Comment by conformal | Hacker News Reader

Comment by conformal | Hacker News Reader

Parent Full thread

we have another project, adsuck ( https://opensource.conformal.com/wiki/adsuck ), that blocks ads via DNS proxying. it can be setup to proxy DNS requests for a single host, e.g. a laptop, or on a network perimeter, e.g. a firewall, and it works by using blacklists to map DNS requests for 'bad' sites to return a NXDOMAIN. this way the ad images and their associated js are never downloaded or executed. see http://rlwpx.free.fr/WPFF/hosts.htm for more info about the blacklists.

you're right to point out that there is not yet a way to separate 1st and 3rd party scripts, but the cookies are handled by the xxxterm.conf setting

cookie_policy = no3rdparty

there is no handling for surrogate scripts atm. i can say that i personally don't bother with sites that require advertisements for viewing but i can understand the desire to do so.

feel free to post feature requests or bugs at https://opensource.conformal.com/flyspray/index.php?project=... .

A blanket ban on third-party cookies or third-party scripts is not enough. You need to be able to specify which third-party domains are trusted. There are lots of decent sites that need to be able to load assets from a different domain in order to be functional, but which also like to load Google Analytics, or set cookies from Omniture (2o7.net). These aren't ads, but are still things I'd like to block.

Many sites also break if you don't load GA, hence the need for surrogate scripts. If you dismiss and don't try to support the secure use of sites that exhibit any of the above behavior, then your browser doesn't have anything to offer users that care about privacy and security. Privacy doesn't have to be the antithesis of compatibility.

DNS blacklisting is useful and has its place, but I would expect a secure-by-default browser to not load any resources from domains outside the one in the requested URL (like lynx) and to provide a simple way to selectively whitelist external resources for that domain only (like the RequestPolicy Firefox extension). That's one important omission from your otherwise impressive list of features that will probably make me stick with Firefox + Vimperator + RequestPolicy.

Reply on news.ycombinator.com