Yes, but also less so every day. Google has already figured out that they should serve Youtube ads and content from the same servers to limit the ability of DNS based ad filtering.

DNS filtering is a cat-and-mouse game that DNS filtering tools will eventually lose. Don't get me wrong, I love Pihole and have used it for a while, but I know that I'm on the losing side of this battle.

DNS filtering has been on the "losing side" for a few decades now. As long as more than 0.1% of people don't use it, it's not worth solving for most ad companies. Even if places like YouTube DO find ways to stuff ads into my face (likely at great technical and operational expense to them), I make it a point to NEVER EVER buy anything advertised, search for any of it, etc. Because they know so little about me (I go out of my way to block as much telemetry and data sharing as possible), their ads aren't very relevant to me anyway, so they're literally just wasting money serving me an ad, trying to pressure me into paying for their premium service. Instead, I just get annoyed if there are too many ads and find something else to do. It would probably serve them better to just realize that some users won't ever convert, and stop wasting time serving them ads.

So you're getting down voted, but I totally agree. I too used to disable javascript using NoScript every where until it was a site that I was okay with. I played the game of only allowing javascript from the same domain, and then looking at the remaining scripts the site wanted to request. CDNs for jQuery, FontAwesome, etc, started to get whitelisted. Anything else, nope. If the site didn't work after that, then the tab was closed. After allowing NoScript to run javascript, I would then lean on uBlock to block the trackers etc that were loaded by anything I missed. It's amazing how difficult surfing the web like this was.

Maybe if you won’t ever convert, they should simply stop wasting time serving you anything? YouTube isn’t a charity.

They're not a charity, but their business model is based on ads and they rely on the network effect to support that model. People who can't see anything at all will immediately defect. No revenue at all from the moment that policy is implemented, plus significant risk that enough will leave to weaken the network effect. People who are forced to watch ads with their content will grumble, some of them might eventually defect, but for the most part they will stay and continue generating revenue. Less immediate impact to the bottom line, and hardly any risk of undermining the network effect.

The "just go away" approach is proving suicidal for online newspapers and magazines. It would be no less so for YouTube. Their content is neither compelling enough nor exclusive enough for that to work.

How could YouTube know you won't ever convert beforehand, and at scale? If they started blocking users for suspicion of not buying anything from ads they would have to block a sizeable portion of their traffic and that would have a negative impact on their company.

YouTube doesn't care if you buy what the ad is selling. They are selling the fact that you viewed the ad.

Network level ad-blocking doesn't work very well.

Privoxy (and Proxomitron before it) were doing it 20 years ago, but never caught on because they're a PITA to setup and can't handle inline adverts. Pi-hole is new, but it's even more work to setup, and suffers the same limitations.

And as ad-blocking has become more popular the problems only gotten worse. It's unusual that I see any ads any more, but when I do it's always in an inline div or span with a "random" id or class name, essentially invisible to pi-hole.

I still use Proxomitron. It's as powerful as the filters you write for it, works across all browsers (including the "hidden" ones embedded in apps and such), and the community has made patches that let you MITM TLS as well using OpenSSL (although the certificate setup needs a bit of planning and understanding.)

The only downside is that its filtering language is regex-like, so basically the equivalent of "two netcats and a sed". I've contemplated writing a filter proxy that would parse HTML into a DOM, run filtering on that tree-structured representation using something XPath or XSLT-ish, and then reserialise the modified HTML to send to browsers, but never had the time to. I suspect performance wouldn't be great with such a setup, although with MITM TLS it's already doing a double-encrypt-decrypt and I don't find that slowing me down noticeably.

Why doesn't it? (Not a leading question, I just don't understand why it doesn't) Isn't the way uBlock and the like work is that they see network requests from a blacklist and not load those resources? Isn't network level blocking just moving that from the local device up a level?

They do (well partly), but with network level blocking you end up with broken DOM elements (like images, videos, etc.) The good think about the browser extensions is that they clean up the DOM and in many cases you wouldn't even know if the pages had ads.

Then there's also Javascript trickery loaded with the page that do hostile things if ad servers aren't reachable, and extensions know how to detect and replace them.

I think the closer the blocker is to the user, the higher the fidelity of the blocking.

A browser extension has access to the actual requests, while all a network level blocker has is the Server header of a TLS packet at best, just an IP with SNI encryption at worst. That's why PiHole works as a DNS proxy by only properly responding to non-blacklisted hosts with a proper DNS response, but even this might be useless in some cases due to "domain fronting".

