5 ms·

I use a modified hosts file instead which is much better. See http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Remember the web is pull not p

I use a modified hosts file instead which is much better. See http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Remember the web is pull not push.

jacquesm 12y ago
Hosts files only work when the ads and other trash are not served from the same domain, and of course the bigger operators do everything they can to make you lose some critical functionality if you block their ad serving IPs. So you'll need to go to the URL level at a minimum if you don't want to use some important functionality.
- psykovsky 12y ago
  I never lost functionality on a site because of hosts file blocking of ads. And that is together with NoScript
- Nanzikambe 12y ago
  Actually this very rarely happens. I a DNS server on my router which has zone that routes all ad hosting & other wanted stuff to an IP which is then rejected by the firewall. I also have a transparent proxy rewriting all web pages removing IFRAMEs - this does ocassionally break things, but it's extremely rare to find a site that actually has a use for them other than serving ads.
  - verisimilitude 12y ago
    Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you have more information about how you did these things?
    - Nanzikambe 12y ago
      I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.
      - verisimilitude 12y ago
        Thank you very very much for taking the time to write this up!

I use a modified hosts file instead which is much better. See http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ Remember the web is pull not push.

jacquesm 12y ago

Hosts files only work when the ads and other trash are not served from the same domain, and of course the bigger operators do everything they can to make you lose some critical functionality if you block their ad serving IPs. So you'll need to go to the URL level at a minimum if you don't want to use some important functionality.

psykovsky 12y ago
I never lost functionality on a site because of hosts file blocking of ads. And that is together with NoScript
Nanzikambe 12y ago
Actually this very rarely happens. I a DNS server on my router which has zone that routes all ad hosting & other wanted stuff to an IP which is then rejected by the firewall. I also have a transparent proxy rewriting all web pages removing IFRAMEs - this does ocassionally break things, but it's extremely rare to find a site that actually has a use for them other than serving ads.
- verisimilitude 12y ago
  Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you have more information about how you did these things?
  - Nanzikambe 12y ago
    I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.
    - verisimilitude 12y ago
      Thank you very very much for taking the time to write this up!