Deshittification as a Service: Reclaiming Privacy and Performance with OpenBSD
3 hours ago
- Modern smart TVs track viewing habits and serve ads even after opting out, requiring network-level enforcement to restore privacy.
- Deploy an OpenBSD gateway with Packet Filter (pf) and Unbound to isolate untrusted devices on VLANs and intercept evasive traffic.
- Block encrypted bypass attempts (QUIC on UDP 443, DoT on TCP 853) and redirect DNS and NTP queries to local services using pf's rdr-to.
- Use Unbound's local-zone with always_nxdomain to instantly return 'domain does not exist' for telemetry endpoints, avoiding timeouts.
- After a factory reset, manually set the correct time on WebOS TVs to fix TLS certificate validation before blocking telemetry.
- Blocking telemetry improves UI responsiveness and reduces CPU load on underpowered smart TV processors, with similar benefits for mobile devices.
- Passive DNS filtering alone is insufficient; Layer 2 isolation, forced interception, and fail-fast blackholing are required to defeat modern hardware evasion tactics.