If uBlock Origin + Privacy Badger give you too many problems, what you are after is a worse setup. You want a less aggressive system that allows the ad-tech that those sites are relying on to work, which will also allow that ad-tech to display some ads and invade some privacy, but its a perfectly reasonable choice.

Personally, I use uBlock Origin + Privacy Badger (and NoScript for work, per policy). In most cases, if a site doesn’t work I’ve realized I really don’t want to be there (and the Internet is likely better off without adding my rant to the comments section of that click bait article I really shouldn’t be wasting my time with). It is fairly rare to find a broken site and rarer still to actually need to use it (airlines are the worst), so I don’t sweat the time to temporarily disable protection or work out the white list.

I recommend multiple layers. Why? Because some devices/apps will circumvent one of these layers one way or another.

I use Pi-Hole plus WireGuard to route all my devices through my home broadband connection (so even on a hotel/train WiFi, when on LTE, etc). I forward it to Unbound which uses DNSSEC and DNSCrypt. I’m using an EdgeRouter Lite for that purpose. It does add a little bit of latency, but I don’t mind, as it also increases my privacy on the insecure link. It also works on say a smart TV or an official Android device (I use a rooted Android device with microG which doesn’t implement GAds). My partner sees barely any ads at home due to this setup (I did not bother to setup WireGuard on her smartphone as of yet).

On each individual client device I also use a layer 7 firewall (“personal firewall”). On macOS I use Little Snitch and LuLu. On Linux I use OpenSnitch. I don’t use Windows, but if I would I’d at least remove all the tracking stuff (for example with O&O ShutUp). On Android, I don’t use a layer 7 firewall which is my bad.

For browser, on every OS I use a configured Firefox (which I did NOT document; my bad!) with a bunch of addons. uBlock Origin (mainly to manually block “you are blocking ads” notices). I use uMatrix, Cookie AutoDelete, Smart Referer, Privacy Badger, Decentraleyes, HTTPS Everywhere, containers for Amazon/Facebook/Google (would like to add Microsoft), CanvasBlocker, Tracking Token Stripper, Forget Me Not, Terms of Service; Didn’t Read, and Buster: Captcha Solver for Humans.

uMatrixwillbreak the web. However it is more user-friendly than NoScript ever was. You are going to have to configure such. For websites you regularly use, you can save the temporary changes, or just not use such bloated websites. Also, I recommend the addon Dark Reader and the feature Reader Mode.

To test your setup on your browser, try ipleak.net. One of the things I configured in Firefox, is to disable WebRTC. I don’t use an addon for that.

Thebestsetup acc to me for web is Firefox + uMatrix + CanvasBlocker + WebRTC Blocker + DecentralEyes + HTTPS Everywhere + Smart Referrer + StartPage / DuckDuckGo + any DNS over HTTPS provider of your choice. Be prepared for the recaptcha time sink. You could turn on Firefox’s resistFingerpriting setting, too. Use Brave or Bromite as an alternative browser for websites that break.

For phones, you could run DNSCloak with AdGuard DNS (iOS) or Blokada (Android). There’s AdGuard Pro, Lockdown Firewall, and Guardian VPN+Firewall for iOS that are super neat.

NoRoot Firewall, NetGuard, and GlassWire Firewall for Android that I’ve found to have acceptable privacy policies. LittleSnitch or LuLu Firewall for Mac, GlassWire Firewall for Windows are some of the other options.

Pi-Hole your routers too for other devices connecting to Internet.

>Be prepared for the recaptcha time sink.

You can marginally reduce the recaptcha “problem” by using the Privacy Pass extension, though I can’t speak to whether there’s a net loss of privacy by using it.

I have “pi-holed” my openbsd router using both ip blocklists for the firewall and dns blocklists for unbound that refresh automatically every night.

All my clients run firefox with ublock origin and https everywhere. I ran no script for a while but it is quite painfull to manually allow scripts on a lot of pages so I think I have found a nice balance. I have also turned off wasm support in firefox.

If a site doesn’t work with the above or shoves large nasty inline popups with “we value your privacy” etc and do not show a clear reject button I leave.

edit: I also pay subscription to most of the websites I use often that support payment and if they don’t I email them and tell that I don’t want ads and that I’d like to pay for it. Usually one can come to an arrangement.

