uBlock Origin CNAME uncloaking now supports filtering by IP address

CNAME cloaking? Does this mean an ad site may use a randomly generated subdomain pointing to a wildcard record?

The title seems to be wrong, uBlock Origin supported it for many years at this point (only on Firefox). This seems to be a refactor of that code, not a whole new feature.

This is such an intrusion of privacy. I wish I could just disable cookies entirely but the usability of many webpages just goes down. I should not be punished for not wanting 3rd party trackers.

I always find this development curious. About a decade ago I worked in this space. When someone brought up ad blockers I just said "put the analytics on our main domain. No one is going to block the entire website". The answer I got was "no one would ever do that because of the implications of serving advertising from your main domain". Yet, here we are.

As an example of what CNAME cloaking is, let's say that a SAAS provider A wants to provide you, company Q, with fancy ad tracking software. In the olden days, they'd tell you to embed a script at e.g. https://A-ads-tracking.example into your website at address https://q-company.example

To block those ads, blocklists that uBlock Origin use have rules then that say "block requests being made to the domain name A-ads-tracking.example", which blocks the ads.

CNAME cloaking is where SAAS provider A sets up their ad-tracking services not on domain A-ads-tracking.example, but instead at a specific IP address of e.g. 29.1.2.3; then (and here's the important part) SAAS A tells you Company Q that you need to set up a subdomain of q-company.example which has a CNAME record pointing to 23.1.2.3, a subdomain with an innocuous name like media.q-company.example; once you've set up that CNAME, you at Company Q add a script tag to your website for `media.q-company.example` and now SAAS A is able to track all the users on your site. This indirection allows for effectively infinite cat-and-mouse on the part of you the owner of the Q Company vs the blocklists that the public assemble.

To get around this CNAME cloaking problem, the software powering extensions like uBlock Origin need to be able to see not only the destination domain of requests by browsers, but the underlying IP addresses of those domains as well. This commit makes that behavior possible, or at least is related to making that code work better.