161–170 of 445 posts
At this point it's irresponsible for browsers not to come with ad blocking preinstalled.
AFAIK only Orion browser [1] comes with full 1st party and 3rd party ad and tracker blocking, by default.
Or, in other words, FBI now recommends using Android :-) It's baffling how much better uBlock Origin + Firefox experience on Android is compared to any iOS ad blocker I have tried. They kind-of work but let half of the ads through.
Yeah, android trades browser ads for system wide tracking. I’m not really sure that’s a good deal.
(2022)
Though yes, this story dates from December and was covered at the time (from a different source):
https://news.ycombinator.com/item?id=34095107>
Earlier quoted context omitted.
Yeah, android trades browser ads for system wide tracking. I’m not really sure that’s a good deal.
That is only if you have Google Play Services installed.
Though I seem to recall GPS shim that's available and which I really should swap in on my BOOX tablet.
Official announcement, December 2022: https://www.ic3.gov/Media/Y2022/PSA221221
There was also an HN discussion at the time: https://news.ycombinator.com/item?id=34095107>
Here are a few things I do to combat nasty websites: - blacklists entire domains using wildcards (using an "unbound" DNS resolver and forcing all traffic to my DNS resolver, preventing my browser to use DoH -- I can still then use DoH if I want, from unbound) - reject or drop a huge number of known bad actors, regularly updated: they go into gigantic "ip sets" firewall rules - (I came up with this one): use a little…
I personally use Timescale magicDNS on all my devices, with pihole DNS running on a home server. The magicDNS can make my home server the 1st responder for DNS queries and it'll block a lot of ad domains.
Earlier quoted context omitted.
While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It's no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar tec…
But: 1. couldn’t you “just” (yea yea I know) install a cert on all your devices and force all 443 traffic though a proxy (like some corporate networks do)? 2. (Something I’ve been meaning to get around to trying for a while) default-block outgoing connections unless unless the external host was recently resolved for the corresponding internal host via your internal resolver? That seems like it would kill anything tha…
That's insufficient. There's nothing stopping a web site (or ad on a website) from forming its own DoH request that bypasses the browser and the port. It can be done entirely within the HTTPS stream.
Here are a few things I do to combat nasty websites: - blacklists entire domains using wildcards (using an "unbound" DNS resolver and forcing all traffic to my DNS resolver, preventing my browser to use DoH -- I can still then use DoH if I want, from unbound) - reject or drop a huge number of known bad actors, regularly updated: they go into gigantic "ip sets" firewall rules - (I came up with this one): use a little…
While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It's no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar tec…
And hey, maybe one day advertisements will be served directly via IP addresses, not domains:)
Earlier quoted context omitted.
While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It's no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar tec…
But: 1. couldn’t you “just” (yea yea I know) install a cert on all your devices and force all 443 traffic though a proxy (like some corporate networks do)? 2. (Something I’ve been meaning to get around to trying for a while) default-block outgoing connections unless unless the external host was recently resolved for the corresponding internal host via your internal resolver? That seems like it would kill anything tha…
And with 2), that would work, though you'd probably want to whitelist port 53 so that you can resolve names in the first place. Sounds like it should be effective, though.