4 ms·

> DNS level adblocking is fantastic, especially since it can be done network wide so easily and used as an extra layer of ad filtering. It's great, but DNS ove

by vageli 6y ago

> DNS level adblocking is fantastic, especially since it can be done network wide so easily and used as an extra layer of ad filtering. It's great, but DNS over HTTPS will end the party soon enough (if I was a smart TV manufacturer, I would be prioritizing adding dns over https to the device firmware to subvert network blocks).

beamatronic 6y ago
That gives the consumer one more reason not to hook it up to the network, ever.
Arnavion 6y ago
DNS-adblocking in a router can be complemented by the router's firewall blocking outbound to all DoH provider IPs. (It'll need to be a constantly-updating blocklist, but the DNS-adblock lists are also that already.)
- 0xcde4c3db 6y ago
  I can't vouch for these since I haven't tried them yet, but it can apparently also be complemented by configuring your local DNS server to return NXDOMAIN for use-application-dns.net [1] and using a DoH proxy to protect upstream requests from snooping [2]. [1] https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... [2] https://github.com/aarond10/https_dns_proxy https://github.com/aarond10/https_dns_proxy
1vuio0pswjnm7 6y ago
I do not understand. I run my own DNS but I also gather DNS data in bulk from DNS over HTTPS or DNS over TLS sometimes. I retrieve the data outside of the browser and put it into my own zone files. Are you saying that applications and devices will make it practically impossible for the user to change DNS settings to point to localhost or RFC1918-bound DNS servers? How would they be able to do that, assuming the user can control the first upstream router. Even if they could do this, it seems a bit too heavy-handed. Much easier I would think for application developers to just make an ad blocking extension, e.g., uMatrix, stop working. For example, they could say this is because the application now has its own built-in ad blocker. Nevermind that the developers are paid from the sale of web advertising services.

by vageli 6y ago

beamatronic 6y ago

That gives the consumer one more reason not to hook it up to the network, ever.

Arnavion 6y ago

DNS-adblocking in a router can be complemented by the router's firewall blocking outbound to all DoH provider IPs. (It'll need to be a constantly-updating blocklist, but the DNS-adblock lists are also that already.)

0xcde4c3db 6y ago
I can't vouch for these since I haven't tried them yet, but it can apparently also be complemented by configuring your local DNS server to return NXDOMAIN for use-application-dns.net [1] and using a DoH proxy to protect upstream requests from snooping [2]. [1] https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... [2] https://github.com/aarond10/https_dns_proxy https://github.com/aarond10/https_dns_proxy

1vuio0pswjnm7 6y ago

I do not understand. I run my own DNS but I also gather DNS data in bulk from DNS over HTTPS or DNS over TLS sometimes. I retrieve the data outside of the browser and put it into my own zone files. Are you saying that applications and devices will make it practically impossible for the user to change DNS settings to point to localhost or RFC1918-bound DNS servers? How would they be able to do that, assuming the user can control the first upstream router. Even if they could do this, it seems a bit too heavy-handed. Much easier I would think for application developers to just make an ad blocking extension, e.g., uMatrix, stop working. For example, they could say this is because the application now has its own built-in ad blocker. Nevermind that the developers are paid from the sale of web advertising services.