4 ms·

I'm not convinced IP-based blocking can be more effective than DNS blocking. Very often many different sites are hosted on one IP address (e.g. a CDN in the 'wo

I'm not convinced IP-based blocking can be more effective than DNS blocking. Very often many different sites are hosted on one IP address (e.g. a CDN in the 'worst' case), and IP blocking would mean lots of things become inaccessible. Users access services by DNS name, so if you want to control access it has to be at that level. Whether DNS can be effectively blocked while maintaining privacy is another issue, but I can't see IP-based blocking helping here.

judge2020 7y ago
I agree, CF allows porn and blocking every Cloudflare site isn't a viable course of action for most people. Governments like UK that mandate restricting access shouldn't be doing it for you by DPI'ing DNS. Instead, any blocking needs to be done on the device, whether it be MDM for any business-related blocking or via Parental Controls/Restrictions for blocking porn.
comex 7y ago
In my opinion, both DNS- and IP-based blocking are a hack because they fundamentally have to work based on limited information. After all, ad services could pretty easily start doing any of the following: - proxying ad requests through the server of the website you're visiting; - accessing ads by IP address directly; or - using randomly generated domain names. With a browser-based ad blocker, those measures would still be an obstacle, but at least you'd have a chance - you could switch to more heuristic ways of detecting ads based on, say, the scripts involved, or the content of the media being downloaded, or its size and placement on the page. None of that information is available to network-based blockers, at least not when HTTPS is in use. Admittedly, those things probably won't happen anytime soon, at least not for regular website ads. (Though as one example, Twitch has already started using fairly sophisticated measures to bypass ad blockers for their video ads...) But I'm an idealist, and I like to fight on favorable territory. When it comes to cat and mouse games, I don't want to be the mouse.

judge2020 7y ago

I agree, CF allows porn and blocking every Cloudflare site isn't a viable course of action for most people. Governments like UK that mandate restricting access shouldn't be doing it for you by DPI'ing DNS. Instead, any blocking needs to be done on the device, whether it be MDM for any business-related blocking or via Parental Controls/Restrictions for blocking porn.

comex 7y ago

In my opinion, both DNS- and IP-based blocking are a hack because they fundamentally have to work based on limited information. After all, ad services could pretty easily start doing any of the following: - proxying ad requests through the server of the website you're visiting; - accessing ads by IP address directly; or - using randomly generated domain names. With a browser-based ad blocker, those measures would still be an obstacle, but at least you'd have a chance - you could switch to more heuristic ways of detecting ads based on, say, the scripts involved, or the content of the media being downloaded, or its size and placement on the page. None of that information is available to network-based blockers, at least not when HTTPS is in use. Admittedly, those things probably won't happen anytime soon, at least not for regular website ads. (Though as one example, Twitch has already started using fairly sophisticated measures to bypass ad blockers for their video ads...) But I'm an idealist, and I like to fight on favorable territory. When it comes to cat and mouse games, I don't want to be the mouse.