- 5 Posts
- 30 Comments
7·13 hours agoPretty interesting. It is a rabbit hole, you say well I dont trust this so I secure it here, and then you have to trust the next layer down. Eventually you have to have some level of trust. But I think its pretty cool none the less.
This is like chaff, and I think it would work. But you would have to deal with the fact that whatever patterns it was showing you were doing “you would be doing”.
I think there are other ways that AI can be used for privacy.
For example, did you know that you can be identified by how you type/speak online? what if you filtered everything you said through an LLM first, normalizing it. Takes away a fingerprinting option. Could use a pretty small local LLM model that could run on a modest local desktop…
Ton of comments, and I havent read them all, but I wanted to ask if you really meant popular or if you wanted something for a specific reason. Easy for new ppl to linux, good for desktops, etc etc.
I dont really use GUIs on linux, except for when I want to have a fancy pants riced network monitor type situation. I am a big fan of NixOS except for python Dev stuff. Big fan of being able to clone a machine or recover a machine with a single conf file.
I will also say that what I have listed is for my known digital foot print. If you catch my drift.
You are right. It’s the choice I’ve made. I’m decided that I would rather have the lock down because I no longer think that being anonymous means anything. It’s my opinion that due to the rise and ease of apply AI/ML and computational access we are all data points. So it’s no longer a matter of blending in.
TLDR, I weighed the two and chose this
They aren’t open. But yes. It would be if they were. The are open within my VPN. :)
Can you explain that?
sure thing, here you are
services: pihole: container_name: pihole image: pihole/pihole:latest ports: # DNS Ports - "53:53/tcp" - "53:53/udp" # Default HTTP Port - "8082:80/tcp" # Default HTTPs Port. FTL will generate a self-signed certificate - "8443:443/tcp" # Uncomment the below if using Pi-hole as your DHCP Server #- "67:67/udp" # Uncomment the line below if you are using Pi-hole as your NTP server #- "123:123/udp" environment: # Set the appropriate timezone for your location from # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones, e.g: TZ: 'America/New_York' # Set a password to access the web interface. Not setting one will result in a random password being assigned FTLCONF_webserver_api_password: 'false cat call cup' # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all' FTLCONF_dns_listeningMode: 'all' FTLCONF_dns_upstreams: '127.0.0.1#5335' # Unbound # Volumes store your data between container upgrades volumes: # For persisting Pi-hole's databases and common configuration file - './etc-pihole:/etc/pihole' # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true' #- './etc-dnsmasq.d:/etc/dnsmasq.d' cap_add: # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities # Required if you are using Pi-hole as your DHCP server, else not needed - NET_ADMIN # Required if you are using Pi-hole as your NTP client to be able to set the host's system time - SYS_TIME # Optional, if Pi-hole should get some more processing time - SYS_NICE restart: unless-stopped unbound: container_name: unbound image: mvance/unbound:latest # Change to use 'mvance/unbound-rpi:latest' on raspberry pi # use pihole network stack network_mode: service:pihole volumes: # main config - ./unbound-config/unbound.conf:/opt/unbound/etc/unbound/unbound.conf:ro # custom config (unbound.conf.d/your-config.conf). unbound.conf includes these via wilcard include - ./unbound-config/unbound.conf.d:/opt/unbound/etc/unbound/unbound.conf.d:ro # log file - /srv/docker/pihole-unbound/unbound/etc-unbound/unbound.log:/opt/unbound/etc/unbound/unbound.log restart: unless-stoppedI am relatively new to docker as well tbh. I did a lot with virtualization and a lot with linux and never bothered, but I totally get the use case now ha. just an FYI, if you use docker on Windows it runs slower as it has to leverage the Windows subsystem Linux (WSL) and a slightly different docker engine (forget which one). So linux is your best bet. If you do want to use a full VM I found Qemu to be the best option for least resource usage.
Yes, you can give fake info. I would say thats kinda the next step. Harden your browser and associated tech stack so you are secure. Then provide fake data that is generic enough so that it blends in. firefox or chrome standard agent, windows 11, etc.
for example https://deviceatlas.com/blog/list-of-user-agent-strings
The problem with hardening your system is that you become more identifieable unless you provide fake data. For example, here are my test results from coveryourtracks.eff.org
Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 2054.58 browsers have the same fingerprint as yours.
plugins are definitely detectable. just came across this, worth checking out your browser security.
everything you do to customize your browser makes your browser fingerprint unique. but you have a mostly unique fingerprint due to things you arent considering as well. system related stuff that your browser tells about you.
you have some options. 1) there are addons that limit privacy issues, 2) use a local web proxy, im using squid proxy for example just have it running on an old laptop. Optionally, I would also say, from a privacy standpoint look into DNS blackholing pihole, unbound, etc, and there are plenty of other things.
my favorite addons are ublock, privacy badger, i run noScript which is probably more painful than most are willing to put up with but I have heard that jShelter is a good compromise.
happy to share my docker-compose with pihole and unbound. im not the original author its a compilation of a few peoples. no issues. normal DNS inside the house DoT outside.
I have been thinking about this a lot recently. I live a life where OPSEC is relevant. Its something that I have had to consider always, and has been for 2 decades. Even so, I wasn’t as concerned this whole time as I am these days. The fact is that technology is making it such that its no longer “im not a person of interest they wont spend resources on me” because data crunching is happening to such an extreme, on such a grand scale, that person of interest doesn’t even matter. Do you exist, yes. Do you have a digital foot print, yes you do. Even if you dont do a lot online. Your metrics are being captured and being inferenced, and systems are using predictive analysis to determine what you “may” do in a given situation. Depending on who controls those systems they may decide not to give you a chance to make that choice.
Ill I can say is that there are a large number of groups that want your data, for a lot of different reasons, and none of them are for your benefit. So, are you going to let them have it, or are you going to take steps to reign in the amount of info you leave about?
Checking out RethinkDNS right now, this looks great! Thanks. Was tracking most of the other stuff, that stuff holds true on computers as well, but on mobile I was kinda drawing a blank.
Interesting in learning more about that. I do a lot of dev work with AI, agentic and otherwise. Did a proof of concept for quick fact finding but of course you run into “where do you source the truth” and the more I looked the harder it was.
totally arbitrary, lol. Im used to DNSSEC, saw DoT and DoH about the same time, think I saw a write up that used DoT and just went for it. Havent even compared DoT vs DoH, but DoH reminds me of Homer Simpson cuz im old XD
In my particular setup, I have an additional constraint and that is that my network has to be designed for portability and travel. Not that it affects your design per say. Thank you for the response. Just something that occurred to me that I hadnt mentioned.
I am living a transient life at the moment. So lots of virtualization and lack of control concerning the WAP and such.
I do like your set up btw.
Yeah, I am pretty close to that, the pihole to unbound, unbound DoT to cloudflare. What I am doing at this point is bypassing the DNS to ISP, but as I stated in my response above, not yet blocking everything on the net from using the regular stuff. Just feasibility testing at the moment.
Love the dual setup for DNS. I set my primary to this and my secondary to just cloudflare at them moment for when I bork my primary DNS will fidgeting with it, haha.
Ok, got another one for ya based on some comments below. You have all the usual addons to block ads and such, but you create a sock-puppet identify, and use AI to “click” ads in the background (stolen from a comment) that align with that identity. You dont see the ads, but the traffic pattern supports the identity you are wearing.
So rather than random, its aligned with a fake identity.