3 ms·

It's because of things like this—not to mention the added overhead/middleman—that I think ad blocking at the DNS level is the best way to go. With both Android

by tambeb 5y ago

It's because of things like this—not to mention the added overhead/middleman—that I think ad blocking at the DNS level is the best way to go. With both Android and iOS supporting encrypted DNS system-wide, blocking at the DNS level is more convenient than ever (mobile & wifi are covered, no need to set DNS for each wifi network, etc.). I realize of course, though, that DNS level blocking is mostly a non-starter with regards to YouTube since the ads are served up from the same domains as the videos (mostly? generally? not certain here).

tyingq 5y ago
If, at some point, all we have is hostnames and url lists to block with, the ad folks will figure out how to unblock themselves.
- tambeb 5y ago
  I run my own little ad blocking DNS service and the thing I'm probably most concerned about is websites/publishers/etc. deciding to serve their ad and user tracking assets from their own domains. Though most would probably need—or choose—to use subdomains and be easily blockable all over again.
  - bozzcl 5y ago
    Same here, I can think of a million ways to circumvent DNS blocking. The good thing is, most sites are not gonna adopt them very quickly. Besides, DNS blocking would have value even if all sites started doing that: there's plenty of malware/phishing domains to be blocked and I don't think those have better alternatives!
ascagnel_ 5y ago
I run a Pi-Hole on my local network, and I still see YouTube ads -- they're served from the same CDN as the videos. The way in which YT delivers ads (pre-, mid-, and post-roll videos on the same CDN/domain as the content) seems, on the surface, to thwart any type of static ad detection.
- Dah00n 5y ago
  This is more of a rant on Pi-hole than related to Youtube ads but... Pi-hole can be fine but it isn't effective if you want it to block not only the lowest hanging fruits which a browser adblocker could easily block too but also stuff that doesn't follow the rules and might use hardcoded DNS IPs if they can't get the reply they want from the DNS server. With some Windows PC's, Apple devices, Chromecasts and Androids I quickly saw Pi-hole hang because of tens of thousands of requests if I tried to force all DNS through it. Because I'm a geek I turned to my homelab instead of the RPI4 and ended up with two nginx load balancers with two Pi-holes behind each (yes, 4 Pi-holes). Even though they were now running in virtual machines on a dual Xeon HP Proliant they still died when they got flooded. The hardware could easily take the hammering of requests but the software not so much (often the counter skyrocketed to 40000 requests before it died). Now I just block 100% of DNS requests at the gateway/firewall (OPNsense) instead and oh boy does it catch and log a lot of stuff the Pi-hole didn't. The amount of software that use hardcoded DNS, make example.com requests and try to reach RFC TEST-NET IPs is just staggering. Sorry about the rant but just in case you didn't know that Pi-hole is only effective against good network citizens like, well, now you know.
  - jcastro 5y ago
    Have you tried self hosted adguard? It's very performant and can use any of the lists you can use with pihole: https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome Switched a few years ago and it's great!
    - Dah00n 5y ago
      No I haven't tried Adguard but as far as I know it is another DNS server that blocks ads like pi-hole? To block everything there has to be a firewall like OPNsense in the mix and at that point I might as well use it as DNS too.
  - bozzcl 5y ago
    Last year, I added firewall rules to my router to block: * Any outbound DNS and DNS-over-TLS requests coming from anything other than my Pi-Hole * Any outbound HTTPS requests to DNS-over-HTTPS providers that I know of It's surprising how many hits I got to those block rules. Makes me very worried about the adoption of DoH: all its privacy and anti-tampering advantages also apply to devices that violate privacy, like smartphones and smart TVs. I want to keep those under control. I'm curious about your setup: how many devices do you have in your network that you need a load-balanced Pi-Hole setup!? My RPi4 has been rock-solid, but it sounds it doesn't have to handle nearly as much load as yours. Makes me wonder if my next hardware purchase should be a small server to host a hypervisor instead of a single RPi.

by tambeb 5y ago

tyingq 5y ago

If, at some point, all we have is hostnames and url lists to block with, the ad folks will figure out how to unblock themselves.

tambeb 5y ago
I run my own little ad blocking DNS service and the thing I'm probably most concerned about is websites/publishers/etc. deciding to serve their ad and user tracking assets from their own domains. Though most would probably need—or choose—to use subdomains and be easily blockable all over again.
- bozzcl 5y ago
  Same here, I can think of a million ways to circumvent DNS blocking. The good thing is, most sites are not gonna adopt them very quickly. Besides, DNS blocking would have value even if all sites started doing that: there's plenty of malware/phishing domains to be blocked and I don't think those have better alternatives!

ascagnel_ 5y ago

I run a Pi-Hole on my local network, and I still see YouTube ads -- they're served from the same CDN as the videos. The way in which YT delivers ads (pre-, mid-, and post-roll videos on the same CDN/domain as the content) seems, on the surface, to thwart any type of static ad detection.

Dah00n 5y ago
This is more of a rant on Pi-hole than related to Youtube ads but... Pi-hole can be fine but it isn't effective if you want it to block not only the lowest hanging fruits which a browser adblocker could easily block too but also stuff that doesn't follow the rules and might use hardcoded DNS IPs if they can't get the reply they want from the DNS server. With some Windows PC's, Apple devices, Chromecasts and Androids I quickly saw Pi-hole hang because of tens of thousands of requests if I tried to force all DNS through it. Because I'm a geek I turned to my homelab instead of the RPI4 and ended up with two nginx load balancers with two Pi-holes behind each (yes, 4 Pi-holes). Even though they were now running in virtual machines on a dual Xeon HP Proliant they still died when they got flooded. The hardware could easily take the hammering of requests but the software not so much (often the counter skyrocketed to 40000 requests before it died). Now I just block 100% of DNS requests at the gateway/firewall (OPNsense) instead and oh boy does it catch and log a lot of stuff the Pi-hole didn't. The amount of software that use hardcoded DNS, make example.com requests and try to reach RFC TEST-NET IPs is just staggering. Sorry about the rant but just in case you didn't know that Pi-hole is only effective against good network citizens like, well, now you know.
- jcastro 5y ago
  Have you tried self hosted adguard? It's very performant and can use any of the lists you can use with pihole: https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome Switched a few years ago and it's great!
  - Dah00n 5y ago
    No I haven't tried Adguard but as far as I know it is another DNS server that blocks ads like pi-hole? To block everything there has to be a firewall like OPNsense in the mix and at that point I might as well use it as DNS too.
- bozzcl 5y ago
  Last year, I added firewall rules to my router to block: * Any outbound DNS and DNS-over-TLS requests coming from anything other than my Pi-Hole * Any outbound HTTPS requests to DNS-over-HTTPS providers that I know of It's surprising how many hits I got to those block rules. Makes me very worried about the adoption of DoH: all its privacy and anti-tampering advantages also apply to devices that violate privacy, like smartphones and smart TVs. I want to keep those under control. I'm curious about your setup: how many devices do you have in your network that you need a load-balanced Pi-Hole setup!? My RPi4 has been rock-solid, but it sounds it doesn't have to handle nearly as much load as yours. Makes me wonder if my next hardware purchase should be a small server to host a hypervisor instead of a single RPi.