pixelserv pixelserv - A Better One-pixel Webserver for Adblock

[Asad Ali]

I've done that already. Can I delete the package file to force a re-download?

Yep you can try that. Use these commands in terminal one by one.

"opkg remove pixelserv-tls"

"opkg install pixelserv-tls"

P.S Before trying that did you restart Pixelserv-tls AFTER you did the ep>6>5 upgrade? Because that's necessary.

 

[joe68000]

Yep you can try that. Use this commands in terminal one by one.

"opkg remove pixelserv-tls"

"opkg install pixelserv-tls"

P.S Before trying that did you restart Pixelserv-tls AFTER you did the ep>6>5 upgrade? Because that's necessary.

Yep. I followed the instructions and upgraded the entware packages - there were a lot. Then I restarted pixelserv. When I noticed the compile time had not changed, I posted about it. I'll try forcing the upgrade using the above steps now.

 

[joe68000]

Yep. I followed the instructions and upgraded the entware packages - there were a lot. Then I restated pixelserv. When I notice the compile time had not changed, I posted about it. I'll try forcing the above steps now.

That worked. After removing and reinstalling, I restarted and I see the new version is installed:

pixelserv-tls 2.3.1 (compiled: Jan 31 2020 13:27:14 flags: tls1_3) options: 192.168.2.3

Thanks very much! I am now curious why I am not seeing the "tfo" TCP Fast Open flag. It doesn't look like that is something that is explicitly enabled.

 

[Asad Ali]

I am now curious why I am not seeing the "tfo" TCP Fast Open flag. It doesn't look like that is something that is explicitly enabled.

TCP Fast Open is only supported in newer HND router's kernel i.e RT-AX88U and RT-AC86U.

 

[joe68000]

TCP Fast Open is only supported in newer HND router's kernel i.e RT-AX88U and RT-AC86U.

Ah, ok. Thanks again!

 

[HorseCalledHorse]

That worked. After removing and reinstalling, I restarted and I see the new version is installed:

pixelserv-tls 2.3.1 (compiled: Jan 31 2020 13:27:14 flags: tls1_3) options: 192.168.2.3

Thanks very much! I am now curious why I am not seeing the "tfo" TCP Fast Open flag. It doesn't look like that is something that is explicitly enabled.

Just wanted to pipe up and say I had exactly the same issue on my AC86U. Same solution, too. Thanks, @Asad Ali!

 

[gattaca]

Just wanted to pipe up and say I had exactly the same issue on my AC86U. Same solution, too. Thanks, @Asad Ali!

^^^ Ditto. Did the ep route and even restarted the router - no updated header. It was only after removing the package and resinstalling manually as suggested did the 1/31 date show up. That's a bit strange too.

 

[Flatlander]

I am using Pi-Hole and pixelserv-tls on the same machine (linux gateway), like this:

After setting up pihole, you can change the ip-address in /etc/pihole/setupVars.conf. In my case I am running the pihole-admin via ip 192.168.1.254 and pixelserv-tls on 192.168.1.253. Change the line in the conf-file to: IPV4_ADDRESS=192.168.1.253/24

Also change the pihole blocking-mode (in /etc/pihole/pihole-FTL.conf) to
BLOCKINGMODE=IP-NODATA-AAAA

Use BLOCKINGMODE=IP if you also need IPv6 support.

Now, pihole redirects to this ip-address, which is where pixelserv-tls is listening on. You need to configure lighttpd to only listen to 192.168.1.254 (or in my case apache2 as I am serving pihole via a virtual host). For lighttpd you need to add the following line to the config file:
server.bind = "192.168.1.254"

I still do not have pixelserv-tls running correctly, due to certificate issues, but pihole "forwards" the requests to pixelserv-tls just fine.

P.S. I had edited the wiki, but removed it again. Better ask permission here...

 

[Jack Yaz]

Here we go again!

https://www.theregister.co.uk/AMP/2020/02/20/apple_shorter_cert_lifetime/

 

[Makaveli]

Here we go again!

https://www.theregister.co.uk/AMP/2020/02/20/apple_shorter_cert_lifetime/

After the last set of changes to pixelserv are we currently at 2 years max for certs?

 

[dave14305]

Here we go again!

https://www.theregister.co.uk/AMP/2020/02/20/apple_shorter_cert_lifetime/

Seems like it would be easier for @kvic to implement the cert lifetime as a command line parameter instead of hardcoding, since it is changing so frequently now.

 

[RMerlin]

Here we go again!

https://www.theregister.co.uk/AMP/2020/02/20/apple_shorter_cert_lifetime/

Screw Safari, quite frankly... And screw Apple. The industry held a ballot on this, it didn't pass. So they decided to ignore ballot results anyway and still do whatever they wanted to do, ignoring what the rest of the world wanted.

 

[EmeraldDeer]

"Certificates issued prior to September 1 will have the same acceptable duration as certificates do today, which is 825 days. No action is required for these certificates."

 

[thelonelycoder]

Here we go again!

https://www.theregister.co.uk/AMP/2020/02/20/apple_shorter_cert_lifetime/

Combined with the unsatisfying situation on this thread's topic, I seriously consider to drop usage of it.

 

[terminator]

Just got this up and running. When the Chrome add-on 'AdBlock' is used, it gets rid of the entire ad including the whitespace. This keeps the whitespace there. Is there a reason for that or am I missing something?

 

[jrmwvu04]

Just got this up and running. When the Chrome add-on 'AdBlock' is used, it gets rid of the entire ad including the whitespace. This keeps the whitespace there. Is there a reason for that or am I missing something?

Add-ons clean up/modify the html, eliminating the white space. DNS redirection just blocks the connection to the ad server - the html is unaffected. Limitation of the method.

 

[terminator]

Add-ons clean up/modify the html, eliminating the white space. DNS redirection just blocks the connection to the ad server - the html is unaffected. Limitation of the method.

Ahh, makes sense. Thanks!

 

[terminator]

Actually, another question. Is there a way to use a paid certificate instead of the self signed one so it doesn't have to be installed on each device? I did it easily on macbook but for iPhone and other mobile devices it won't be that easy + guests.

 

[dave14305]

Actually, another question. Is there a way to use a paid certificate instead of the self signed one so it doesn't have to be installed on each device? I did it easily on macbook but for iPhone and other mobile devices it won't be that easy + guests.

You need a CA cert, not just a server cert to sign the certificates Pixelserv will generate. So I think the answer is no.

Importing the CA cert is pretty well documented on the wiki for most devices and browsers.
https://github.com/kvic-z/pixelserv...ificate#import-pixelserv-ca-on-client-devices

 

[jsbeddow]

Combined with the unsatisfying situation on this thread's topic, I seriously consider to drop usage of it.

Err...? Could I ask for a clarification here? Do you mean that you will personally drop (stop using) Safari, or are you considering dropping support for pixelserv (and the corresponding certificates) within Diversion?

I agree with the first possibility, but would be thoroughly shocked if you meant the second one.