3 ms·

How?

by realshowbiz 7y ago

How?

Skunkleton 7y ago
Dns blacklisting of ad domains is a common technique.
- staticassertion 7y ago
  That hardly makes ads "unblockable".
  - squiggleblaz 7y ago
    At the moment you can make a tv that resolves dns using 8.8.8.8 and looks at fancy.ads to display an add in the tv guide/web browser/youtube app/whatever. But I can make my router direct any dns request back to itself and filter fancy.ads so that it never resolves to anything useful. DNS over HTTPS means that you can make a tv that resolves dns using https://8.8.8.8 https://8.8.8.8 and looks at fancy.ads. But I can't mitm it because I don't have a suitable trusted certificate to respond to that request. So either the request to fancy.ads gets dropped and the request to online.movies.example.com gets dropped so I can't use my smart tv for its intended purpose. Or both get through. Obviously things are different if the service uses standard OS level configuration so I can tell it to resolve dns using https://my.adblocked.dns https://my.adblocked.dns or /etc/hosts. But nothing obliges any particular system to do that. If my logic is faulty, please, do inform.
    - uponcoffee 7y ago
      The solution is to do as most goverments do [0]: sniff the SNI header during TLS handshakes and drop the connection if the domain matches your blocklist(s)//regex filters. [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
    - NegativeLatency 7y ago
      If you could get your own cert onto said device you could MITM yourself and preserve adblocking.
    - squiggleblaz 7y ago
      I can't reply to my children, so I'm replying to myself instead. Uponcoffee suggests inspecting the SNI header to drop the TLS handshake. So the DNS resolves fine, but when they try to connect to https://fancy.ads https://fancy.ads, that request is tampered with and fails. As far as I know, that depends on a bug in TLS which will be fixed in some future version, so that inspecting such a request becomes impossible. NegativeLatency suggests installing an alternative certificate. This would presumably work if I have root access to my smart device. Maybe I can get access to root on my smart tv, I'm not sure, I don't use smart tvs. But random people can't get access to root on their phone. It will break their banking apps. I can install an adblocker on my phone and accept the consequences of my actions. I'm not sure what the tradeoff between adblocking and banking apps is, even for me. I would probably want to write my own browser based app to let me log into my bank from an separated web browser - if I'm trying to log into my bank when I'm standing in the queue I don't want to piss fart around with stupid browser tabs. I certainly can't tell my coworker "yeah I'll just install this ad blocker on your phone, it'll block some analytics too so your privacy will be a little more respected" if the only way to do it is to break their banking apps. I mean, okay, the ads aren't unblockable. But we are at the point where I have to make a trade off between letting you run whatever code you want on my phone, and letting you not run any code at all on my phone. Capitalism depends on negotiation to work. If it's just "I'm a big company, use my service or don't", capitalism stops working.
      - uponcoffee 7y ago
        Fair, ESNI will eventually fix that but it's still a ways off from a finalized standard, and further still from being adopted en masse. Then there's the option to reverse lookup the dns record associated with a given ip. So ad blocking/censorship will still be viable for a while yet.
    - shawnz 7y ago
      If the TV manufacturer wanted to implement this mechanism, they wouldn't need DoH to do it. They could just put the ads right on online.movies.example.com and use TLS there. Any kind of ad-blocking mechanism based on DNS is trivially bypassable. Suggesting that we should weaken encryption/privacy because some people plan to use it in ways that we don't like is just not a viable option. It's exactly the argument that governments are trying to use to mandate backdoors in our chat services. With encryption, it's all or nothing.
  - Skunkleton 7y ago
    Do you wear a seatbelt? Its the same thing.
- deathanatos 7y ago
  And how does DoH prevent that? I would presume that, like with DNS over DNS¹, a resolver could check /etc/hosts first prior to attempting to resolve over the network; do proposed DoH resolvers not do that? Worse comes to worse, you could always run your own local resolver. ¹or whatever we're calling the original protocol now
  - Skunkleton 7y ago
    DoH bypasses the normal resolver, and gives control over resolution to the browser. Not a big deal if your browser is from Mozilla. A little more concerning if your browser is from google.
    - derefr 7y ago
      That's how it's done now, because browsers want to push the tech when nobody else has yet bothered; but it would make a lot more sense in the long term for DNS to stay an OS-level concern, so I would expect DoH to be implemented by the OS DNS resolvers.
    - shawnz 7y ago
      DoH is just a protocol. Your appliance/application could choose to bypass the network specified resolver whether or not it uses DoH.
Avamander 7y ago
Internet of Shit devices, Smart TVs and etc. would be unaffected by DNS-level adblocking. But to be fair, one shouldn't support such awful business practices by buying such devices anyways.
- jimmaswell 7y ago
  What's so awful about a device having ads in it?
  - qzervaas 7y ago
    There was a recent count of some smart TV brand showing an advert on the on-screen volume slider. How do you like them ads? Update: https://www.flatpanelshd.com/news.php?id=1416894724&subaction=showfull https://www.flatpanelshd.com/news.php?id=1416894724&subactio...
    - jimmaswell 7y ago
      The devices would be more expensive otherwise. I don't really mind, especially in a case like this where you can just turn it off.
    - squiggleblaz 7y ago
      Do your child, since I cannot reply to them: You have no evidence that the devices would be more expensive. Your only evidence is that the companies would receive less income all else being equal. But what is the evidence that the trade off is your eyeballs instead of your dollars? And if the tv is perfect except for the ads, where do you get the more expensive, ad free version?
      - jimmaswell 7y ago
        You can buy "dumb panels" but they apparently cost more. Some of that is that they're rated for rougher conditions being mounted in public places though. And why can't you respond to me?
  - 7y ago

How?

