Live data from Hacker News

Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

github.com

61–63 of 63 posts

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#61

Why build something fresh and not join forces with pihole? Reinventing the wheel for a niche function doesn't get traction much. I don't know the reason why the devs of this project think they need to start afresh, there are already tools like Firefox+unlock origin+ pihole which should solve most if not all of the problems. Why not incorporate the defining feature into pihole so that people don't have to add more com…

> Why build something fresh and not join forces with pihole? Reinventing the wheel for a niche function doesn't get traction much.

What harm does it do? Sure, some combination of 3 or more other things might give you most of the same functionally but why shouldn't people have the option to chose whichever works best for them? Even if the capabilities were 100% identical it's still worth it because it gives you an option if the thing you're using goes evil or stops updating or turns out to contain a vulnerability that takes months to fix etc.

Even better, it could lead to innovation. Maybe Privaxy does something better than pihole does, or has some nice feature they don't and pihole sees it, loves the idea, and makes that improvement or adds that feature too and suddenly everybody is better off. Maybe just having competition helps improve things.

I'm really struggling to understand how anyone loses here, or why it's preferable to have our options limited.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#62
post #58
post #51

What does it mean when: "The service may not tolerate TLS interception." I figured the proxy would be making the request entirely independently. How would an external entity even know the data was later being passed on?

TLS connections are tunnelled through proxies directly to the endpoint (HTTP CONNECT method) rather than the "client request to proxy" followed by "proxy request to endpoint" method of proxying. This remote interception then involves turning a CONNECT back into the classic proxy connection. First a TLS session from your client to the proxy, then a TLS session from the proxy to the real endpoint. The proxy needs to pr…

Interesting. Thanks!

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#63
post #48
post #2

I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…

D. Create a whole bunch of VMs with browsers and “fake users” to DoS the whole ad-based business model.

Some people might do this, but it will never be enough people to even register on the scales of the ad-funded businesses.
Post reply on HN