A PiHole only sees the DNS request, which works fine if ads are served from a separate hostname like ads.mydomain.com. But if they're served from the same sub-domain and simply have a different URL (ie, mydomain.com/ads/[...]), then the PiHole won't block it. uBlock/ABP will, because they can filter on entire URLs, not just the domain.

uBlock (and AdBlock Plus) can access and prune/block individual DOM elements, and even has a built-in tool (the eye dropper icon) to select and block them. I think they call it "cosmetic filters". It's also available in the right-click context menu under "Block element".

I don't know exactly how it works under the hood, though. If I block a div with text in it, I know the div is still downloaded, just not displayed. I don't know what happens in more complicated cases, like if I block a div that contains an img tag. I think it's smart enough to prune the img tag before the browser downloads it, but IDK for sure.

I vaguely recall Privoxy having some kind of content filtering, but when I tried it, it wasn't html/css/javascript aware, and only did regex based replacement.

I guess I am missing something. I have a Pi-Hole setup at both home and office that serve as the only DNS for the entire network at both locations. I don't see ads, affiliate links don't resolve, and tracking/monitoring services don't capture my traffic.

My experience has been that it took about 30 minutes to setup and I don't see ads on the internet, nor do my family or team.

I can’t speak for pi-hole, but Diversion on Asuswrt-Merlin works fantastic for me. No ads ever except for YouTube ads lately due to google’s changes to how they serve ads from the same servers they provide services on.

> No ads ever except for YouTube ads lately due to google’s changes to how they serve ads from the same servers they provide services on.

Thats what I meant by network level blocking doesn't work very well. Using uBlock Origin, I don't see YouTube ads.

There's a huge difference between "doesn't work very well" and "works perfectly except for one really sneaky ad company, sometimes". How does ublock origin cover scripts and ads for my entire network? Did you even look at what I'm talking about before making such general statements? My router blocks hundreds of thousands of incidents per week, and there are only two people in my household. One can't use a browser plugin on android tv, Apple TV, smart tv, and a million other devices. By your own logic, ublock origin doesn't work very well. See what I mean?

Pi-hole and similar solutions are crude compared to uMatrix. I wish that weren't the case. If we didn't have to rely on browser extensions for fine-grained control then alternative browsers like qutebrowser could become more than just toys.

One of my concerns is that DNS over HTTP(s) is really just a way to obfuscate DNS queries from the oversight of network level ad blockers like Pi Hole, AdBloka et al.

You might've noticed most of the new Internet protocols Google is championing move to pushing things through HTTPS where they cannot be intercepted and provide a guaranteed tunnel between the servers (statistically speaking, Google), and the browser (also, statistically speaking, Google). I would never go so far as to speculate why, but it does appear Google is heavily focused on this.

That's why you use DoH from you pihole, not your computer/phone etc.

Of course, but my concern is that DoH makes it easier for apps (Chrome, etc) to handle their own DNS queries internally rather than relying on the device's network libraries.

MiTM intercepting HTTP(s) traffic on my Android devices is really difficult due to certificate pinning. The only way to quantify how many unexpected requests apps are making was to watch DNS traffic. If, one day, these apps just make a single DNS request to Google's DoH host then encrypt all their traffic from there onwards, I'd have no insight into what's going on in my own device.

I am not a fan of DNS over HTTPs for similar reasons too.

I have a Pi-hole and use uBlock; when I turn off uBlock and use the Pi-hole alone, a ton of ads still seem to come through. This is with the default blocklists (StevenBlack, MalwareDomains, sysctl.org, zeustracker.abuse.ch; about 8 total). Maybe I'm not adding enough lists, but "out of the box" it doesn't seem to cut it.

You may have a secondary DNS. Sometimes that isn't even intentional as ISP modems automatically upstream failed DNS regardless of the local DHCP settings (I'm looking at you AT&T Fiber)

The new trend to slip through is hiding behind cloudflare. I see cloudflare urls being loaded within cloudflare URLs to obfuscate the source of ads and scripts

So this only blocks/matches known domains? That isn't nearly as useful as to what uMatrix/uBlock allow, such as filtering by resource type. E.g. you may want to disable all JS by default, which uBlock allows.

Yes. Pihole and the like can only block domains, adserver.doubleclick.com.

setting up a dedicated linux box to run pi-hole is a lot harder than installing a browser extension (but I agree it's awesome)