Used to run privoxy back in the day, but stopped when adblock extensions came along. It was simply more convenient to manage adblocking from the browser rather than figuring out regexps to put in its config. Also, it didn't do https.
Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
11–20 of 63 posts
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#12> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages. I'm not sure I understand why it would be more capable than a DNS blocker ? If it's just because you can inject into the traffic that's comparing apples and oranges ? Or am I missing something ?
Let’s say a text based ad shows up in a div with the id “advert”. A DNS based blocker will not be able to block it, but an extension or a proxy based blocker that looks at the HTML content will be able to block it. So yeah, inject as well as as modify the HTML directly. It could do things like shimming advertising libraries as well defanging them potentially.
Okay, that makes a bit more sense now actually!
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#13There was a proxy, proxomitron in early 2000s, that allowed you to change the html/js as it went through the proxy. people used it for adblocking and removing page annoyances, like removing sounds / animated gifs / etc. Here is a list of random old filters people had built at one time: https://proxomitron.info/45/help/Default-Web-Filters.html
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#14Not to be confused with Privoxy: https://www.privoxy.org/
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#15This approach is a natural escalation step as DNS-based blocking is getting increasingly difficult. But it's not without its drawbacks. For example, browsers tend to have by far the best TLS implementations. By MITMing yourself, you essentially trust the proxy's TLS implementation instead, which will receive much less scrutiny. There's a lot of precedent for TLS vulnerabilities introduced by middleboxes. If browser extensions are possible they should be preferred. But the author does have a point that this can't be taken for granted anymore!
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#16I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…
I wouldn't write it off - one possible trick here is to also MITM the DoH/DoQ server and disable ECH by removing the relevant records from the DNS response. We've just added DNS support to mitmproxy and this is a natural follow-up. :)
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#17There was a proxy, proxomitron in early 2000s, that allowed you to change the html/js as it went through the proxy. people used it for adblocking and removing page annoyances, like removing sounds / animated gifs / etc. Here is a list of random old filters people had built at one time: https://proxomitron.info/45/help/Default-Web-Filters.html
There were numerous of these.
Privoxy, dansguardian, Squid (AFAIR), and others.
The notion that SSL/TLS means that ONLY the webserver origin and web browser client are permitted to see or mitigate content ... is itself harmful. Trusted proxies under your control do have a place, though yes, that introduces new points of contention as well.
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#18Not to be confused with Privoxy: https://www.privoxy.org/
My understanding is that Privoxy either cannot deal with SSL/TLS traffic, or deals very poorly with it.
The FAQ doesn't seem to discuss the issue at all, which is not a good sign:
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#19Why build something fresh and not join forces with pihole? Reinventing the wheel for a niche function doesn't get traction much. I don't know the reason why the devs of this project think they need to start afresh, there are already tools like Firefox+unlock origin+ pihole which should solve most if not all of the problems. Why not incorporate the defining feature into pihole so that people don't have to add more com…
Does PiHole do anything other than DNS-based blocking?
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#20There was a proxy, proxomitron in early 2000s, that allowed you to change the html/js as it went through the proxy. people used it for adblocking and removing page annoyances, like removing sounds / animated gifs / etc. Here is a list of random old filters people had built at one time: https://proxomitron.info/45/help/Default-Web-Filters.html
There were numerous of these. Privoxy, dansguardian, Squid (AFAIR), and others. The notion that SSL/TLS means that ONLY the webserver origin and web browser client are permitted to see or mitigate content ... is itself harmful. Trusted proxies under your control do have a place, though yes, that introduces new points of contention as well.
I used to swear by Privoxy till the internet realised HTTPS was actually important and it stopped working everywhere.