Optimal DNS Ad Blocker

http://optimal.com/network-ad-blocking-beta/

by uptown • 10 years ago

115 94 10 years ago

optimal.com

bognition• 10 years ago

Very interesting. I'd be curious to know what Optimal plans to do with all the DNS traffic they'll be collecting

chews• 10 years ago

Selling it to advertisers. duh.

matt_wulfeck• 10 years ago

I'm definitely weary of handing over my DNS data to a company I don't know. Besides, Safari ad blocking plugins already take care of this while surfing.

This may have unintended (both good or bad) affects on normal app experience since it's configured on the network.

rconti• 10 years ago

For a few bucks more a month, I'll sell you a proxy service through which you can proxy your DNS requests to optimal!

optimalrob13• 10 years ago

We are not selling this information and never will. We built a safari blocker called fewerads that's in the App Store. But we found lots of users wanted to block ads in chrome mobile or inside Twitter or Facebook (to be clear, web ads, not those platforms' ads), which is what lead us to this idea.

benologist4• 10 years ago

This looks really cool, especially for the bajillion mobile-only people connecting straight through their telco without any ublock/ghostery/hosts/etc blocking.

I am using a local DNS server that does this called Pihole [1] supplemented with additional blocklists [2] for malware and privacy.

One thing I don't see is any statistics ... you might be surprised at how much software in your home is endlessly communicating with companies you might not even have heard of, and that's been a great benefit of taking control of my DNS resolution [3].

[1] https://pi-hole.net/

[2] https://github.com/benlowry/pihole-extended-hosts

[3] 5.1% of my networks' requests today got blocked - https://i.imgur.com/ELL9CDu.png

dingaling• 10 years ago

It would be useful if their website described what exactly it installs. A recursive DNS server with a web UI and big list of null-routed domains? That's my guess.

How does that help mobile users outside their home network without also setting up a VPN back in?

benologist4• 10 years ago

All it really requires is opening up port 53 to the internet but I don't know enough about securing a DNS server to take that step yet. I'm intending to continue working on my little offshoot and hopefully it will get to the point you could safely host it on digitalocean/aws/etc.

optimalrob13• 10 years ago

We'll be adding more info when we prep things for a wider consumer release. We are working to learn as much as we can and are looking forward to everyone's feedback!

optimalrob13• 10 years ago

Pihole is awesome! We love what they are doing and if you can't get there on trusting us but want a pure, local network blocking solution I highly recommend this project! On my medium.com/@robleathern page I talk about my experience setting one up.

buro9• 10 years ago

One can achieve this locally, on a laptop/desktop, using https://github.com/StevenBlack/hosts

Or you can combine that with https://github.com/jlund/streisand to have a VPN service that happens to adblock (great for mobile).

That said... I like that Optimal have made this too, because neither of the above can work for all devices in a household and more things in the house are tracking you and serving adverts (TV!).

The real questions I have are:

Who sources the list of domain names in there that they will null route?

How will this work with DNSSEC protected sources or whether they anticipate this at all?

How will they become aware of new domains being used by smart devices that are not shared by web sites (and therefore no-one notices and adds it to any blacklist)?

koolba• 10 years ago

I think it'll be hilarious if the future of DNS security and authentication is driven by ad companies ensuring consumers can't dodge them.

benologist4• 10 years ago

If you want StevenBlack's hosts list to be network-wide I integrated it with an open source, self-hosted DNS server called https://pi-hole.net/ last week which adds a slick admin interface and browser extensions too, then I put it all in a Vagrantfile and set my router to use the VM as a DNS server.

Screenshot: https://i.imgur.com/ELL9CDu.png

Vagrantfile: https://github.com/benlowry/pihole-extended-hosts

xienze• 10 years ago

Alternately, if your router is capable of doing so, have it be the DNS server, seeded with the hosts file. That's what I do with my EdgeRouter Lite.

dalanmiller• 10 years ago

I use pi-hole at home and it's a great little tool for my home network and I think makes a noticeable difference on web browsing speeds.

