Google to remove all VPN ad blockers that don’t comply with their policy

> This is getting posted again and again and I don’t understand why.

It is a click-bait (upvote-bait)?

TFA: ... we've been closely following the situation of the Google Play Policy changes and the company has now entered into the next phase ...

Yeah, they've got inside information. Sure.

> Anyways, at least Google allows sideloading so devs can live without Google Play. When Apple pulls something like that we have no choice.

Being able to sideload apps is the single issue that has kept me on android my entire life. Not being able to install the apps that I want to install on my own phone is a no-negotiation deal breaker for me. I really wish Apple would loosen their white knuckle grip on their precious iOS devices so that I could have options, but they obviously don't respect their users enough to give them that choice.

> There are no news here. Ad blockers were never allowed to Play store

This comment is absolutely unacceptable. I understand this isn't your decision, but its a decision I disagree with in the strongest possible terms. Ad blocking is the number one extension I use above all others. So if someone finds some excuse to bring attention to that fact, I say, let them do it.

> This is getting posted again and again and I don’t understand why

Maybe because we're majorly affected by this whims of this supranational corporation and the only power we have to respond is to have as-visible-as-possible discussions about it.

yeah nextdns has been working just fine for me.

Does content-blocking API works for apps? Or only for browser?

Do you have a link to the content blocking APIs to integrate with arbitrary apps? For example, random game apps which show in app ads. VPN adblockers can block the ads there. How do I use a content blocking api to do this?

Which content-blocking APIs are you talking about? Blockada just started hosting a DNS server. Google just made it so that blocking decisions can't be made locally anymore and all my used domain names are sent to a third-party server. Given deployment of SSL and even cert pinning in almost all apps I know of, I doubt the local VPN API allowed them to gather much more info than hostnames either.

EDIT: I see you're affiliated with Google Play. You should've lead with that.

This is false. Blokada uses the Private DNS feature of the phone to block ads. That feature is only available as of Android 9. Any device running Android 8 or lower doesn't have access to it.

I don't believe there is a "content-blocking api". Correct me if I'm wrong.

Using a VPN could technically allow an ad blocker to block based on the full http path instead of blocking based on domain name.

It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't.

Blokada does use the VPN functionality…

I use firefox with ublock. But that works only for browsing.

Android has no system-wide content blocking APIs. Furthermore, Google's policy specifically states that VPNs may not "Manipulate ads that can impact apps monetization", proving that this is not about VPNs, but about ad blocking in general.

My solution is a WireGuard VPN to my home network (which is behind PiHole) but a local solution cannot properly block network requests without the VPN API.

Blokada has switched to doing DNS-based blocking through DNS but that's purely to get around Google's arbitrary restrictions on the VPN API.

Users should be able to use whatever network filters they like. If I don't want to send ICMP packets, or DNS packets for certain servers, or any other kind of specific traffic, I should have control over what my device is doing.

Note that the VPN API does not necessitate actually setting up a VPN to a cloud server. The VPN API exposes packets to an Android app so it can decide whether or not to forward the packet, rewrite it, send it through a tunnel, etc. Normally, there is no cloud service when VPN ad blockers are in use. Blokada has switched to a cloud system but only after Google blocked their normal system.

Until Google releases a comprehensive network filter driver API or firewall API there is simply no alternative. The Blokada local DNS server solves one problem (the need for a VPN) but cannot prevent ad libraries from using DoH to work around content blockers.

VPN blocks it on all apps, but generally speaking I agree it's better to do this in this order, where possible:

In-app (browser, css aware)

In-dns (local resolver)

In-network (pihole or IP firewall)

Ex-Network (vpn/proxy)

Since the first option has very sparse universal support (and shrinking) - you need to rely on the less savoury options to achieve proper adblocking.

You should disclose your affiliations in this case.

Blockada 5's VPN runs entirely on the phone. No problems with battery usage.

Using their DNS with Blockada 6? No thank you.

I'm saving the APK and I will sideload it for as long as it will work. The problem is the maintenance of the blacklist. Anyway, a lot of people are interested in blocking ads, a solution will be found.

Is already there an open source app equivalent to Blockada?

No, it’s more about getting those pixies out of your closed garden and into the big open net to be processed.

As long as you’re going towards the cloud I bet they’ll affirm it.

What you are looking for is Blokada 5. Blokada 6 is just an entrypoint for their subscription model

Looking forward to a new insidious workaround Google and Apple will use to limit the impact of this legislation.

> Google will have to allow alternative app stores on Google Play.

Play is a store. It's used on Android, which allows other stores, of which there are many.

