System-wide open source ad blocker for Mac, Windows, and Linux(github.com)
github.com
System-wide open source ad blocker for Mac, Windows, and Linux
https://github.com/anfragment/zen
172 comments
Thank you for your work! If you are interested in users verifying your binaries, maybe sigstore could help you.
https://www.sigstore.dev/
https://www.sigstore.dev/
Are any well known projects using sigstore? It looks interesting.
Thank you for starting this project. There is a bit of overall negativity in this thread from users who don't fully understand what is going on here, but please don't get discouraged. This is ultimately the correct approach to addressing browsers that have a financial interest in serving ads.
Thank you for your work. I appreciate it very much. Please don’t be down motivation by the negative comments.
About your comment of security, I think it’s better to make a FAQ file and write it there to clearly explain.
And one suggestion is I hope zen will have function to choose upstream DNS server (can be DoH or DoT server). It will be the best block ads with combo DNS and HTTPS.
About your comment of security, I think it’s better to make a FAQ file and write it there to clearly explain.
And one suggestion is I hope zen will have function to choose upstream DNS server (can be DoH or DoT server). It will be the best block ads with combo DNS and HTTPS.
Thank you very much for your work! I really appreciate it. It seems a great solution in a situation where you can't use Pi-hole etc.
I'm comfortable with a DNS based blocker (pi-hole) and it seems to work quite well. Bonus: It works across all devices on the network, rather than installing something onto the OS.
I seem to end up regretting anything I do at the network level to block traffic. It always seems to pop up that one weird time I actually do need something from a blocked domain to load, and it takes me way too long to remember that's what I did to block it.
Good point. Its fine if I'm the only one using the network, but I'll admit it can take a bit before I connect the dots between pi-hole and "this link I'm clicking off google won't load".
That's when you connect to your VPN.
I have a network configuration with 2 dnsmasqs, 1 with pi-hole-style hosts block, and 1 without, and most of my devices get the ad-blocking DNS, 1 gets the "unfiltered" DNS.
To do this from the DHCP component of dnsmasq, you can tag MAC addresses and create different configurations (including which DNS they get) for each tag, e.g. https://github.com/imp/dnsmasq/blob/770bce967cfc9967273d0acf...
I have a network configuration with 2 dnsmasqs, 1 with pi-hole-style hosts block, and 1 without, and most of my devices get the ad-blocking DNS, 1 gets the "unfiltered" DNS.
To do this from the DHCP component of dnsmasq, you can tag MAC addresses and create different configurations (including which DNS they get) for each tag, e.g. https://github.com/imp/dnsmasq/blob/770bce967cfc9967273d0acf...
I had that same issue until I started using mine over tailscale. One of my computers acts as the DNS server for the whole network with pihole on it, and then anytime I need to get around something I temporarily disconnect from my tailnet. Super nice cause then I get no ads on my phone too.
I'm not refuting what youre saying in any way; this is just a related suggestion for anyone using PiHole who occasionally runs into what you've described.
There's an Android app called flutterhole which can connect to and activate your pihole's 'pause blocking' feature. I have found this to be the easiest way around the scenario the poster above has mentioned. Doesn't help with figuring out PiHole is responsible obviously. HTH.
There's an Android app called flutterhole which can connect to and activate your pihole's 'pause blocking' feature. I have found this to be the easiest way around the scenario the poster above has mentioned. Doesn't help with figuring out PiHole is responsible obviously. HTH.
Since you shared an android app, I’ll share the iOS app I use for the same purpose, called “Pi-Hole Remote”
https://apps.apple.com/app/id1515445551
https://apps.apple.com/app/id1515445551
This looks convenient and powerful. Good share!
I personally setup an instance of Homebridge on the device running Pi-Hole, then use HomeKit on my Apple products to turn Pi-Hole on/off as if it were a light bulb.
I personally setup an instance of Homebridge on the device running Pi-Hole, then use HomeKit on my Apple products to turn Pi-Hole on/off as if it were a light bulb.
Pi-holes have an api that lets you hit a url that’ll pause the blocking for a configurable time. I use a Mac shortcut, but even a bookmark would work
I find it also a bit frustrating because browsers may even ignore your network's DNS settings so you can easily get unexpected behavior (yes, I know it's expected if you are a domain expert but I'm not and it shouldn't be surprising when users are shocked that they implement a pihole and see their machine is using a different DNS than expected. I'd actually expect novice users to be surprised in this case)
> browsers may even ignore your network's DNS settings
They should't. Bypassing policy is malware behaviour.
Funny that they ignore "my" network DNS, not ISP's. (in the name of freedom)
They should't. Bypassing policy is malware behaviour.
Funny that they ignore "my" network DNS, not ISP's. (in the name of freedom)
FF enables this and they aren't not ignoring the ISPs. Settings > Privacy and Security > DNS over HTTPS
There is a reason to do this btw. The name should say it all. It'll default to cloudflare but they let you specify what you want. The utility? Let's say I'm not an advanced user, what's my DNS look like? Is it DoH? We both know the answer. So defaulting so users' traffic is default DoH sounds like a security improvement. There's also an additional utility. If I take my laptop and move from my home network to another one, I actually don't end up using a different DNS.