My only wish is that it would serve a page notifying me "this is possibly an ad, but would you like to continue?" versus just flat out blocking. I know there's a whitelisting functionality but it'd be cool if I could handle this directly in my actions in the browser.

nwrk• 10 years ago

Nice! Thanks

shirman• 10 years ago

Is it possible to marry this to Bind9?

JustSomeNobody• 10 years ago

I use this with Gas Mask on OS X.

optimalrob13• 10 years ago

Hi I'm the CEO of Optimal, Rob. We use open source lists of adservers but have had to evolve from those lists since some of them are invalid or overly aggressive. We do not and will never make decisions about what to block based on being paid by any of these companies. We are building a consumer filtering system, and we are responsible to consumers. If you try it out and find any sites that don't work as intended please email us or contact support.

DyslexicAtheist3• 10 years ago

Hi,

Will you switch over to a paid service once you're out of beta?

Also what's your policy on logging?

Below (a probably outdated list of) privacy enhanced servers that don't log.

  # Swiss Privacy Foundation http://www.privacyfoundation.ch/de/service/server.html
  77.109.138.45
  77.109.139.29
  # www.censurfridns.dk http://www.censurfridns.dk/
  91.239.100.100
  89.233.43.71
  # CCC http://www.ccc.de/censorship/dns-howto
  85.214.20.141 
  204.152.184.76
  194.150.168.168
  213.73.91.35
  # Comodo Secure DNS https://www.comodo.com/secure-dns/
  8.26.56.26
  8.20.247.20
  # DNS Watch https://dns.watch/index
  84.200.69.80
  84.200.70.40
  # Fool DNS http://www.fooldns.com/fooldns-community/
  87.118.111.215
  # Free DNS http://freedns.zone/
  37.235.1.174
  37.235.1.177

take the above list to find the one fastest for you:

  for i in `cat dns.txt|grep -v '^#'`
  do 
    qt=`dig @$i techcrunch.com| grep "Query time:" |cut -f2 -d ':'`
    echo "$i: $qt"
  done

owly• 10 years ago

@optimalrob Great work in simplifying ad blocking for all devices. Question, is Optimal working on an option to block adult content as well? OpenDNS Family Shield does an excellent job of this currently for home and school networks. We use it and dnsmasq to block all of the major ad networks. Good luck!

drdaeman• 10 years ago

neither of the above can work for all devices in a household and more things in the house are tracking you and serving adverts

Isn't the best approach is to just buy only devices that either known to not have adware onboard (e.g. "dumb" TVs), or that can be re-flashed with software you can relatively trust?

That only applies to the core OS and its capabilities. The apps can contain all the nonsense they want, because OS can deny the access or feeds the sanitized data if the app's badly written or insists on the business model where user pays with their privacy.

stordoff2• 10 years ago

One can achieve this locally, on a laptop/desktop, using https://github.com/StevenBlack/hosts

I use this with DD-WRT to get network-wide filtering. It's not perfect (only updates on router boot), but good enough for me.

Additional DNSMasq options:

    addn-hosts=/tmp/ad-hosts
    no-resolv
    strict-order
    server=8.8.8.8
    server=8.8.4.4

Startup script:

    wget -qO /tmp/ad-hosts-v4 https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

    H_MERGE=/tmp/ad-hosts
    H_ORIG=/tmp/ad-hosts-v4

    sort $H_ORIG | uniq | grep "^0" >> $H_MERGE
    sort $H_ORIG | uniq | grep "^0" | sed "s/0\.0\.0\.0/::/g" >> $H_MERGE
    stopservice dnsmasq && startservice dnsmasq

jsingleton• 10 years ago

Network-wide is the way to go. Hosts files can be tricky to set up on phones and tablets.

I run dnsmasq on a pi as my ISP router is pretty limited. You can't even change the DNS servers, so the pi has to do DHCP too.

I use it to block other things like fixed banner overlays. With caching you can get it to work when you go off WiFi too [0].