Skunkleton 7y ago

Dns blacklisting of ad domains is a common technique.

staticassertion 7y ago
That hardly makes ads "unblockable".
- squiggleblaz 7y ago
  At the moment you can make a tv that resolves dns using 8.8.8.8 and looks at fancy.ads to display an add in the tv guide/web browser/youtube app/whatever. But I can make my router direct any dns request back to itself and filter fancy.ads so that it never resolves to anything useful. DNS over HTTPS means that you can make a tv that resolves dns using https://8.8.8.8 https://8.8.8.8 and looks at fancy.ads. But I can't mitm it because I don't have a suitable trusted certificate to respond to that request. So either the request to fancy.ads gets dropped and the request to online.movies.example.com gets dropped so I can't use my smart tv for its intended purpose. Or both get through. Obviously things are different if the service uses standard OS level configuration so I can tell it to resolve dns using https://my.adblocked.dns https://my.adblocked.dns or /etc/hosts. But nothing obliges any particular system to do that. If my logic is faulty, please, do inform.
  - uponcoffee 7y ago
    The solution is to do as most goverments do [0]: sniff the SNI header during TLS handshakes and drop the connection if the domain matches your blocklist(s)//regex filters. [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
  - NegativeLatency 7y ago
    If you could get your own cert onto said device you could MITM yourself and preserve adblocking.
  - squiggleblaz 7y ago
    I can't reply to my children, so I'm replying to myself instead. Uponcoffee suggests inspecting the SNI header to drop the TLS handshake. So the DNS resolves fine, but when they try to connect to https://fancy.ads https://fancy.ads, that request is tampered with and fails. As far as I know, that depends on a bug in TLS which will be fixed in some future version, so that inspecting such a request becomes impossible. NegativeLatency suggests installing an alternative certificate. This would presumably work if I have root access to my smart device. Maybe I can get access to root on my smart tv, I'm not sure, I don't use smart tvs. But random people can't get access to root on their phone. It will break their banking apps. I can install an adblocker on my phone and accept the consequences of my actions. I'm not sure what the tradeoff between adblocking and banking apps is, even for me. I would probably want to write my own browser based app to let me log into my bank from an separated web browser - if I'm trying to log into my bank when I'm standing in the queue I don't want to piss fart around with stupid browser tabs. I certainly can't tell my coworker "yeah I'll just install this ad blocker on your phone, it'll block some analytics too so your privacy will be a little more respected" if the only way to do it is to break their banking apps. I mean, okay, the ads aren't unblockable. But we are at the point where I have to make a trade off between letting you run whatever code you want on my phone, and letting you not run any code at all on my phone. Capitalism depends on negotiation to work. If it's just "I'm a big company, use my service or don't", capitalism stops working.
    - uponcoffee 7y ago
      Fair, ESNI will eventually fix that but it's still a ways off from a finalized standard, and further still from being adopted en masse. Then there's the option to reverse lookup the dns record associated with a given ip. So ad blocking/censorship will still be viable for a while yet.
  - shawnz 7y ago
    If the TV manufacturer wanted to implement this mechanism, they wouldn't need DoH to do it. They could just put the ads right on online.movies.example.com and use TLS there. Any kind of ad-blocking mechanism based on DNS is trivially bypassable. Suggesting that we should weaken encryption/privacy because some people plan to use it in ways that we don't like is just not a viable option. It's exactly the argument that governments are trying to use to mandate backdoors in our chat services. With encryption, it's all or nothing.
- Skunkleton 7y ago
  Do you wear a seatbelt? Its the same thing.
deathanatos 7y ago
And how does DoH prevent that? I would presume that, like with DNS over DNS¹, a resolver could check /etc/hosts first prior to attempting to resolve over the network; do proposed DoH resolvers not do that? Worse comes to worse, you could always run your own local resolver. ¹or whatever we're calling the original protocol now
- Skunkleton 7y ago
  DoH bypasses the normal resolver, and gives control over resolution to the browser. Not a big deal if your browser is from Mozilla. A little more concerning if your browser is from google.
  - derefr 7y ago
    That's how it's done now, because browsers want to push the tech when nobody else has yet bothered; but it would make a lot more sense in the long term for DNS to stay an OS-level concern, so I would expect DoH to be implemented by the OS DNS resolvers.
  - shawnz 7y ago
    DoH is just a protocol. Your appliance/application could choose to bypass the network specified resolver whether or not it uses DoH.

Avamander 7y ago

Internet of Shit devices, Smart TVs and etc. would be unaffected by DNS-level adblocking. But to be fair, one shouldn't support such awful business practices by buying such devices anyways.

jimmaswell 7y ago
What's so awful about a device having ads in it?
- qzervaas 7y ago
  There was a recent count of some smart TV brand showing an advert on the on-screen volume slider. How do you like them ads? Update: https://www.flatpanelshd.com/news.php?id=1416894724&subaction=showfull https://www.flatpanelshd.com/news.php?id=1416894724&subactio...
  - jimmaswell 7y ago
    The devices would be more expensive otherwise. I don't really mind, especially in a case like this where you can just turn it off.
  - squiggleblaz 7y ago
    Do your child, since I cannot reply to them: You have no evidence that the devices would be more expensive. Your only evidence is that the companies would receive less income all else being equal. But what is the evidence that the trade off is your eyeballs instead of your dollars? And if the tv is perfect except for the ads, where do you get the more expensive, ad free version?
    - jimmaswell 7y ago
      You can buy "dumb panels" but they apparently cost more. Some of that is that they're rated for rougher conditions being mounted in public places though. And why can't you respond to me?
- 7y ago