Hacker News Reader

Comment by ssijak | Hacker News Reader

Just use something that lives outside of the browser and covers blocking at the computer level (or router for the whole home), but I prefer at the computer level if you are up to the blocker being proxy for all https traffic.

But a very small number of people will do that. I was surprised how small is the number of people running any adblocker at all.

View on HN

For web browsing, these solutions necessarily cannot be as sophisticated as software running in the browser. They're also much less convenient to install and use.

DNS filters and firewall rules are crude tools by comparison but you can't install uBO on random apps or your TV.

Not to mention this is an attack on multiple fronts: do you _really_ believe DoH is about privacy?

It both is and it isn't. It moves people from different threat models to a middle ground, and for some people that's worse and for some people it's significantly better.

If you live in the U.S. for most major ISP users it's probably a wash and you're just letting a different party have your info. If you live in a nation that desires to control what you consume online then it probably is a net gain.

dnscrypt.org will shuffle between multiple encrypted resolvers. So no single party has your info.

Isn't that worse though since your data would be spread across multiple potentially untrustworthy parties instead of just a single one? Given how many requests a browser makes and normal browsing habits like regularly visiting the same sites, it would eventually lead to each resolver having a full profile of what you browse.

That makes me think of the reason Tor has Entry Guards where the first hop is limited to just a few selected nodes instead of random: https://support.torproject.org/about/entry-guards/

Having adblocker that can monitor all https traffic is very effective, and works on the level of the whole machine.

That option will be gone too. They already tried to go that way this year. They will succeed next time, unless people finally stop using browser made by an advertising company.

DNS adblockers like PiHole are certainly useful, but they don't provide as clean or comprehensive of an experience as a proper ad-blocking extension. For example, bypassing adblock detectors, cleaning up pages that get mangled by the removal of ads, removing ads hosted by the same domain as the desired content, and other things that could never really be accomplished with a domain blocklist.

On the flip side they are largely set and forget for all your devices. They also do things like blocking a Roku device from phoning home.

Oh it also does dns over https which is a nice bonus.

Squid proxy with SSL bumping however does solve all those issues.

Blocking at the DNS level doesn't help if the malicious content (ads/tracking/malware) is hosted from the same domain as the main site.

Reply on news.ycombinator.com