You can also use Mullvad's DNS[0], or switch to 1.1.1.2/1.0.0.2 if you want malware protection on Cloudflare's DNS.
Stop making up conspiracies that don't exist. There's enough BS in the world already that we don't need to make ones up to be upset.
[0] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
There is a reason to do this btw. The name should say it all. It'll default to cloudflare but they let you specify what you want. The utility? Let's say I'm not an advanced user, what's my DNS look like? Is it DoH? We both know the answer. So defaulting so users' traffic is default DoH sounds like a security improvement. There's also an additional utility. If I take my laptop and move from my home network to another one, I actually don't end up using a different DNS.
You can also use Mullvad's DNS[0], or switch to 1.1.1.2/1.0.0.2 if you want malware protection on Cloudflare's DNS.
Stop making up conspiracies that don't exist. There's enough BS in the world already that we don't need to make ones up to be upset.
[0] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
I have a very simple setup that works for us.
ISP’s router has unrestricted Wi-Fi access. I run a router behind it with restricted (via pi-hole) access.
All devices connect to the restricted Wi-Fi. Any time I need unrestricted access, I connect to the ISP router Wi-Fi for some time and back to the restricted when done.
ISP’s router has unrestricted Wi-Fi access. I run a router behind it with restricted (via pi-hole) access.
All devices connect to the restricted Wi-Fi. Any time I need unrestricted access, I connect to the ISP router Wi-Fi for some time and back to the restricted when done.
Don't you mean you run the restricted router in front of the ISP router?
Not sure what the correct usage is regarding front vs behind.
Basically Outside World — ISP Device - internal restricted Router (using pi-hole as DNS) - home devices
So, yes, if looking from inside the restricted router would be in front.
Basically Outside World — ISP Device - internal restricted Router (using pi-hole as DNS) - home devices
So, yes, if looking from inside the restricted router would be in front.
+1
I connect to mine over tailscale DNS.
I recommend adding a tray icon that disables it for 60 seconds (super helpful for the odd site that serves something critical from an ads domain… like my bank).
Only downside is apps don’t have to use system DNS and a few mobile ones are wise enough to bypass.
I connect to mine over tailscale DNS.
I recommend adding a tray icon that disables it for 60 seconds (super helpful for the odd site that serves something critical from an ads domain… like my bank).
Only downside is apps don’t have to use system DNS and a few mobile ones are wise enough to bypass.
I don't mind PiHole, but it doesn't do nearly as good a job of ad blocking as a "real" browser plugin does.
The amount of crap that still comes through when I turn off uBlock -- but am still using PiHole DNS, which is always active on my home network -- is a lot.
Honestly I don't think DNS-based adblocking is really viable, long-term. It's just too easy for advertisers and dirtbag website operators to get around it. There's just no substitute for controlling the retrieval of content elements and their presentation from the application where the user is doing the interaction.
This is why keeping browsers out of the hands of adtech corporations is pretty important; once they control that presentation layer it's largely game over. They can just tunnel all the traffic through a single connection to a relay server, if they want to, and there won't be shit a user can do about it once they've decided that's the only browser they can use.
The amount of crap that still comes through when I turn off uBlock -- but am still using PiHole DNS, which is always active on my home network -- is a lot.
Honestly I don't think DNS-based adblocking is really viable, long-term. It's just too easy for advertisers and dirtbag website operators to get around it. There's just no substitute for controlling the retrieval of content elements and their presentation from the application where the user is doing the interaction.
This is why keeping browsers out of the hands of adtech corporations is pretty important; once they control that presentation layer it's largely game over. They can just tunnel all the traffic through a single connection to a relay server, if they want to, and there won't be shit a user can do about it once they've decided that's the only browser they can use.
"Bonus: It works across all devices on the network, rather than installing somthing onto the OS."
A proxy can be installed "onto the OS" of a RPi. It does not have to be installed on the computer used to view web pages.
A Pi-Hole is a modified dnsmasq installed "onto the OS" of a RPi.
A proxy can be installed "onto the OS" of a RPi. It does not have to be installed on the computer used to view web pages.
A Pi-Hole is a modified dnsmasq installed "onto the OS" of a RPi.
They were clearly referring to the OS of a device someone would browse on, not the OS of a network device.
Can confirm, never leaving the house is a very effective way to avoid unpleasant interactions :)
+1 using AdGuard on Home Assistant Raspberry Pi
I’m using NextDNS for this and it’s great.
It is just not wise to allow some random application to MiTM your SSL traffic.
If you can read the code and asure that the traffic won’t be sent to a malicious third party, why not? What is the concern?
The concern is that it's a huge waste of time for everyone to read the code, and a significant investment of time for anyone to do so, that's why not
How would you know if the binary was built from the code verbatim?
How would you know that for future updates?
How would you know that for future updates?
The build steps are provided as a GitHub action in the repo. You can audit the build pretty easily, or if you're super paranoid you can build it yourself by following the build steps.
Even if the app is trustworthy, it still adds an attack vector to your system. It could have a bug, or the certificate could be exploited by another program.
Equally true of every ad
This would be a reasonable argument if there weren't many alternative ad blocking methods that don't require MITMing your TLS traffic.
It's in no way worse than running a single browser extension with overly broad privileges. If this method of adblocking gains more traction (quite possible, as Google keeps moving to damage in-browser ad blockers), I expect the implementation to receive a lot more scrutiny.
I think we have to face the reality that web browsers might no longer be considered "user" agents.
I think we have to face the reality that web browsers might no longer be considered "user" agents.
> I think we have to face the reality that web browsers might no longer be considered "user" agents.
I think too many techies are, much like yourself, contributing to the problem by refusing to move away from Chrome for "reasons"[1], and then compounding it by refusing to acknowledge that "web browsers" != "Google Chrome".
[1] The "reasons" are of dubious quality. Myself and many others are able to do all normal web-browsing from firefox or firefox forks with no functional or performance degradation.
I think too many techies are, much like yourself, contributing to the problem by refusing to move away from Chrome for "reasons"[1], and then compounding it by refusing to acknowledge that "web browsers" != "Google Chrome".
[1] The "reasons" are of dubious quality. Myself and many others are able to do all normal web-browsing from firefox or firefox forks with no functional or performance degradation.
> I think too many techies are, much like yourself, contributing to the problem by refusing to move away from Chrome [...]
Contrary to your assumptions, I've been quite vocal against the Chrome/Blink monoculture for a while. Unfortunately there is a legit case for it; several generations of "low-end" devices (anything older than 10 years basically), that are still quite capable and in common use, where the difference in performance between Firefox and Chromium becomes quite noticeable, especially as you try to watch video.
I don't think the problem is "techies", we have zero influence outside our own circles - see the historical rates of Linux adoption. The problem is we need the good ol' hammer of antitrust to start swinging again. We also need the regulators to be smart; if we get really unlucky, they will target iOS Safari instead. (This would be good in a healthy ecosystem, but would only serve to further entrench Google's position in the current situation.)
By the way, using a filtering/rewriting proxy has other merits, especially on said older hardware; you can rewrite the entire web page to make it more lightweight and accessible. Check out miniwebproxy[1] and medium-rare[2]. It's also quite simple to write one; you need maybe a hundred lines of Go to start getting results. I've been experimenting with integrating Readability[3][4]; and I think there's more potential to this approach.
[1]: https://humungus.tedunangst.com/r/miniwebproxy
[2]: https://humungus.tedunangst.com/r/medium-rare
[3]: https://github.com/go-shiori/go-readability
[4]: https://github.com/mozilla/readability
Contrary to your assumptions, I've been quite vocal against the Chrome/Blink monoculture for a while. Unfortunately there is a legit case for it; several generations of "low-end" devices (anything older than 10 years basically), that are still quite capable and in common use, where the difference in performance between Firefox and Chromium becomes quite noticeable, especially as you try to watch video.
I don't think the problem is "techies", we have zero influence outside our own circles - see the historical rates of Linux adoption. The problem is we need the good ol' hammer of antitrust to start swinging again. We also need the regulators to be smart; if we get really unlucky, they will target iOS Safari instead. (This would be good in a healthy ecosystem, but would only serve to further entrench Google's position in the current situation.)
By the way, using a filtering/rewriting proxy has other merits, especially on said older hardware; you can rewrite the entire web page to make it more lightweight and accessible. Check out miniwebproxy[1] and medium-rare[2]. It's also quite simple to write one; you need maybe a hundred lines of Go to start getting results. I've been experimenting with integrating Readability[3][4]; and I think there's more potential to this approach.
[1]: https://humungus.tedunangst.com/r/miniwebproxy
[2]: https://humungus.tedunangst.com/r/medium-rare
[3]: https://github.com/go-shiori/go-readability
[4]: https://github.com/mozilla/readability
> Contrary to your assumptions, I've been quite vocal against the Chrome/Blink monoculture for a while.
I apologise for my incorrect assumptions. What browser are you reading this on, right now?
I apologise for my incorrect assumptions. What browser are you reading this on, right now?
elinks
> I think we have to face the reality that web browsers might no longer be considered "user" agents.
If by "web browsers" you mean specifically Chrome, yes. Firefox, Brave, and others are all committed to supporting MV2, and will continue to serve my interests as a user for the foreseeable future.
If by "web browsers" you mean specifically Chrome, yes. Firefox, Brave, and others are all committed to supporting MV2, and will continue to serve my interests as a user for the foreseeable future.
>I think we have to face the reality that web browsers might no longer be considered "user" agents.
Well obviously, if you keep insisting on using a browser made by Google, an ad company.
Well obviously, if you keep insisting on using a browser made by Google, an ad company.
I think it is a mistake for programs that have SSL traffic to not have an option for a user-defined non-secure proxy (usually this would be for a proxy running on the local computer, rather than a remote proxy). A non-secure proxy would save energy (since then it doesn't need to decrypt and encrypt it twice) as well as allowing use of newer (or older) cipher methods in programs that do not support them.
How do you know that the downloaded binaries are built by the GitHub action? If I must audit the code and build it myself every release, then how is this a usable product?
Not a product. It's literally free, free as in free speech, and free as in you're free not to use it.
Building the code yourself for every update is also a solved problem on every system with a feature complete package manager, including Windows. Trust is not so easily solvable, but if you trust nobody, you can choose to look at ads.
Building the code yourself for every update is also a solved problem on every system with a feature complete package manager, including Windows. Trust is not so easily solvable, but if you trust nobody, you can choose to look at ads.
> Not a product. It's literally free, free as in free speech, and free as in you're free not to use it.
Sorry, I change my question to "how is this a usable free?"
Sorry, I change my question to "how is this a usable free?"
Same as everything you use on your computer... If it's not open source it's already game over. If it is, congratulations feel free to inspect all the code yourself and build from source OR trust the project maintainers and use pre built binaries.
Applies to this program no different than your Linux distro.
Of course there could be other tools that can help verify things such as checksums on reproducible builds.
If none of that is "usable" enough for you, feel free to set up your own tooling and automation
Applies to this program no different than your Linux distro.
Of course there could be other tools that can help verify things such as checksums on reproducible builds.
If none of that is "usable" enough for you, feel free to set up your own tooling and automation
> Same as everything you use on your computer
Thank you. That's my point. There is no point in stating that some open source code is somewhat safer because "it can be audited". No. As you said, it's the same as everything I use on my computer. Unless we can establish a consistent safety level for certain type of projects, we can't claim an arbitrary category of software is somehow better.
Thank you. That's my point. There is no point in stating that some open source code is somewhat safer because "it can be audited". No. As you said, it's the same as everything I use on my computer. Unless we can establish a consistent safety level for certain type of projects, we can't claim an arbitrary category of software is somehow better.
Where is the bar for software you trust? do you trust your OS, router firmware, VPN client, web browser, etc?
In fact, that's what I'm trying to say. The line we draw at "hey we can at least audit open source" is a fully imaginary one. It's a false comfort we create. It's the Kool-Aid we drink.
I don't have any trust in any of those components you mentioned, but I came to terms with the risks associated with using them as part of my threat model. However, I find the notion that open source is somewhat safer because "we can audit it" exaggerating if not misleading. It's not a valid argument, and it should never be used because there's no way to do it in an either practical or consistent way for the users of the said product.
I don't have any trust in any of those components you mentioned, but I came to terms with the risks associated with using them as part of my threat model. However, I find the notion that open source is somewhat safer because "we can audit it" exaggerating if not misleading. It's not a valid argument, and it should never be used because there's no way to do it in an either practical or consistent way for the users of the said product.
There's a difference between "you/I can audit it" and "we (collectively) can audit it".
You're not living in a vacuum. The more users (and perhaps more importantly, contributors) an open source product has, the less likely it has intentional backdoors built into it.
You're not living in a vacuum. The more users (and perhaps more importantly, contributors) an open source product has, the less likely it has intentional backdoors built into it.
What's your process to validate if that said software has been collectively audited sufficiently?
Yes that's fair, however that's how our complex world works. E.g. we rely on journalism (the real kind) to uncover all kind of scummy behavior. Similar in the OSS world.
There is no way to easily verify that unless some trusted bodies do this for us and publish their work specifically for what you're using.
Now you just have been stating a problem and no solution.
I do agree with you though that "hey it's OSS and easy to verify because we have the code" is indeed lying to ourselves and especially tools with privileges like this (MITM your encrypted traffic) should not be taken that lightly and have the proper warnings, disclaimer and attention (to watch for bad behavior)
There is no way to easily verify that unless some trusted bodies do this for us and publish their work specifically for what you're using.
Now you just have been stating a problem and no solution.
I do agree with you though that "hey it's OSS and easy to verify because we have the code" is indeed lying to ourselves and especially tools with privileges like this (MITM your encrypted traffic) should not be taken that lightly and have the proper warnings, disclaimer and attention (to watch for bad behavior)
> You can audit the build pretty easily,
Please define "easily"
Please define "easily"
You could just compile it. For updates you could like pull down the new code, check the diff, and rebuild.
No one will do this, and those that read source code during installation do not review it for every upgrade. It's one of those 'just do this!' arguments that has little to no basis in reality. There's more of them replying to the parent comment: "Just do this! Just compile a thing! Just verify signatures for every update!". Come on... Meanwhile the negatives immediately implicate anyone with access to the executable.
You don't know this person, and I see no personally identifiable information to make me trust them. They could literally be a state actor right now! We've also seen so many large supply-chain attacks over the last decade which could easily target a tiny project like this.
I agree with the parent - not wise.
You don't know this person, and I see no personally identifiable information to make me trust them. They could literally be a state actor right now! We've also seen so many large supply-chain attacks over the last decade which could easily target a tiny project like this.
I agree with the parent - not wise.
But doesn’t that apply to chromium / firefox as well (or any other big application). Web browsers are insanely huge, nobody is reading the entire code. What makes this different?
No, because Google and Mozilla pay loads of people to write and review the code that goes into their browsers and ensure it’s not malicious.
Google pays loads of people to conceive and write code that is malicious to endusers e.g. those not paying it for eyeballs.
Is Google going to hack your bank account?
If we start with the reasonable assumption that "being malicious" !== "hacking a bank account", then the answer to your question does not matter at all.
They're going to do everything they can to learn how much money you have in your account and then they'll relentlessly try to manipulate you into losing more of your money.
If you think you can trust Google because they are not interested in robbing your bank account, then you have fallen well for their deceptive campaigns. Google is just a next level robber that operates on corporate level.
So I can apply the same logic to Microsoft concerning Windows, Office, etc. and you wouldn't dispute me, right?
Incidentally, no I have no objections against closed source. I find the religious dogma behind FOSS patently stupid.
Incidentally, no I have no objections against closed source. I find the religious dogma behind FOSS patently stupid.
> So I can apply the same logic to Microsoft concerning Windows, Office, etc. and you wouldn't dispute me, right?
I mean, no, I would dispute you, because everything Microsoft is doing in those products isn't publicly available for the world to see.
Still probably pretty unlikely because those products are hugely popular and widely scrutinized.
I mean, no, I would dispute you, because everything Microsoft is doing in those products isn't publicly available for the world to see.
Still probably pretty unlikely because those products are hugely popular and widely scrutinized.
So you would dispute me, but not for the criteria you originally posed.
The post I was replying to said that despite being open source, nobody reads the code for Chromium and Firefox. This isn't true because people are paid to read that code. Nonetheless, anyone can still read it if they want to. This means that it's at least marginally higher risk for a state actor trying to get code into these codebases than a proprietary codebase.
As I said, I think it's still pretty unlikely that Microsoft products are compromised by a state actor. It's certainly not part of my threat model. I'm not sure what point you're trying to make though. I certainly wouldn't install a system-wide HTTP proxy from a developer I didn't trust. And I don't have much of a choice but to trust Microsoft, their products are so ubiquitous I often have little choice.
As I said, I think it's still pretty unlikely that Microsoft products are compromised by a state actor. It's certainly not part of my threat model. I'm not sure what point you're trying to make though. I certainly wouldn't install a system-wide HTTP proxy from a developer I didn't trust. And I don't have much of a choice but to trust Microsoft, their products are so ubiquitous I often have little choice.
The point I am making is that both Google (insofar as their open source software) and Microsoft both pay programmers to write and examine their code. That was the original criteria, and working off that you shouldn't have a problem with Microsoft.
Of course, you do have a problem as you've already made clear. However, that problem stems from how Microsoft's code is closed source compared to Google's open source code. That's religious FOSS dogma which I referred to earlier, and has nothing to do with whether programmers are paid to write and examine your code.
Of course, you do have a problem as you've already made clear. However, that problem stems from how Microsoft's code is closed source compared to Google's open source code. That's religious FOSS dogma which I referred to earlier, and has nothing to do with whether programmers are paid to write and examine your code.
Do you trust Google + Firefox as much as this random developer? Seems pretty different.
To take a different argument, it’s another party that’s less well known that you have to trust. The more parties you trust, the less secure things become. Whether that additional risk is something you want to take on is a personal decision. MITM SSL traffic would make me uncomfortable.
Yes, some people will do this. I just read the whole project, it's actually a pretty simple program.
I'm installing it now and the best part is if I don't like something I can change it. OSS FTW.
I'm installing it now and the best part is if I don't like something I can change it. OSS FTW.
If you really wanted/NEEDED this, you could definitely go through all the code. It would take a bit, but it's doable with determination (lol). Also, you don't have to necessarily review all of the code every update. All you have to do is view the changes/new commits every time you want to update.
The hardest part is determining that you want to go through all of this hassle to replicate something browser extensions already do (for the most part).
The hardest part is determining that you want to go through all of this hassle to replicate something browser extensions already do (for the most part).
If you believe you can find even just all unintentional bugs, let alone deliberate security vulnerabilities, you've never looked at the underhanded C contest [1].
> All you have to do is view the changes/new commits every time you want to update.
These can be thousands of lines of code per day in busy projects.
[1] https://en.wikipedia.org/wiki/Underhanded_C_Contest
> All you have to do is view the changes/new commits every time you want to update.
These can be thousands of lines of code per day in busy projects.
[1] https://en.wikipedia.org/wiki/Underhanded_C_Contest
I'm as paranoid about this as you, but this type of verification seems easier today with AI tools. I'm not aware of any that do this, but if LLMs can give insight about what a piece of code is doing, they can surely be trained to detect possible suspicious behavior. Perhaps even by inspecting a binary, but certainly by processing code.
https://any.run/cybersecurity-blog/chatgpt-powered-analysis-... Sort of did this
Maybe for well-intended code (and even there I have my doubts – the halting problem says hi!), but most definitely not for malicious backdoors at this point.
I think that's a great use-case. I'd love a real-time security scanning system covering as many open source projects out there as possible.
Please don't downvote an earnest and important question which should be answered
If I can miss subtle and not-so-subtle bugs in my own team's code that I'm working on every single day, what are the chances I'll get it right on somebody else's project?
Being able to MITM any HTTPS request on my system is a privilege I'd not grant lightly. It's up there with browsers, browser extensions (with "all content on all sites" access), and password managers in terms of blast radius in case anything goes wrong.
Being able to MITM any HTTPS request on my system is a privilege I'd not grant lightly. It's up there with browsers, browser extensions (with "all content on all sites" access), and password managers in terms of blast radius in case anything goes wrong.
No but it might be fun to play with in a Qubes environment or similar where you can inspect packets going in and out for anything weird happening.
Looking at packets will only get you so far if they're encrypted.
Software like this has way too many opportunities to exfiltrate information for that approach to work.
Software like this has way too many opportunities to exfiltrate information for that approach to work.
That's true, but if it is trying to exfiltrate data you will probably see more packets coming out than going in. If the concern is that the SSL cert they add allows them to decrypt your data, and you see it sending your requests anywhere it shouldn't, you'll get a window into what they are trying to do. It's not perfect, but it is possible to gain information in such a way.
But as developers, we're happy enough to suggest `wget -qO - https://github/url | sudo bash -s`
No, we're not.
Unfortunately many people do like that, but I hate it and I don't do stuff like that (and it seems many other people hate it too; fortunately you can just download the file without immediately executing it, if you want to view (and possibly modify) it).
[deleted]
Why not? We allow Cloudflare to do it every day.
Application doesn't provide a way to remove installed certificate. Don't use this app.
The way Charles does this is by generating a root certificate dynamically and makes it really easy to remove by giving you instructions for how to install and remove it just for Chrome for example:
https://www.charlesproxy.com/documentation/proxying/ssl-prox...
https://www.charlesproxy.com/documentation/using-charles/ssl...
https://www.charlesproxy.com/documentation/proxying/ssl-prox...
https://www.charlesproxy.com/documentation/using-charles/ssl...
That only works on Windows, I believe (and maybe on Linux). Chrome on macOS uses the system root certificate store.
Tangentially related, I found many built-in Windows applications and services use certificate pinning and will either fail outright or modify behavior (easily identified by the number and size of packets with and without MITM).
It made me very curious to find out what data they're downloading / exfiltrating that they feel the need to go to such extremes to hide it from the user.
FWIW, even some of the packages that do pass through MITM are further encrypted binary blobs, not clear text.
It made me very curious to find out what data they're downloading / exfiltrating that they feel the need to go to such extremes to hide it from the user.
FWIW, even some of the packages that do pass through MITM are further encrypted binary blobs, not clear text.
How many apps do use certificate pinning and so will be broken as a result of this app's MITM?
Afaik most desktop applications don't do certificate pinning.
Mobile apps definitely do.
Except things like browsers (e.g. Firefox, Chrome) or python that ship their own root CA trust store.
Except things like browsers (e.g. Firefox, Chrome) or python that ship their own root CA trust store.
I don't know how it actually works, but won't website like youtube simply deny you access if it detects that the ad related request timed out?
I imagine that browser extensions actually tap into the site's code and somehow go around such detection.
But if this is a simple firewall, how will this work against any website that doesn't just default to most trivial "import ad service", but rather actually takes steps to block the ad blockers (Like youtube)?
I've wondered what-if scenarios like this for a long time. I see them being implemented smaller websites, but never at scale like amazon.com or YouTube where they serve petabytes per second. My conclusion is: it gets so expensive to track and block users at session level that they just let go.
That's only true if only a small percentage of users actually use that particular ad-blocking strategy. If a significant number of users did, then it would be a real concern.
Although I think YouTube et al see an increasing amount of revenue and viewership coming from apps... and if they could, I suspect they would kill their web sites in favor of apps where they have much more control.
Although I think YouTube et al see an increasing amount of revenue and viewership coming from apps... and if they could, I suspect they would kill their web sites in favor of apps where they have much more control.
I haven’t had time to look at the code. Is this generating a unique root certificate per install? If not this could become an attack vector to decrypt TLS traffic.
> During the first run, Zen will prompt you to install a root certificate. This is required for Zen to be able to intercept and modify HTTPS requests. This certificate is generated locally and never leaves your device.
[deleted]
Even if it does create unique root certificates it is a massive attack vector. How good is the tool at protecting the corresponding private key from other software on the device, for example?
It's interesting to see the paranoia FUD in the comments here around MITM, when this is happening on your own machine under your control, and it's open-source too. It should be painfully obvious by now that Big Tech is using "security" as an excuse to effectively force-feed you whatever they want, and depriving you of the right to refuse should be illegal.
Fuck the corporate-authoritarians who are taking away the freedom to do what we want to content that enters our machines. They've been fighting that war for a long time, and we can see through the tactics they've been using.
I've been using Proxomitron as a filtering proxy for over 2 decades after its author's death, and it is even more powerful than this (but requires more setup and tuning.)
Fuck the corporate-authoritarians who are taking away the freedom to do what we want to content that enters our machines. They've been fighting that war for a long time, and we can see through the tactics they've been using.
I've been using Proxomitron as a filtering proxy for over 2 decades after its author's death, and it is even more powerful than this (but requires more setup and tuning.)
I can see it's some kind of replacement for uBlock Origin when MV3 is official.
Does an ersatz root certificate work with HSTS? A quick DDG seems to suggest it's still possible to disable HSTS on the browsers: https://appuals.com/how-to-clear-or-disable-hsts-for-chrome-...
As long as the custom root certificate is properly installed, HSTS will still work.
I kinda see installing a root certificate like disabling SIP in macOS - I get why it's needed in some cases, but it's a deal-breaker for me.
That makes deep ad blocking, local web caching, and automated history logging (with paths) impossible, for better or worse.
That makes deep ad blocking, local web caching, and automated history logging (with paths) impossible, for better or worse.
Nice, I use AdGuard (on mobile and desktop), would this be a suitable replacement?
AdGuard for Mac is the same offering (not to be confused with AdGuard for Safari, which is a browser extension):
https://adguard.com/en/adguard-mac/overview.html
There's also Little Snitch Mini:
https://www.obdev.at/products/littlesnitch-mini/index.html
https://adguard.com/en/adguard-mac/overview.html
There's also Little Snitch Mini:
https://www.obdev.at/products/littlesnitch-mini/index.html
Any differences in performance or how well each works for adblocking compared to the others?
How does it work compared to a browser extension ad blocker ?
Browsers only work in the browser, this is system-wide
Is that even a common problem? I can't think of any apps on my computer that are showing me ads, other than my browser.
It's a very different story on mobile, but there, certificate pinning can also trivially bypass this kind of blocking, and for good reason too: Imagine a system-wide tool like this getting access to online banking credentials, for example...
It's a very different story on mobile, but there, certificate pinning can also trivially bypass this kind of blocking, and for good reason too: Imagine a system-wide tool like this getting access to online banking credentials, for example...
Is anything similar available? Also open source? Does it really work better than browser add-ons? Would this help minimise browser fingerprinting ?
This won't affect fingerprinting (except maybe it'll block the fingerprinting scripts if they're in lists). It does work better than add-ons in that it'll work on regular applications, not just your browser
I meant - but was not very clear: if one used this software instead of a browser add-on to block ads, would this be a big improvement in escaping browser fingerprinting ?
Probably not. Use a dedicated tool like a custom browser (Mullvad Browser comes to mind - it beats fingerprint.com/demo which Firefox even WITH protections enabled, does not.
You may also want to see https://librewolf.net/ while not as good by default compared to Mullvad Browser, it may still be a browser to consider.
I'e been using Librewolf for almost a year now, and like it a lot. Also have some other extensions and tweaks in a user.js
How much better is Mullvad Browser and why?
How much better is Mullvad Browser and why?
It's a filtering proxy server. Privoxy is one alternative.
More than a browser extension as it filters all apps (esp. Electron apps).
Worse than a browser extension where I can deactivate per-site to solve false positives.
Worse than a browser extension where I can deactivate per-site to solve false positives.
Does LittleSnitch allow for an import of urls, IPs, etc.. to block? if so, know of any lists?
They have a few blocklists with IP addresses and hostnames listed on their page you can easily subscribe to. https://www.obdev.at/products/littlesnitch-mini/blocklists.h...
> During the first run, Zen will prompt you to install a root certificate.
Well, nope.
Well, nope.
How does this compare to using a hosts file with known ad servers?
like: https://github.com/StevenBlack/hosts
like: https://github.com/StevenBlack/hosts
Hosts files have never been a good idea for ad blocking, I really wish users would stop promoting them.
It isn't the best way to do it as far as effectiveness goes but it it is pretty good, especially for web browsing. It is the easiest way to do it on my iOS devices (as a fake VPN profile) and can be switched off in a corner case where I need to access something it is filtering out.
It isn't as flexible or powerful as other methods, but it is very simple. Tools are all about how you use them. Ignoring them isn't any better than suggesting them.
It isn't as flexible or powerful as other methods, but it is very simple. Tools are all about how you use them. Ignoring them isn't any better than suggesting them.
An easy example for comparison is hosts file cannot block YouTube ads, while this one can.
How? Can't Youtube just detect which expected resources are not loading and refuse to play?
> During the first run, Zen will prompt you to install a root certificate. This is required for Zen to be able to intercept and modify HTTPS requests.
Still very, very scary.
Still very, very scary.
Why would anyone need to block ads outside of the browser? This seems like it's just asking to introduce obscure errors into other apps?
I meaning Microsoft is trying to introduce ads into the file explorer and search centers...
What do you mean trying to? Look at this shit.
https://imgur.com/a/d0jq4s1
Every time you stamp it out they find a way to sneak it back in.
https://imgur.com/a/d0jq4s1
Every time you stamp it out they find a way to sneak it back in.
If that was my macOS start menu, I’d smash my display with anything I had at hand
It's pretty damn atrocious. I run a different startmenu and taskbar, but it still bugs me.
I still prefer Windows with ads modified to hide those ads over MacOS though.
I still prefer Windows with ads modified to hide those ads over MacOS though.
I don't see the problem here. They're adding value to their OS this way, value that will result in greater profits and therefore shareholder value. My MS stock is doing great thanks to moves like this!
If you don't like it, you don't have to use MS products.
If you don't like it, you don't have to use MS products.
which I really doubt are serving through http(s), making this quite useless for that...
Why do you doubt that? Even Microsoft, with all their money and NIH syndrome, are unlikely to invent a brand new application protocol just to serve ads.
I think the parent is insinuating that Microsoft would just hard bake ads directly into the OS through updates? I'm not really sure though.
Because Google is implementing changes to disable adblockers in the browser.
Are people that much in love with Chrome?
I imagine it would be a chore for ChromeOS users to migrate to another OS and another browser, and ChromeOS has many attractive qualities.
In what world can you modify the OS to add something like this but you cannot modify the OS to install a better browser? (Or a better OS!)
ChromeOS puts Chrome in a nice safe sandbox (in addition to the sandboxing of Chrome tabs that happens on all OSes) that used selinux and other technologies. This requires modifications to Chrome. Replicating that for another browser might be harder than modifying ChromeOS to add something like this.
Most people don't care.
A lot of people have to use it for work whether they like it or not.
If you have to use it for work “whether you like it or not” then you’re extremely unlikely to have the permissions to install your own root certificate, which is a lot more sensitive operation than running Firefox.
Plenty of people use their personal computers for work, even if I strongly advise against it lol
Well then they’re able to install and run Firefox.
My point is the only situations where you have no control over browser installs are when the machine is locked down in such a way that you also cannot install root certificates.
My point is the only situations where you have no control over browser installs are when the machine is locked down in such a way that you also cannot install root certificates.
Not necessarily. And there’s plenty of browser based software/services that do not work with Firefox or have a limited functionality with Firefox that are required for work.
I know back when I did more freelancing with podcast clients this was a constant problem. The OS folks were using could reek havoc if it wasn’t safari, edge, or chrome 90% of the time.
I know back when I did more freelancing with podcast clients this was a constant problem. The OS folks were using could reek havoc if it wasn’t safari, edge, or chrome 90% of the time.
But again, you’d then just use Chrome for work and Firefox for personal browsing.
As it happens I lived through this in the early 00s with IE but back then I used Opera for personal browsing and IE for work.
Even in the very remote possibility that you can somehow make changes to root certificates but cannot install a second browser (and I’m being charitable here because there are literally zero reasons that would ever happen), it would still make more sense to update your local hosts files with a pihole-list block list rather than installing your own root cert and using a 3rd party tool to MITM all your web traffic.
I do get the appeal of this tool. I honestly do. But there are so many safer ways to solve this same problem.
As it happens I lived through this in the early 00s with IE but back then I used Opera for personal browsing and IE for work.
Even in the very remote possibility that you can somehow make changes to root certificates but cannot install a second browser (and I’m being charitable here because there are literally zero reasons that would ever happen), it would still make more sense to update your local hosts files with a pihole-list block list rather than installing your own root cert and using a 3rd party tool to MITM all your web traffic.
I do get the appeal of this tool. I honestly do. But there are so many safer ways to solve this same problem.
I doubt you could use something like this on a work device, anyways. Allowing users to install their own root certificates would be a major faux pas.
[deleted]
Use Brave, they have stated adblocking will continue to work.
Why not? Lots of services are now desktop apps and since you cannot run browser adblockers on Electron apps, this is the next best thing. I also run something similar on Android so I don't see ads in apps either, not just in the browser.
If other apps run into obscure errors due to ad blocking, then it's time to find alternative apps (pending overly-aggressive blocking causing the obscure error - which I have come across, although rarely).
I’d block ads out side of my computer if it was possible, so absolutely need to block all ads in any app.
[deleted]
lofl. no. like… did they try any 2nd order thinking here?
Having just posted the app to a couple of small subreddits before sleep and then waking up to being on the front page over here is quite an experience :) I was hoping to make a Show HN post after giving Zen a bit more polish, but I guess here we are.
Thanks for all the constructive feedback. I totally share your concerns about its security and likewise wouldn't use some unverified application trying to install a root CA on my system. For those wanting to audit the certificate generation and installation code, feel free to take a look at certmanager/get.go and certmanager/install_{platformname}.go. It is mostly self-contained and, I hope, easy to understand. The lack of any instructions on how to delete the certificate is an oversight on my part, and I'll be working on this. Regarding the binaries: all of them are built on GitHub's CI. I wish there was a way for users to verify this fact, but to my knowledge, there is no way to do that currently. You can run and build the app yourself using Wails (https://wails.io/docs/gettingstarted/installation). I'll be sure to add more instructions to the repo in the coming days.
As always, any feedback, help, and suggestions are much welcome.