/tracking/telemetry, not users, by automatically generating them with the software they distribute to users (including Javascripts)

IMO, we don't "block" ads because we never requested them to begin with. What we do is ensure that the requests _made by developers_ do not succeed, we "block" requests that we never made

Segue into debate about user "agency"...

use ublock regardless, lists wont remove everything. you can remove piholelist items from ublock (firefox one, not chrome one).

and every linux user should turn firewall on. and better download CISA hardening guides /best practices . or similar agency guides in countries other than US. they ARE free and mostly unversal, even if guide deals with other distro same principles apply to any system, just use AI to find right commands on your system.

99.999% of linux users who "converted to light of linux" based on nonsensical persuasion from perverts from LTT and other similar perverts, do not follow basic security practices. And these LTT perverts know this and they are laughing at your faces.

Windows in default configuration (as is installed without users turning off updates and other stuff off ) is 1000 milion times safer than linux for DESKTOP in default installed state. Which is state in which 99.9999% of loooosers sorry i meant to say users are using it in.. And im not even talking about totally irrational things to install like Crossover, Lutris and other nonsense based on WINE. I have 80 calls per month about infostealers, spyware in general which stem from using these nonsensical solutions full of old frameworsk (VB, .net etc ) and no security at all. Even official games, on EVERY platform, are scanning whole networks, combing thru your stuff (documents, pictures, webbrowsing activity... ) and noone cares, this is madness.

Distro maintainers should pull their heads from their asses too, how it is possibel to have firewall not enabled in OS in 2026?? HOOOOW. Not even talking about other stuff than like K12 stuff like firewall.

I would think that a regular user of Hacker News would be visiting new websites every day (though it'd definitely still be below 140k)

Just make a captive portal that shows up on your screen for new domains where you can just click "add to allow" or "allow this once" or "add to deny". That way you build the dataset, like most of these tools its annoying in the beginning while you generate the dataset, but after a while its only a few pages a week.

The biggest benefit of my local dns server is latency. On wired internet, my dns is <1ms from my PC.

Upstream dns for me is pretty quick. Google and cloudflare dns are ~5ms from me. But WiFi latency alone is ~8ms most of the time in my experience. On my fiber internet, pinging a dns server in some random upstream server miles away is lower latency than WiFi 10 feet away. But the real issue on WiFi is any packet loss at all adding 50-100ms to that at random depending on interference.

With DNS you are paying this latency cost all the time on nearly every request.

This will be slow for one user, let alone more than one

“The trick everyone misses”

Apparently solving blocking extra domains due to hash collisions (reducing from 1 to 0) would be extra space "to solve a problem I don't have".

I dislike when LLMs talk to me like that. I hate it when humans do it, confidently spewing their overconfident llm assumptions to others

The trick everyone misses: binary search of hashes can be done in log(log(n))

I use arduino-cli exclusively, lighter than ESP-IDF and works completely standalone from the IDE.

Still faster than using a remote resolver: https://www.dnsperf.com/

The simple answer is have 2. If the cost per unit is low enough than deploying 2 PiHoles is trivial.

The developers could make users' lives easier by implementing a clustering option that syncs the 2 out of the box. For static deployments, where you don't change the config too often, it's still decent as it is.

I have my router set up to send DNS requests to my adguard home server, and if there's no response, it falls back to one of Cloudflare's. So it fails-open, letting the ads in along with normal requests.

You can have a 2 adguard home + adguard-sync. Works smoothly.

[dead]

Let’s not trivialize “human rights”, those are much more fundamental issues and this kind of discourse does not help achieve anything.

Pihole and unbound can work together. Pihole isn't a good DNS server, it's a good adblocking DNS server.

people like ease of use, UI, docs, and community.

after all, why use opnSense; just use suricata and $PROPER_X! why use TrueNAS; just use $DISTRO and ZFS!

I'm weird but I need to use a pretty fast PC for a router anyway to get 2.5Gb with QoS and Wireguard for when I'm a road warrior, so I end up just running everything on there rather than having a separate machine for things like Pihole.

I really do need to clean up my DNS setup a bit though. It's pretty wacky right now.