Not sure I'd use Google's DNS servers though. Your ISP's are probably better for both speed and privacy. You can test the speed with an old Google project called namebench [1].

[0] https://unop.uk/block-bbc-breaking-news-on-all-devices

[1] https://code.google.com/archive/p/namebench

oliwarner• 10 years ago

Urgh why do people have to be so POSIX about things. Here is the content of my /etc/cron.daily/adblock file:

    #!/bin/bash

    wget -qO- https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts \
    | sort -u \
    | awk '/^0/ {print;print ":: " $2}' \
    > /tmp/ad-hosts

    service dnsmasq reload

I know cycles are cheap but that doesn't mean we should be spaffing them up the wall when we can do things cheaper. This avoids double-processing the downloaded content.

dnsmasq config as above.

Borating• 10 years ago

See also FreeContributor [1] (works not just with dnsmasq, but unbound and pdnsd and hosts file)

[1] https://github.com/tbds/FreeContributor

hoopsho• 10 years ago

Metiix Blockade blocks at the DNS level.... Locally on Windows or Linux or a raspberry pi if you want.

nherment• 10 years ago

Not sure what to think of it:

An "ethical" ad blocking service launched Thursday that allows users to pay their favorite publishers not to show them ads. [...] With Optimal.com, users will pay a flat monthly fee (Leathern told Business Insider the exact amount hasn't been released, but it's likely to be a high single-digit number) to experience an ad free web.

Source: http://uk.businessinsider.com/optimal-launches-subscription-...

quickben• 10 years ago

So they are paying for browser.. protection... in advance? Like a Racket?

Is that even legal?

optimalrob13• 10 years ago

So we have a separate subscription service at app.optimal.com where you can pay $5.99 a month and we will distribute 70% of that to publishers, entirely transparently. You can also "tip" sites an extra 5c or 25c if you like. There is no connection to our blocker or anyone else's... It's the honor system. We trust some people will do that and it will be enough to create new value for the broken ads ecosystem. We welcome your comments and ideas on this but fundamentally I believe that there should be an option in all media to avoid ads AND pay journalists (my brother is one), a fair rate. This can't be done by any one website on its own.

aphextron• 10 years ago

"An "ethical" ad blocking service "

All ad-blocking is ethical. It's the advertisers job to make me aware of products in a way that doesn't anger me, and they're doing a really shitty job.

witty_username2• 10 years ago

When you adblock instead of not using adblock websites lose money.

jgrahamc• 10 years ago

Now that's a blast from the past. Back in 1996 I joined a company in Mountain View called Optimal Networks, Inc. which had the domain name optimal.com. We sold the company to Compuware and the domain lived on for a while.

If you search jgc@optimal.com you'll find ancient messages from me still lurking on the web. I wonder if that email still receives spam?

optimalrob13• 10 years ago

We get all kinds of crazy optimal spam!

dsl3• 10 years ago

You should hook him up with his old work address!

I actually went on an adventure of re-registering old company addresses a few years ago.

binaryanomaly2• 10 years ago

Getting rid of ads in exchange for letting an additional third party know all my Web-surfing respective DNS-lookups?

Not sure which one is worse ..?

themihai• 10 years ago

Well... what DNS are you currently using now? Isn't a 3rd party? I had 8.8.8.8 so I guess the switch is no-brainer

binaryanomaly2• 10 years ago

In fact, I have my own DNS server running ;)

But if I had not:

- My ISP whose DNS I used, is subject to strong regulations and laws here

- "Additional" 3rd parties are more out of control from this perspective, therefore a significant higher risk, imho

I agree, when you used google DNS before, it's same same...

AdmiralAsshat• 10 years ago

I'd like to believe that Optimal is being altruistic with their DNS servers and just trying to help rid the world of annoying ads...but I'm also realistic.

My VPN provider (Torguard) provides one of these as well. I'm a little more willing to trust them not to do anything malicious with my DNS requests, if only because I'm paying them.

