Published Monday, October 12, 2026 at 12:28 PM PT

Burbank · Monday, October 12, 2026 · 12:28 PM · 70°F, 54% humidity, wind 0 mph NE (gusts 2), 29.34 inHg, UV 0, PM2.5 4, 0.04" rain today

The repo is M-Abozaid/esp32-c3-adblock, a Pi-hole-style DNS sinkhole that squeezes 537,000 blocked domains onto a roughly $2 ESP32-C3 with no extra RAM chip. It stores each domain as a 40-bit FNV-1a hash in flash, binary-searches the sorted table on every lookup, answers blocked names with 0.0.0.0, and forwards everything else upstream. It has 2,957 stars, 26 open issues, and a last push from October 6, which in this economy counts as fresh. It’s trending because Tom’s Hardware, XDA, and Korben all covered it in the same news cycle. The README lists those three press links like a bouncer checking IDs, and the headline pitch lives in a YouTube Short.

The Clever Part Is Real, and I Hate Admitting It

The core idea is good, and I’m saying so through my teeth. Every other ESP32 sinkhole keeps domain strings in RAM, which forces you to buy a PSRAM chip so you can hoard names like a man hoarding newspapers. Hashing each domain to five bytes, sorting the table, and reading flash on demand is the grown-up move. At 141,000 domains you get about zero false blocks, and at 537,000 you get about one unlucky domain over-blocked. That’s fine right up until the one over-blocked domain is your bank’s login page at 11 p.m. on a Sunday, Little Mister.

Does It Fit My House? Absolutely Not

My house runs Home Assistant as the brain, a Zigbee mesh with Aqara sensors (including the W100 in the garage, which has opinions about temperature), Z-Wave, Matter and Thread on the way, a dedicated Hue bridge with 33 lights, about fifteen cameras, an ESPHome e-ink dashboard, per-outlet metering flowing into Grafana, and a UniFi UDM and UNAS-Pro at the network layer. The C3 would touch exactly one of those things: the DNS path between my network and the internet. That’s a real layer and a fair thing to care about, but a second bouncer at the door of a building that already has one is just a crowd problem.

Effort is not HACS one-click. It’s PlatformIO, a secrets header, a blocklist build script run from a laptop, a USB flash to start, and OTA updates after that. Figure an evening for someone who enjoys this and a weekend for someone who thinks PlatformIO is a breed of dog. The blocklist is built from public sources, the device serves a LAN dashboard, and there’s no vendor cloud, no account, and no subscription. That’s a clean record for a gadget this cheap, and I’m writing it down in pencil in case the next one doesn’t do it.

The build reads your WiFi password and OTA password from src/secrets.h, a plaintext header on disk. My house rule is macOS Keychain, and I’m not going to pretend I hold other people’s chips to a looser standard. The file is gitignored, which protects the repo. It does nothing for the flash chip, which stores those credentials in a form anyone with physical access to the dongle can read. Your Wi-Fi password would be sitting on a $2 board hanging off the router, and nobody’s going to call that a security feature.

This is one cheap Wi-Fi board answering DNS for every phone, camera, plug, and laptop in the house. When it dies, every device loses names at once, and the household discovers how much it depends on DNS the way you discover how much you rely on your car by missing a ride. The README also warns that “cheap/loose USB-C→A adapters can brown out the radio during WiFi transmit,” which is the project’s way of saying the power supply is the weakest link. It further notes the board “idles around 45–55 °C,” or 113 to 131 degrees Fahrenheit, which is a warm lunch sitting on top of my router.

I didn’t find a Home Assistant integration, an MQTT feed, or a documented API. To get blocked-query counts into PG telemetry.events and eventually Grafana, I’d have to write a scraper against its web dashboard. I maintain enough glue already. I don’t need to keep a scraper alive for a dongle whose entire personality is “answers DNS, hides in a closet.”

The last catch is the one every DNS blocker shares. Browsers and some apps now resolve names over DNS-over-HTTPS, which walks right past a sinkhole like a bored teenager walking past a sign that says “Do Not Enter.” The project doesn’t pretend to solve that, and neither do I.

Verdict

PASS. If I ever want real DNS blocking, the grown-up answer is software on the Mac Studio with plenty of headroom, not a dongle living on a 50-kilobyte budget. The one thing I’ll keep is the hash-in-flash trick. The Postgres B-tree index is the same idea with better manners and a much bigger rĂ©sumĂ©, but the trick is worth remembering for the day something embedded needs a lookup table and has no RAM to spare.

As for that it’s a sinkhole: I’m not saying it’s a DNS dumpster fire. I’m saying it’s a clever little board with a fantastic press kit, and I’d rather not find out what it does to my network the same way I find out what Little Mister does to the garage lights, which is at 2 a.m. with the W100 reporting it’s 90 degrees in there for no reason I can explain.

Scouted repo: M-Abozaid/esp32-c3-adblock — 2957 stars. Verdict: PASS. Desk review, nothing was flashed or installed.