As someone not very knowledgeable with the issues associated with web assembly, may i ask why have you disabled it?

Would you be willing to share your auto-updating method? I created my own but I’m curious to see other methods.

I have the exact same setup with OpenBSD (pcengines router) and Firefox + plug-ins but the inconvenience of using NoScript outweighs the JavaScript garbage that gets through without it.

On macOS I mostly use LittleSnitch, with a few lists, then manually add trackers and calls to weird domains made by apps that shouldn’t make them. Upside is, it’s system-wide.

Wrote a post about thathttps://weekly.elfitz.com/2019/02/12/block-ads-and-trackers-…

But the best setup (still haven’t done it) would probably be pi-hole, remotely accessible over some vpn (because you don’t want to manage what would otherwise amount to a publicly accessible DNS server). It would cover all your apps and devices.

The only problem I’ve encountered with nextdns is they went down effectively taking out internet and no one at home knowing how to mitigate it.

Otherwise, a good value prop, provided you turn off their logging feature that captures client-ip among other metadata.

Also, keep in mind that you could run Pi-Hole on a VPS and split-VPN only DNS traffic through it:https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/DO charges $5 for 1TB traffic and a decent amt of compute, which ought to be enough for 500 or more (?) devices worth of DNS traffic.

+1 for nextdns. I’ve been using them since they were first posted to HN, and have had zero issues and enjoyed the ease of use. The iPhone app gives me the capability to block specific services while nextdns is in use (Facebook, Google, etc) and to easily disable it for the few moments I actually need to access certain platforms.

Looking at their site, it seems complicated to set up.

What is the difference between IPv4, unbound, stubby, knot, and cloudfared – do you set one, or all of them? Do I want DNS over HTTPS, DNS over TLS, or both? Is it compatible with a VPN?

For the trouble, it looks like it wouldn’t be any harder to just set up your own Pi-Hole. Am I wrong?

I understand where you come from, but I’d say they’ve made a good job of simplfying as much as they could at this early stage.

Use DNS over HTTPS for:

1. Firefox.

2. Intra app on Android phones below version 9.

3. Clouflared on Linux.

4. Their official iOS app.

Use DNS over TLS for:

1. Android 9 and above.

2. Knot or Stubby or unbound clients on Linux.

IPv6 and IPv4 are for DHCP provided DNS:

1. With IPv4, you’d need tolinkyour client-ip (public IP of your router) with your nextdns setup.

2. IPv6 doesn’t require any suchlinked-ipacrobatics.

Re: VPN:

If you use DNS over HTTPS on Android or iOS, you won’t be able to use a VPN, and that’s because the DNS traffic is itself routed through a VPN and one can’t chain VPNs on Android just yet. Other than that, VPN should work with rest of the setup mechanisms.

Wow, what a creative use of IPv6 to allow a custom configuration without the use of DNS-over-HTTPS.

DNS over HTTPS, DNS over TLS, and DNSCrypt are all abt preventing DNS manipulation attacks and encrypting the DNS traffic to the resolver (if not till the nameserver). Plain old DNS over UDP/53, IPv6 or not, can’t be a substitute for that, afaik.

Do you use anything else in conjunction with it? Or NextDNS alone is enough?

I ask because it seems simple enough that I can just install it really quickly on non-technical people’s computers (when they ask me for help) without bothering to downloading a bunch of extensions on different browsers, updating stuff, etc, etc…

Nextdns is enough, but uBlockOrigin or uMatrix would be more effective for the web, along with DecentralEyes, CanvasBlocker, WebRTC Blocker, SmartReferrer, and other such extensions.

Also, aggressive blocking can cause some websites and apps to break. dns.adguard.com (DoT) andhttps://dns.adguard.com/dns-query(DoH) whilst not aggressive don’t break as many websites and apps, and would remain free to use. Nextdns would cost you $1 a month if you need more than 500k queries once they’re out of the beta stage.

I’m curious, what websites are breaking for you? I use the same (+ Facebook Container) and I rarely notice breakage. PrivacyBadger is the only one that’s broken something for me before (image links from a CDN), I can’t recall uBlock Origin ever breaking a site for me unless the site has an anti-adblocker.