Retra• 10 years ago

I don't find the "I can trust them because I'm paying them" idea very useful. Nor the "If you're not the customer you're the product."

The bottom line is, if your information is valuable, then it will be in the advantage of those who possess it to exploit it whether you pay them or not. The only real non-moralistic consideration is whether you will stop paying if they start selling.

Either way, "I have a moral obligation to not sell your info, even if you don't pay me not to" sounds a lot better to me than "I don't sell your info because you think you're paying me not to." It's a horse apiece if you're dealing with strangers and you have to take them at their word.

wpietri• 10 years ago

The difference is in sustainability. Sure, some people always want more; morality is no barrier for them. But most people run into trouble only when they face a significant conflict of interest.

Thinking about companies I've seen the inside of, when the company is doing ok, it's rare for people to just up and do something sleazy. But if they company could collapse, suddenly the moral calculus shifts. Even if they don't do something dubious, they often will consider revenue sources they would have ignored before. As they say, desperate times call for desperate measures.

So I'm much more likely to trust a company I'm paying a fair rate for what they're doing. That's not to say that those people don't turn bad sometimes, but it happens a lot less.

esaym• 10 years ago

I've been using https://github.com/jakeogh/dnsgate for about 6 months now. Much better than just throwing stuff into /etc/hosts

Flammy• 10 years ago

Well this makes me feel a little better... from http://optimal.com/privacy-policy/

WHAT WE COLLECT

We get information about you in a range of ways.

snip

DNS service. If you utilize our DNS-based service, we may receive information about your IP address and URLs requested by that address. DNS requests utilize the UDP protocol which means we do not typically get information on the full URL you are attempting to visit (We receive far less information than a company providing a VPN service to you, for example, and that is one of the reasons we prefer this approach as it gives us far less information about user browsing). We do, however, have an IP address associated with each request and so could produce a list of sites visited by each IP address using our DNS servers. We do not know who you are when you use our DNS service, however. IP addresses may also be shared between users, and are not universally regarded as personally identifiable. We only use the IP addresses as follows: (a) the count of unique IPs we use as a benchmark for the adoption of our DNS service, and (b) we may check IP addresses against a free database of countries or cities provided by MaxMind and hosted on our servers, to limit the ability for users outside of certain areas to use our DNS service. We will not use the IP addresses we gather for any other purpose, and we will not correlate or combine them with any other personal information provided by you or other DNS service users, and we will never sell or share any of this information with any outside companies in any way. We may use aggregate request counts to help compensate publishers based on overall site traffic, across all users of our DNS service.

boxfire• 10 years ago

instead of letting the browser grab the dns abstractly all the way down through the os, use your ISP's standard DNS for the exact address in the address bar and/or a white list, and their DNS for implicit requests. Still leaks a picture of you, but a far muddier one.

0xmohit2• 10 years ago

Additionally, it says:

  - We may share personal information with your consent. For example, you may let us share personal information with others for their own marketing uses. Those uses will be subject to their privacy policies.
  - We may share personal information when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business or assets. These deals can include any merger, financing, acquisition, or bankruptcy transaction or proceeding.
  - We may share personal information for legal, protection, and safety purposes.
  - We may share information to comply with laws.
  - We may share information to respond to lawful requests and legal processes.
  - We may share information to protect the rights and property of Optimal.com Corp., our agents, customers, and others. This includes enforcing our agreements, policies, and terms of use.
  - We may share information in an emergency. This includes protecting the safety of our employees and agents, our customers, or any person.
  - We may share information with those who need it to do work for us.
  - We may also share aggregated non-personal data with others for their own uses.

Essentially, there are so many reasons for us to share your personal information that we can't help it.

Amusingly, the website:

- Uses Google Analytics

- Runs over HTTP (not HTTPS)

boodm• 10 years ago

What are the security concerns with a service such as this?

dsr_• 10 years ago

The obvious two: Optimal gets to see every domain name your computer asks for, including personalized domains like yourname.bloggingservice.com; Optimal gets to answer those requests in any way it wants to (MITM attacks).

profeta• 10 years ago

I will just leave this here http://someonewhocares.org/hosts/

i put this hosts file on every device/router that i touch.