No, they don't need to allow alternative stores on their store. They need to allow alternative stores on Android - which already exist (Galaxy Store, Amazon Store, F-Droid, et. al.)

They just need to give them fully equal status than Play Store (I think they promised this for Android 13, not sure what the state is.)

From the start google has allowed alternative app stores on android, samsung phones come with the samsung app store installed by default and there are many, for example f-droid you can install yourself.

are there alternative app stores on iOS?

And also - Lots of folks are worried about protecting our personal information from advertisers, which will cause the ads we see (if we see them) to be less relevant, and therefore less valuable. Which in turn means that we need to see more of those less-valuable ads to pay for the resources we are consuming.

Wouldn't it be better to see MORE relevant, more valuable, and overall fewer ads?

I pay my ISP. That should ensure I can communicate with anyone else paying their ISP.

As for content monetization, I host my own site without ads, solely to spread my own views. I take enjoyment in that.

I watch YouTube with uBlock Origin on my laptop, and NewPipe on my phone. If I were forced to watch ads, I'd stop watching. And I wouldn't pay for YouTube, because I believe it is much larger than its competition, and don't want to contribute to a monopoly.

I pay for Nebula, and when the creator also posts there, that is where I watch their videos.

Ads don't pay for the Internet, they pay for content. The problem is that's it's highly intrusive and mostly unimaginative leading to a negative sentiment. It's also pushing content that I haven't asked for, products or whatever.

I'd rather pay cash money for the app that is being advertised, than pay-per-view for ads promoting a free app I'll never download, which itself is funded by more adverts.

If ads didn't take over the whole screen and use outright false or misleading statements, or attempt to phish information or install viruses, then I don't think most would have a problem. Ads these days are intrusive to the point that certain websites and apps are rendered completely useless by them.

We already pay for internet.

I have pihole in my local network, the router defaults to it as the only DNS server. Amazon FireStick still serves ads, even when I set the DNS on the stick to the pihole.

I think the ads are encrypted end-to-end from amazon-ad server to stick, using likely the same channels as the regular video content

Only go on the Internet from home?

You can achieve the same function on your (android) phone by just enabling "Private DNS" in settings and setting it to "dns.adguard.com". This blocks ads on EVERY network you connect to, even cellular.

What about updates? Not so trivial to keep the app up to date without an app store.

What were you waiting for?

Basically a VPN running something like pi-hole for you.

As I understand, VPN acts as a firewall replacement.

The VPN is not a separate vpn running on a server, but instead one running locally. The custom vpn client is both a vpn client and the vpn itself.

Android does not expose a firewall API. It does expose a VPN API that lets the developers choose how to handle traffic. This can be useful for VPNs that only want to connect to intranet websites through the VPN and let the rest of the traffic go through the normal route.

Adblockers use this API to block connections, redirect DNS traffic, or possibly even rewrite content for DNS lookups. There is no system wide content blocker and even if there was, there is no way to enforce applications to use a content-blockable network API.

Often, VPN blockers operate by simply rewriting DNS requests. They can also simulate DoH servers being down by blocking traffic to them (for scummy apps that bypass the system DNS) or mess with unencrypted content. DNS being an unencrypted protocol helps them block HTTP(S) connections even with technologies such as ESNI/ECH. Without ECH, simple SNI sniffing may also be a way to block connections that made their way past the DNS filter, though there's no reason for scummy ad libraries to use real domain names for their certificates; there's always a risk of spoofing.

Note that the VPN API is just the API of choice to be allowed to mess with network packets. There's no firewall API or network level driver that can do so in any other capacity. In almost all cases, there is no cloud server. Blokada uses some kind of cloud server, probably as a way to bypass Google's restrictions, but other apps work fine without it.

Some blocking apps work with custom, usually locally-generated, CA certificates to intercept HTTPS traffic. They're very spotty at best and very uncommon in my experience. Since Android 7, apps need to manually opt in to using user certificates from the CA store and most of them don't; in fact, most of them seem to be moving towards certificate pinning, meaning that even system-trusted CA certificates (which you will need root access for to inject them yourself) don't pass the validation step. Such a VPN filter would throw TLS errors across all major applications and services, leaving only the browser and the very few apps that opted into user certificates working. Not a great user experience to say the least.

What apps do you recommend one to download from F-Droid?

F-Droid won't help for very long here. The next thing I see Google doing is remotely uninstalling them from everyone's phones by adding them to Play Protect's list of "malicious" packages, just like they did with Vanced Manager.

How is ensured that there is no malware im the apps?