8 ms·
System-wide open source ad blocker for Mac, Windows, and Linux
- dotcoma 3y agoIs anything similar available? Also open source? Does it really work better than browser add-ons? Would this help minimise browser fingerprinting ?
- kevin_thibedeau 3y agoIt's a filtering proxy server. Privoxy is one alternative.
- sodality2 3y agoThis won't affect fingerprinting (except maybe it'll block the fingerprinting scripts if they're in lists). It does work better than add-ons in that it'll work on regular applications, not just your browser
- dotcoma 3y agoI meant - but was not very clear: if one used this software instead of a browser add-on to block ads, would this be a big improvement in escaping browser fingerprinting ?
- sodality2 3y agoProbably not. Use a dedicated tool like a custom browser (Mullvad Browser comes to mind - it beats fingerprint.com/demo which Firefox even WITH protections enabled, does not.
- krpl 3y agoYou may also want to see https://librewolf.net/ https://librewolf.net/ while not as good by default compared to Mullvad Browser, it may still be a browser to consider.
- dotcoma 3y agoThanks to both of you. I am a light user of LibreWolf (I mostly use Iridium browser)
- krpl 3y agoI haven't heard of Iridium browser before, seems neat. Thanks.
- PrimeMcFly 3y agoI'e been using Librewolf for almost a year now, and like it a lot. Also have some other extensions and tweaks in a user.js How much better is Mullvad Browser and why?
- normalaccess 3y agoI haven’t had time to look at the code. Is this generating a unique root certificate per install? If not this could become an attack vector to decrypt TLS traffic.
- hug 3y ago> During the first run, Zen will prompt you to install a root certificate. This is required for Zen to be able to intercept and modify HTTPS requests. This certificate is generated locally and never leaves your device.
- deleted 3y ago[deleted]
- lxgr 3y agoEven if it does create unique root certificates it is a massive attack vector. How good is the tool at protecting the corresponding private key from other software on the device, for example?
- exitzer0 3y agoIt is just not wise to allow some random application to MiTM your SSL traffic.
- I_Am_Nous 3y agoNo but it might be fun to play with in a Qubes environment or similar where you can inspect packets going in and out for anything weird happening.
- lxgr 3y agoLooking at packets will only get you so far if they're encrypted. Software like this has way too many opportunities to exfiltrate information for that approach to work.
- I_Am_Nous 3y agoThat's true, but if it is trying to exfiltrate data you will probably see more packets coming out than going in. If the concern is that the SSL cert they add allows them to decrypt your data, and you see it sending your requests anywhere it shouldn't, you'll get a window into what they are trying to do. It's not perfect, but it is possible to gain information in such a way.
- develatio 3y agoIf you can read the code and asure that the traffic won’t be sent to a malicious third party, why not? What is the concern?
- sedatk 3y agoHow would you know if the binary was built from the code verbatim? How would you know that for future updates?
- rubyn00bie 3y agoYou could just compile it. For updates you could like pull down the new code, check the diff, and rebuild.
- notfed 3y agoWhy would anyone need to block ads outside of the browser? This seems like it's just asking to introduce obscure errors into other apps?
- barnabee 3y agoI’d block ads out side of my computer if it was possible, so absolutely need to block all ads in any app.
- deleted 3y ago[deleted]
- newcool1230 3y agoI meaning Microsoft is trying to introduce ads into the file explorer and search centers...
- jay_kyburz 3y agoWhat do you mean trying to? Look at this shit. https://imgur.com/a/d0jq4s1 https://imgur.com/a/d0jq4s1 Every time you stamp it out they find a way to sneak it back in.
- Erratic6576 3y agoIf that was my macOS start menu, I’d smash my display with anything I had at hand
- PrimeMcFly 3y agoIt's pretty damn atrocious. I run a different startmenu and taskbar, but it still bugs me. I still prefer Windows with ads modified to hide those ads over MacOS though.
- shiroiuma 3y agoI don't see the problem here. They're adding value to their OS this way, value that will result in greater profits and therefore shareholder value. My MS stock is doing great thanks to moves like this! If you don't like it, you don't have to use MS products.
- _boffin_ 3y agoDoes LittleSnitch allow for an import of urls, IPs, etc.. to block? if so, know of any lists?
- rmkrmk 3y agoThey have a few blocklists with IP addresses and hostnames listed on their page you can easily subscribe to. https://www.obdev.at/products/littlesnitch-mini/blocklists.html https://www.obdev.at/products/littlesnitch-mini/blocklists.h...
- TheFuzzball 3y agoI kinda see installing a root certificate like disabling SIP in macOS - I get why it's needed in some cases, but it's a deal-breaker for me. That makes deep ad blocking, local web caching, and automated history logging (with paths) impossible, for better or worse.
- Symphony_eric 3y ago[dead]
- mathisd 3y agoHow does it work compared to a browser extension ad blocker ?
- sodality2 3y agoBrowsers only work in the browser, this is system-wide
- lxgr 3y agoIs that even a common problem? I can't think of any apps on my computer that are showing me ads, other than my browser. It's a very different story on mobile, but there, certificate pinning can also trivially bypass this kind of blocking, and for good reason too: Imagine a system-wide tool like this getting access to online banking credentials, for example...
- CodeNest 3y agoApplication doesn't provide a way to remove installed certificate. Don't use this app.
- rosywoozlechan 3y agoThe way Charles does this is by generating a root certificate dynamically and makes it really easy to remove by giving you instructions for how to install and remove it just for Chrome for example: https://www.charlesproxy.com/documentation/proxying/ssl-proxying/ https://www.charlesproxy.com/documentation/proxying/ssl-prox... https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/ https://www.charlesproxy.com/documentation/using-charles/ssl...
- lxgr 3y agoThat only works on Windows, I believe (and maybe on Linux). Chrome on macOS uses the system root certificate store.
- aredox 3y agoMore than a browser extension as it filters all apps (esp. Electron apps). Worse than a browser extension where I can deactivate per-site to solve false positives.
- tejohnso 3y agoI'm comfortable with a DNS based blocker (pi-hole) and it seems to work quite well. Bonus: It works across all devices on the network, rather than installing something onto the OS.
- anticorporate 3y agoI seem to end up regretting anything I do at the network level to block traffic. It always seems to pop up that one weird time I actually do need something from a blocked domain to load, and it takes me way too long to remember that's what I did to block it.
- thedaly 3y agoGood point. Its fine if I'm the only one using the network, but I'll admit it can take a bit before I connect the dots between pi-hole and "this link I'm clicking off google won't load".
- netsharc 3y agoThat's when you connect to your VPN. I have a network configuration with 2 dnsmasqs, 1 with pi-hole-style hosts block, and 1 without, and most of my devices get the ad-blocking DNS, 1 gets the "unfiltered" DNS. To do this from the DHCP component of dnsmasq, you can tag MAC addresses and create different configurations (including which DNS they get) for each tag, e.g. https://github.com/imp/dnsmasq/blob/770bce967cfc9967273d0acfb3ea018fb7b17522/dnsmasq.conf.example#L292 https://github.com/imp/dnsmasq/blob/770bce967cfc9967273d0acf...
- satvikpendem 3y agoNice, I use AdGuard (on mobile and desktop), would this be a suitable replacement?
- mkskm 3y agoAdGuard for Mac is the same offering (not to be confused with AdGuard for Safari, which is a browser extension): https://adguard.com/en/adguard-mac/overview.html https://adguard.com/en/adguard-mac/overview.html There's also Little Snitch Mini: https://www.obdev.at/products/littlesnitch-mini/index.html https://www.obdev.at/products/littlesnitch-mini/index.html
- satvikpendem 3y agoAny differences in performance or how well each works for adblocking compared to the others?
- mrAssHat 3y agoThis snitch is proprietary crapware. Instead, use OpenSnitch when on Linux and LuLu Firewall when on Mac.
- mkskm 3y agoIt's proprietary but quality software. LuLu is cool but doesn't offer the same functionality.
- netsharc 3y agoDoes an ersatz root certificate work with HSTS? A quick DDG seems to suggest it's still possible to disable HSTS on the browsers: https://appuals.com/how-to-clear-or-disable-hsts-for-chrome-firefox-and-internet-explorer/ https://appuals.com/how-to-clear-or-disable-hsts-for-chrome-...
- josephcsible 3y agoAs long as the custom root certificate is properly installed, HSTS will still work.
- passerby1 3y agoHow many apps do use certificate pinning and so will be broken as a result of this app's MITM?
- SushiHippie 3y agoAfaik most desktop applications don't do certificate pinning. Mobile apps definitely do. Except things like browsers (e.g. Firefox, Chrome) or python that ship their own root CA trust store.
- gigel82 3y agoTangentially related, I found many built-in Windows applications and services use certificate pinning and will either fail outright or modify behavior (easily identified by the number and size of packets with and without MITM). It made me very curious to find out what data they're downloading / exfiltrating that they feel the need to go to such extremes to hide it from the user. FWIW, even some of the packages that do pass through MITM are further encrypted binary blobs, not clear text.
- krpl 3y agoalso see: https://en.wikipedia.org/wiki/Hosts_(file) https://en.wikipedia.org/wiki/Hosts_(file)
- quyleanh 3y agoI can see it's some kind of replacement for uBlock Origin when MV3 is official.
- waynesonfire 3y ago[flagged]
- Xeamek 3y agoI don't know how it actually works, but won't website like youtube simply deny you access if it detects that the ad related request timed out? I imagine that browser extensions actually tap into the site's code and somehow go around such detection. But if this is a simple firewall, how will this work against any website that doesn't just default to most trivial "import ad service", but rather actually takes steps to block the ad blockers (Like youtube)?
- nurettin 3y agoI've wondered what-if scenarios like this for a long time. I see them being implemented smaller websites, but never at scale like amazon.com or YouTube where they serve petabytes per second. My conclusion is: it gets so expensive to track and block users at session level that they just let go.
- Kadin 3y agoThat's only true if only a small percentage of users actually use that particular ad-blocking strategy. If a significant number of users did, then it would be a real concern. Although I think YouTube et al see an increasing amount of revenue and viewership coming from apps... and if they could, I suspect they would kill their web sites in favor of apps where they have much more control.
- acl777 3y agoHow does this compare to using a hosts file with known ad servers? like: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- quyleanh 3y agoAn easy example for comparison is hosts file cannot block YouTube ads, while this one can.
- lxgr 3y agoHow? Can't Youtube just detect which expected resources are not loading and refuse to play?
- quyleanh 3y agoI know the YouTube ads is getting more complicated now, but it's just simple example. Another is hosts file/DNS blocking will remain the blank space on web page, but this one will not.
- lxgr 3y agoHow does this avoid blank spaces? Does it parse and rewrite HTML or inject Javascript that does?
- mike_d 3y agoHosts files have never been a good idea for ad blocking, I really wish users would stop promoting them.
- hellotomyrars 3y agoIt isn't the best way to do it as far as effectiveness goes but it it is pretty good, especially for web browsing. It is the easiest way to do it on my iOS devices (as a fake VPN profile) and can be switched off in a corner case where I need to access something it is filtering out. It isn't as flexible or powerful as other methods, but it is very simple. Tools are all about how you use them. Ignoring them isn't any better than suggesting them.
- ottoflux 3y agolofl. no. like… did they try any 2nd order thinking here?
- nurettin 3y ago> During the first run, Zen will prompt you to install a root certificate. This is required for Zen to be able to intercept and modify HTTPS requests. Still very, very scary.
- anfragment 3y agoHello HN! Having just posted the app to a couple of small subreddits before sleep and then waking up to being on the front page over here is quite an experience :) I was hoping to make a Show HN post after giving Zen a bit more polish, but I guess here we are. Thanks for all the constructive feedback. I totally share your concerns about its security and likewise wouldn't use some unverified application trying to install a root CA on my system. For those wanting to audit the certificate generation and installation code, feel free to take a look at certmanager/get.go and certmanager/install_{platformname}.go. It is mostly self-contained and, I hope, easy to understand. The lack of any instructions on how to delete the certificate is an oversight on my part, and I'll be working on this. Regarding the binaries: all of them are built on GitHub's CI. I wish there was a way for users to verify this fact, but to my knowledge, there is no way to do that currently. You can run and build the app yourself using Wails (https://wails.io/docs/gettingstarted/installation https://wails.io/docs/gettingstarted/installation). I'll be sure to add more instructions to the repo in the coming days. As always, any feedback, help, and suggestions are much welcome.
- dvfjsdhgfv 3y agoThank you very much for your work! I really appreciate it. It seems a great solution in a situation where you can't use Pi-hole etc.
- mike_d 3y agoThank you for starting this project. There is a bit of overall negativity in this thread from users who don't fully understand what is going on here, but please don't get discouraged. This is ultimately the correct approach to addressing browsers that have a financial interest in serving ads.
- quyleanh 3y agoThank you for your work. I appreciate it very much. Please don’t be down motivation by the negative comments. About your comment of security, I think it’s better to make a FAQ file and write it there to clearly explain. And one suggestion is I hope zen will have function to choose upstream DNS server (can be DoH or DoT server). It will be the best block ads with combo DNS and HTTPS.
- userbinator 3y agoIt's interesting to see the paranoia FUD in the comments here around MITM, when this is happening on your own machine under your control, and it's open-source too. It should be painfully obvious by now that Big Tech is using "security" as an excuse to effectively force-feed you whatever they want, and depriving you of the right to refuse should be illegal. Fuck the corporate-authoritarians who are taking away the freedom to do what we want to content that enters our machines. They've been fighting that war for a long time, and we can see through the tactics they've been using. I've been using Proxomitron as a filtering proxy for over 2 decades after its author's death, and it is even more powerful than this (but requires more setup and tuning.)
- thefz 3y ago> During the first run, Zen will prompt you to install a root certificate. Well, nope.