1V1vuio0pswjnm7·Jan 16, 2023Recommendation phrase
"Personally, I recommend installing the uBlock advert blocker on all devices which support it."
NB. I am a casual use of uBlock. I have nothing against it. However like other alternatives it may have limitations that are worth considering.
At the very least we have to consider devices and applications that do not support uBlock Matrix/Origin.
With respect to those that do support it, a company making large profits from advertising that controls a particular application, like a web browser, or that controls a particular operating system, like a graphical mobile or desktop one that no user ever compiles themselves, can "remove support" for uBlock at any time.
Options for setting a default gateway and setting DNS servers are arguably even more prevalent on devices than support for uBlock. Presumably companies making large profits from adv
Read the rest
ertising could remove support for DNS settings and default gateways from the operating systems they control, however this seems much less likely.^1
Where no user-configurable firewall is available on the device, we can sometimes use DNS settings, i.e. wildcards, to point DNS traffic to a DNS server we control. We can configure the DNS server to block/allow certain DNS traffic. We can also use the DNS server to point all HTTP traffic to the proxy.
The DNS server and the proxy can be running on the loopback of the device or they could be running on the gateway, where the gateway is another computer that we control.
What is needed to disrupt this UID API from IAB. Is DNS enough. Do we need to filter URLs for certain JS files. Do we need to filter cookies.
"All UID2 endpoints use the same base URL.
Environment Cloud_Region Code_Base_URL
Testing AWS US East (Ohio) us-east-2 https://operator-integ.uidapi.com
Production AWS US East (Ohio) us-east-2 https://prod.uidapi.com
Production AWS Asia Pacific (Sydney) ap-southeast-2 https://au.prod.uidapi.com
Production AWS Asia Pacific (Tokyo) ap-northeast-1 https://jp.prod.uidapi.com
Production AWS Asia Pacific (Singapore) ap-southeast-1 https://sg.prod.uidapi.com
For example, https://operator-integ.uidapi.com/v2/token/generate"
Source: https://github.com/IABTechLab/uid2docs/blob/main/api/v2/READ...
In authoritative DNS, a wildcard entry such as
*.uidapi.com 1 IN A 127.0.0.1
would send HTTP requests for these UID API endpoints to the loopback.
This is is the same effect as using a hosts file like the StevenBlack one. Except some applications may ignore /etc/hosts.
In dnscache, djb's recursive DNS server, creating a one line file like
echo 127.0.0.1 > dnscache/root/servers/uidapi.com
would send DNS lookups for these UID API endoints to the loopback.
(NB. AFAIK, unbound does not by itself support wildcards.)
What about uBlock.
uBlock relies on certain lists maintained by various third parties.
For example,
https://raw.githubusercontent.com/StevenBlack/hosts/master/d...
https://codeload.github.com/easylist/easylist/zip/refs/heads...
https://malware-filter.gitlab.io/malware-filter/urlhaus-filt...
https://raw.githubusercontent.com/gorhill/uBlock/master/asse... (lists contained therein)
I perused some of these lists looking for the uidapi.com endpoints.
It's possible I missed something but I only got one result:
cdn.uidapi.com in the StevenBlack hosts file
I think all the third party lists are great, however those require constant dillgence and there are so many now it is becoming confusing.
Personally I find whitelists that I control are easier for me to manage. I also find that on Android, NetGuard is more useful than uBlock. They do different things. I find NetGuard is more versatile.
The number of domains that I need to access is much smaller and grows at a slower rate than the number of domains on the internet that need to be "blocked".
As is sometimes done in firewall rules, using DNS I "block" all domains by defult and add A records for the domains I actually need to access.
1. There are numerous open source operating system projects that could provide those traditional, basic features to any user who wanted them. As it happens, such companies have relied considerably on such non-commercial, open source projects to create their own commercial, advertising-friendly versions.