If you’re talking about the “please disable your adblocker to continue” messages, you can consider something like Anti Adblock Killer [1] which can help bypass those kinds of blocks.

As far as the best setup I think what you have is fairly close to “the best” already without getting more hands-on. You can check out Pi-hole which I’ve heard is superior, but harder to setup [2].



Off the top of my head, disabling uBlock has been the only way to unblock on-and-off trouble with some ATT-owned websites (ATT’s own website, ATTWatchTV.com, etc) and owner.ford.com (original, the beta works fine).

My experience has been generally good, but weird stuff (especially authenticating/login) just won’t work sometimes with uBlock and Privacy Badger running.

I also use the HTTPS everywhere Chrome extension, so perhaps that is an added factor that breaks things.

Same setup here, zero problems encountered. Maybe there’s a custom blocklist that gives problems?

Might not be the best setup, but this gives me minimal issues.

1/ Chrome browser with extensions – Disconnect (https://disconnect.me/), Ad blocker, and Anti-Adblock killer script with Tamper monkey.

2/ Cookies disabled by default.

3/ Any sites which refuses to function without them, open in incognito or guest window.

This gives me minimal problems. Most of the tracking is out via Disconnect, many ads are blocked automatically, and the remaining ones I block manually. I will definitely be tracked by a few websites and third-parties, but this gives me a better balance than just focusing on complete block.

To add to it, google provides you an option for not recording searches and location. Also, keep deleting cookies regularly for the ones you have enabled.

I’m mildly surprised that no one has mentioned [Better](https://better.fyi). Works very well for me.

The pitch:

Better uses our own list of blocking rules, curated and
maintained by Ind.ie. We use the principles of Ethical
Design to decide what should be blocked. This is our
only blocking criteria, advertisers cannot pay us to
compromise our integrity and unblock them.

Better does not block respectful ads. Respectful ads
respect human rights, human effort, and human
experience. For an example of respectful ads, see
The Deck network, winner of our first Cloud of Fame award.

Edit: I forgot to mention the most important piece: When a site says that it won’t work without JS, I accept this and close the tab. Unless it’s Google Maps.

My browser has built-in URL-based filters.

I browse with JS disabled except for a handful of sites, which I enable for the session whenever I need it.

My browser makes it easy, with a three-key shortcut to toggle it.

This is about the extent of it.

I used to use uBO, which I still think is great, and enough for more Chrome and Firefox users. Many blessings to its maintainer.

Although this isn’t exactly blocking, I tend to use Reader View a lot these days. I installed an extension that allows to force using it for any page, and I wish that FF made it default.

General advice: make sure you have a solution on all platforms. TV, IoT, phone on wifi, phone on mobile network, etc…

At home you need to first subvert your ISP.

Make sure you have a router doing blocking, like a PiHole. For mobile devices always use a VPN and DNS protection like dns-crypt. Use Cloudflare’s mobile DNS over HTTPS solution even though that’s a single point of failure, decide for yourself how risky you think that is.

Besides browser specific plugins you should implement a host block. The host block lists are not too exhaustive so if you use dns-crypt configure it to log every dns request and add any new hosts to your block list that look surprising.

It’s a lot of work, but if that’s what you’re looking for you may find some fun ways to automate this workflow 🙂

The best setup is cli browser links or lynx.

Next best is Firefox with uBlock Origin, uMatrix, Privacy Badger, Cookie Autodelete, Decentreleyes, and a bunch of about:config alterations. Some sites will break. If a site breaks I either forget about it or open it in incognito.

I use a slightly customized version of the Energized Protection[1] block list, which acts as a DNS sinkhole but is really just a text file that you paste into /etc/hosts. Before that I was using Pi-Hole but I found it too cumbersome to maintain properly. (Additionally /etc/hosts entries are way easier to scan, modify and verify for non-maliciousness IMO.)

In my browser I use uMatrix since it gives me fine-grained control over what websites can do. I have very strict default policies that break most sites but you can set them to whatever you want.

Additionally I’ve written my own regex-based request blocker[2] for YouTube midroll- and page ads since I don’t trust other, more opaque ad blocking solutions that handle those (like AdBlock Plus). It does break all other Google services I’m aware of however. (Which I could patch but I don’t really mind.)


