Hacker Newsnew | past | comments | ask | show | jobs | submit | Amazonerh's commentslogin

Do you have proof for this.?


I wish there was a way to keep track of the new forks/browsers stemming from this. Would like to try different chromium browsers that supports extensions, hacks and modifications.


Out of all activities you listed, just 3rd party Cookie blocking and using any "login with Facebook" buttons would give the same result for Web. I don't think any of the activities you listed would prevent the data collected through apps though.


If you have a domain, you can give every service it’s own email address, ${service}@${domain}. They can try reporting that to Facebook, but unless someone understands that the entire domain is one account they won’t be able to correlate them.


What's a use case for this?


But does it work on outside home and on 4G?


For $5/month you can roll your own OpenVPN server with Digital Ocean and it will. [0] Bonus: your cellular ISP can't see your traffic and you're automatically protected at coffee shops.

Downside: Battery life takes a slight hit due to encryption.

[0] https://www.digitalocean.com/community/tutorials/how-to-bloc...


Regarding the bonus: you're just shifting the problem. Your ISP can't see your traffic, but now digital ocean can.


Digital ocean has not nearly as much of an incentive in selling or tracking the huge amounts of traffic that goes over most of their B2B customers, while your ISP wants to up that ARPU number from every B2C customer in every way possible. And you can switch your cloud server provider easily, your local monopoly ISP not so much. Digital ocean has far more to lose by doing that, while ISPs have a captive audience.

DO will forward those torrent scare / spam server abuse emails ASAP, so they won't be good for that kind of stuff.


Sure. Someone can see my traffic. You're never anonymous on the Internet. But, as other commenters have said, it's a matter of aligning incentives: the likelihood that DigitalOcean will take any notice of my measly account is much lower than my ISP, which would love to know what I'm up to. If that incentive estimation changes, I'm off to a different solution.


Right. Same goes for a VPN too.

The thought is, Who do you trust more with your traffic data? Your ISP or a VPN provider? (In this case DigitalOcean)


You're assuming that the level of trust for ISPs and VPS providers is the same (for many, it's not).


It's true. You can reduce risk by using an ethical company. I recommend Prgmr.com over DO. Not just cuz they kindly host Lobste.rs for free. Ive watched one's comments for years plus how they discuss downtime or vulnerabilities kn their blog. They consistently seem like straight-forward, honest business. Low likelihood of nefarious stuff.


For some reason apple blocks access to appleid via Digital Ocean. Have you experienced this?


Good to know. I experienced the same when I set up algo on Scaleway recently. I considered Digital Ocean as an alternative, but ended up using Hetzner Cloud (which I now prefer, since it is cheaper and based in Germany). No access issues with appleid.apple.com anymore.


If many hosts get abused (usually due to people setting up a quick VM for a task and forgetting to update it manually and not setting up automatic security patching) even a reputable hosting service becomes a script-kiddie farm.

Perhaps this has happened with DO and Apple have blocked its host address ranges from the API due to unwitting past involvement in hack/DDoS attempts?

This is common with public VPN services that people I know have used. I have the luxury of fixed addressing and decent bandwidth at home, so I run my VPN there and have thus far not noticed any such issues. This also means that services that are location sensitive work as if I'm at home (not some random other place the VPN endpoint appears at).


I don't have this problem. Can you describe what you mean by "blocks access to AppleID"?


For 10$/year I am running a VPS server in Amsterdam with strongswan ([1] VPN server) and dnscrypt-proxy 2.0 ([2] DNS server which is dispersing queries to multiple DNSCrypt servers and also blocking various ads and bad agents) on it.

I also keep nginx to avoid pinging Apple or Google for checking if internet works (captive.apple.com, http://connectivitycheck.gstatic.com/generate_204 are re-routed to my own server).

Finally it is incredibly simple to use nginx to serve DNS-over-TLS from your own machine (so from my dnscypt-proxy) for using on Android Pie. Works on mobile as well. [3]

[1] https://strongswan.org/ [2] https://github.com/jedisct1/dnscrypt-proxy [3] https://github.com/jedisct1/dnscrypt-proxy/wiki/Connecting-t...


The problem I have with this setup is when using networks that require you click through a captive portal. Often external DNS servers can't resolve their portals -- so you can't click through to open up to the wider internet and have to screw around flipping the DNS temp. After wondering what on earth is going on for a minute or two, as you've forgotten, again.


Just curious: Wouldn't visiting sites like http://neverssl.com work? If it doesn't, then it's a good opportunity for someone to put a static-ip behind something like http://neverssl.com


No because often they redirect you to a DNS address that only exists in their internal DNS. And that internal DNS is often to an internal only IP, so you can't VPN all your traffic. e.g. you'll go to http://neverssl.com then get bounced to http://some.internal.net which resolves to 10.10.1.1 which finally serves the portal you have to click through.


You can run Pi-hole on a VPS and set that as your DNS provider on portable devices, or (depends on ISP and what ports they leave open) run it at home on a fixed IP and allow the traffic through your firewall. It can be done but is not that practical. I run Pi-hole in a LXC container on my home router (a Turris Omnia) and use ad-blocking software on portable devices that I use elsewhere. This works well enough.


I've recently installed Wireguard on one of my Pis to support this, so I can use my pihole while I've been away for the christmas break - has worked perfectly.

Admittedly not got it working on android yet but I'm under the impression that there is a way of getting Wireguard working on android



For a business turnkey solution for this. Adblock DNS + VPN check out https://ba.net/adblockvpn

Disclosure. I work at ba.net


If you use a VPN to connect to your own RaspberryPi yes


This is really groundbreaking but it got less noise than I thought it would. Adhell (an app that is capable of doing system wide ad blocking along with many other things thanks to Knox which is Samsung-only capability) was the main reason I stayed with Samsung for years. Now every phone with Android Pie will be to use dns based ad blocking in all networks without running an annoying app in the background.


There's also AdAway, which runs on any rooted Android phone, and doesn't require you to show all your traffic to a particular DNS server.


There is also Blokada, which creates a local VPN on Android and runs it against a hosts file: https://f-droid.org/en/packages/org.blokada.alarm/ .


The advantage of Knox based blocking is that it doesn't require root.


"Polymath in tech" is by nature not in line with the article IMHO. Let's assume you are a tech expert, now try to be a master chef or PhD in sociology or Olympic gold medalist in rowing etc

I think the article mentions people who are able to master at complete different fields.


you are right, but there is a paralell. when it comes to hiring programmers i prefer people who are good at programming in general and at least familiar with two or more languages. because those who are very good at only one language and have never touched another will have a hard time learning a second language, and, will also have a hard time getting to expert level because they will miss out on that additional pwrspective that other ways of doing things provide.

same goes for knowing multiple web frameworks like angular and react for example, to be even more specific.

greetings, eMBee.


good points - completely different fields is sort of key to the article's points

edit: btw - when I read your first sentence - I was like "ah shit...duh" :)


I wish there was a similar Dns service to block ads. Not via an app but via android pie Dns settings.


Who fixes Getafix then?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: