Hacker News Reader

Comment by geoffeg | Hacker News Reader

Does anyone know of a way to run uBlock Origin as an HTTP(s) proxy? I'd really like to be able to provide uBlock Origin style functionality to mobile and other browsers on my network that can't easily run uBlock. Historically privoxy could do some of what uBlock does, but development on privoxy seems to have declined...

View on HN

Have you considered pi-hole[0], NextDNS[1], or AdGuard[2]?

[0] https://pi-hole.net/

[1] https://nextdns.io/

[2] https://adguard.com/en/welcome.html

I have pi-hole, and while DNS filtering does eliminate a majority of annoyances on the web, there's still a large amount that I need uBlock for.

DNS filtering is the only option outside the browser because of SSL

That's not necessarily true. SSL/TLS does not prevent all MITM, it prevents unwanted MITM.

To be fair, I don't think you can install certificates on a Chromecast for example, so it might not be practically feasible for all devices, but a blanket "SSL makes that impossible" is not correct.

SSL/TLS does not prevent all MITM, it prevents unwanted MITM.

That’s news to me. Can you expand on this ? I always assumed if an API Endpoint for example is served on TLS it’s secure till the termination. No ?

You can always choose to install your own root certificates, at which point your browsers will trust any certificates issued by them (which could be your own mitm proxy)

It would cause issues for websites / apps using HSTS / Certificate pinning (a.k.a. most big websites)

No, HSTS doesn't pin the cert, it just says that TLS must be used. A custom root certificate will fulfill that requirement.

Cert pinning isn't used by browsers in general.

In practice it's usually done with SSL termination (MITM but you have a trusted certificate)

Adguard Docs on it: https://kb.adguard.com/en/general/https-filtering#how-does-h...

Charles Proxy: https://www.charlesproxy.com/documentation/proxying/ssl-prox...

If you have Android, the easiest way to run uBlock Origin is to install it for mobile Firefox.

Precisely. On iOS, I've recently been enjoying Hyperweb, which you can add some of uBlock Origin's blocklists to. My experience so far has been great, though I'm aware that their blocking is probably based on Safari's neutered "content blocker" API so it isn't quite as fast or efficient.

I've been very happy with the free tier of Lockdown Privacy, which blocks ads in every app, not only Safari. It creates a dummy VPN which can filter. Not as powerful as uBlock Origin, but it blocks in-app ads too.

Ah, not an option for me since I already use a VPN to access services on my home network like my pi hole. I tried Lockdown a while back, and I do remember it worked pretty darn well. But my pi hole works great, too, as far as DNS-level blocking is concerned. And it's nice to know that my network traffic is safe from my mobile provider :)

Yes, unfortunately it won't help you if you use any apps that display arbitrary websites in the system webview. E.g. a reddit client.

If you set it as the default browser, well-behaving apps that use Chrome Custom Tabs will use firefox in these situations.

https://f-droid.org/packages/org.blokada.fem.fdroid

Yes and no. One could create a Squid SSL-Bump (MITM) proxy and create ACL's that operate closely to uBlock. There won't be full parity between the two so uBlock would still provide some benefit to the client. The method of using Squid as a MITM proxy method assumes one can install and trust a server public key into the clients. Squid will limit what HTTP protocols one could use. e.g. h2, alpn won't be supported. If one does not mind those limitations and having to maintain a small list of sites to bypass MITM due to public key pinning then Squid can have rules for anything the client or server can see. Domains, URL's, Content-Type, Size, Methods, Ports, you name it. One could save some bandwidth on static content as an additional benefit.

You could try adguard (android version), but it is paid.

And the biggest problem is most of sites are already upgraded to https, it needs MITM attack, but lots of applications won't accept any user certificate... (so adguard needs be installed to let those apps bypass its proxy, that's mean, you cannot just host a central proxy server to filter all ssl traffic)

Is Privoxy development velocity the best metric?

Once the framework is in place, the interesting action is in filter configuration, right?

https://www.privoxy.org/ says latest release is about two months ago.

Pihole? I think they share some block lists.

Only does DNS blocking

Reply on news.ycombinator.com