It works fully local. So infinitely (and this is not even a hyperbole) faster and you won't have to exchange one privacy hole for another on the "cloud".

bitchypat• 10 years ago

infinitely (and this is not even a hyperbole) faster

Not if your HOSTS file is >135KB (the one you've provided is 373KB), you're using Windows 8 or earlier and you haven't disabled the DNS Client service.

http://winhelp2002.mvps.org/hostswin8.htm (about half way down)

Nadya• 10 years ago

...or earlier...

I've never had an issue on XP or 7 and I've used the same host file shared above with many, many more that I've personally added (my hosts file is nearly 500KB)

wila• 10 years ago

Not OP, but he said "device"/"router", not many of those run Windows 8.

FWIW I do the same, also use that host file at the border router and yes the difference is quite big. I'm always shocked about the extra adverts I see when using a computer or tablet outside of my own network.

geuis• 10 years ago

I experimented with this idea back in March, https://github.com/geuis/lead-dns

It turns out to be a pretty bad experience. There are tons and tons of legit domains that serve normal content that also serve ads. I used a subset of urls from a popular ad blocking list (https://github.com/geuis/lead-dns/blob/master/lists/easypriv...).

After only a few hours, using the web normally was near impossible. Just a very broken experience. Sadly, since you can't pass a path to a dns server, there's no finer-grained way to allow certain requests to a domain to go through and block others.

josho• 10 years ago

I've been using DNS to filter out the worst offenders. I don't mind most ads, so my list of domains is quite small. But, I've found it to be an effective tool.

I agree, however, that anytime a site is broken that I'm left wondering if I'm responsible because I've inadvertently blocked a CDN or something important.

seanwilson• 10 years ago

Say everyone in the world started using this today: what solution would Google need to use to deliver ads to get around DNS blocks?

witty_username2• 10 years ago

Google could use the same domain for advertising or use IP addresses instead of domain names.

pbhjpbhj2• 10 years ago

How would they verifiably record the adds served, say on my example.org page the ads come from example.org too how can Adsupplier Inc. then be sure I served those ads to a genuine page-requester?

jamiesonbecker• 10 years ago

Local version, appending to /etc/hosts:

    curl -q \
    https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts \
    2>/dev/null | sudo tee -a - /etc/hosts

shafiqissani• 10 years ago

thanks

joemccall86• 10 years ago

How easy is it to temporarily switch it off if a site is broken? Like if they have some crucial JS/CSS served from a blocked domain? I also wonder this with the hosts file approach. Is that kind of flexibility you give up for speed?

optimalrob13• 10 years ago

This is a slight issue, we are looking at ways to make this easier. The reality on the hosts file approach we think is that we can be far more dynamic and help protect users from bad domains as well, but time will tell.

justin_oaks• 10 years ago

If enough people blocked ads via DNS, I wonder how long it would be before we saw advertisers using plain IP addresses instead of DNS hostnames.

blinkingled• 10 years ago

Would be more and more of a problem with most sites switching over to HTTPS - Cert mismatch warnings if your ad URL is https and mixed content warning if not. Besides how hard would it be for someone to add a rule to uBlock to block by-IP URL access?

latitude• 10 years ago

I wrote a tiny DNS filtering daemon that does exactly the same -

https://github.com/apankrat/dnswhisperer

I've been using it routinely for past couple of months and it works really well. It blocks web ads, but it's blocks in-app ads and tracking as well. Tailing a log when launching an iPad game make for an interesting read. If anything slips through, just check the log, add the offender to the blacklist and restart the daemon.

0xmohit2• 10 years ago

I haven't used it myself, but I'd believe that Brave [0] might be a better option.

