How do you deal with https traffic? Wouldn't you need to MITM proxy everything and install CA certs on the client? And wouldn't that reduce client side security since all certs would be signed by the same CA?
Pi-Hole is just a DNS-based adblocker. It returns 127.0.0.1 (I believe) for ad-serving domains, so it happens before https even starts to be negotiated.
For hosts files, 0.0.0.0 is generally preferred, which marks the host as unreachable, rather than localhost (127.0.0.1, etc.), which might well recieve and try to process the request.
I'm using the defaults, but from the sounds of the documentation having it return 0.0.0.0 might be beneficial. It certainly explains some weirdness that I've seen when using Pi-Hole.