[0] https://brave.com/

optimalrob13• 10 years ago

I like Brave, and it works well! But many people want to keep using their FB/TWTR browsers.

dsl3• 10 years ago

You can use use OpenDNS and turn on filtering of the "Advertising" category. https://community.opendns.com/domaintagging/?category_id=53

Protip: Doing this at the DNS and not the browser level leads to lots of brokenness. (Like when you try to sign into an app on your Roku/FireTV and it hangs on a Google Analytics event).

sparrish• 10 years ago

One significant benefit of OpenDNS is you can go whitelist a site/domain from filtering if it's breaking something and they have more categories than just 'Advertising'. I use it to help protect myself and my children from pornography.

pbhjpbhj2• 10 years ago

I use opendns, the black/white-listing is a bit unrefined IMO, it does work though. The limit on the list length is quite tight on the free tier too.

ChartsNGraffs2• 10 years ago

I'd like to setup an add-blocking service, but I fear that I'll spend all my time admin-ing/whitelisting sites when a family member has a broken web experience. Is this an inevitability based on the nature of things?

aorth• 10 years ago

Adding another vote of confidence for running your own local DNS resolver with a block list. I use this script to generate a compatible hosts list for unbound:

https://github.com/jodrell/unbound-block-hosts

It's not terribly sophisticated, but every few weeks or whatever I just run this again:

  $ ./unbound-block-hosts --file=/opt/brew/etc/unbound/local-blocking-data.conf
  $ killall -HUP unbound

intrasight• 10 years ago

My strategy is to use OpenDNS to block sites, and uBlock Origin to block all 3rd-party access. Then I whitelist stuff. Whitelisting is more work than blacklisting but I'd claim it is more comprehensive. On my phone I just disable javascript.

textmode• 10 years ago

If there is strong demand I could put together a solution sor home networks that does not use a third party resolver, i.e., no tracking whatsoever. It could be run from an SD card or USB stick entirely in memory, i.e. no install needed. All you need is an extra computer; old is fine.

As for the "breaking" some websites, it depends on what you block. Speaking for myself, if blocking doubleclick.net makes one out of thousands hang, then that is acceptable. In fact it's desired because I want to know about such sites. What kind of website would do that? Doubleclick offers zero value to the user. I like this aspect of DNS blocking.

Also it's easy to "whitelist" or "blacklist" certain subdomains if that's what you need to do. Simply a matter of editing a text file, and this can be automated.

As for the comments about what effect this would have if practiced by the masses, I think it would bring these ad-supported search engines and social media sites to a day of reckoning.

Users would have all the power. At least one search engine claims it's focused on users. This would put that statement to the test. Users in control. As it should be.

thelittleguys• 10 years ago

What software is being used? BIND?

known2• 10 years ago

It's not that simple https://adblockplus.org/filter-cheatsheet

mrmondo• 10 years ago

I wouldn't trust some random company with all my DNS queries, great way to essentially MITM you're internet with yet another 3rd party.

IgorPartola• 10 years ago

I have tried DNS ad blocking based on one of the popular lists out there. Sadly it was overly aggressive. It cut off my access to sites like mint.com and the Google Analytics dashboard (need it for $WORK). It also made sites like Hulu not work because of their ads. Debugging why this was happening was a huge pain because for example Mint uses Intuit domain names that are like right levels deep CNAMES.

I am going to try this out, but here I would have even less control since I can't edit the zone file.

Edit: Just turned it on and cleared all relevant caches. Still seeing ads all over Google, CNN, BBC, Imgur and a few others. Don't think this works terribly well.

Edit 2: oh but now the Comedy Central app on my phone won't launch. Turning this off.

ChartsNGraffs2• 10 years ago

I noticed a recent trend in sites that refuse to serve when running an ad-blocker. Is the web a usable experience for people who are running ad-blockers?

davidu• 10 years ago

Hardcoding DNS servers that are run on Amazon IPs on AWS is just an incredibly bad idea.

jakeogh• 10 years ago

https://github.com/jakeogh/dnsgate

ig0r0• 10 years ago

Does not seem to be working for me. Tried both the UK and US IPs, never got an DNS response

Optimal DNS Ad Blocker

Related Stories