Oh and I also changed some defaults in Firefox’s about:config to disable some integrated services that are likely to include tracking and tracking-vulnerable web APIs. I do realize that this might make me more fingerprintable though.

No, I don’t, but years ago [eons], hosts files tended to redirect to, which does incur a penalty. Directing to [invalid IP] does not (or not any more).

Not at all.

I also just checked via dig if there is any slowdown and dig didn’t report any. (I first queried google.com with the large hosts file, then replaced the hosts file with a default one, cleaned my DNS caches and requeried and it didn’t show any speedup.)

Furthermore, I don’t know how Pi-Hole works internally so I don’t know if it’s somehow specially optimized compared to /etc/hosts or implements any caching strategies but wouldn’t introducing another server in your DNS chain slow things down more than /etc/hosts which is always present anyways?


You block domains at the dns, you can download a variety of block lists and you can also create your own. You can log the dns lookups to find out what domains are being used which can be used to further create a block list.
The advertising code and tracking code never gets downloaded. Runs on the window pc so you don’t have to worry about making changes to anything else upstream, great for laptops and road warriors who use a variety of internet connections.

For mobile I usehttps://blockerdns.com/(full disclaimer: that’s my creation). It’s ad blocking through DNS-over-TLS on Android 9 and above.

For home I just run my own bind DNS servers internally. And then for friends and family I have them set their routers to a couple bind DNS servers (same config as my internal ones) in the cloud.

For all of the above I use the same block list. It currently has about 25k entries, and is built with some data from a few of the well known public lists. But I augment that with domains I find by regularly auditing specific websites that are particularly aggressive with ads and specifically trackers.

But with that said, since I’ve got friends, family and paying users working from that list, I do actively try to prevent the breaking of popular sites and services. For example, personally I’d outright block anything related to Facebook since I quit them years ago, but too many people still use it, so for my list I try to keep a good balance by blocking their pixel and stuff like that, while allowing the resources absolutely necessary for the site.

Credible effort. You should add a section abt latencies, too.

There are free alternatives. So, you might need to provide extra value-add for the $1 (I understand no-logs is a value-add).

If I may ask, how does the tech stack look like? And what’s the software run for DoT and DoH

>ad blocking through DNS-over-TLS on Android 9 and above.

FYI, dns.adguard.com does more or less the same thing, and is free.

>full disclaimer: that’s my creation

Small observation: when you disclose something, it’s a disclosure.

Currently using Brave Browser, AdBlock Plus and Privacy Badger. For my daily usage, I only have a few sites I need to whitelist.

What does ABP and PB add to Brave? I have used Brave for several months and found it to be excellent from a speed perspective. I sort of always assumed that if it’s able to go that much faster than Chrome, it must be blocking most of the nasty trackers. But perhaps I still need to add in some reinforcements?

I think ABP on top of Brave is overkill. I always used uBlock Origin on Chrome and that worked better for me than ABP. Now that I’ve switched to Brave, I don’t have anything additional installed, and I feel like it’s blocking almost all of the ads and definitely all of the tracking (in fact, Brave’s anti-tracking is sometimes a bit too aggressive and blocks normal function of sites, so I have to disable it on occasion).

My setup is Firefox with the usual about:config modifications (search for it)


Ad Nauseum

Smart Referer

Decentralized Eyes

https everywhere

Cookie autodelete

VPN with ipv6 turned off since they don’t reroute that

With uMatrix I also block all first party cookies and scripts by default and white list as needed.

This only breaks websites the first time you visit them. Only thing that becomes an issue is uMatrix but as you Whitelist the sites you need it just ends up not being a big deal.

Very similar to what I have. May I recommend using containers? It works wonders and gives me peace of mind.

I use that setup + a hosts block file, and i recently started using a pi-hole. I also use stylus to block a few custom elements and change themes for a few sites. I mostly visit news sites and some random sites.

The only issues i have had have been on pinterest.
What sites do you have issues on?

Well thank you good to know, ill have to start experimenting to see how well it meets my needs.
I mostly use stylus to to dark theme sites , remove side bars footers and headers, then expand the main article column to be 80 – 100% of the page. I really enjoy just reading an article with no distractions. (reddit is a pain)

I posted this somewhere else before, so I will just repost as the answer did not change that much.

I use Safari with JS and cross-tracking disabled on macOS and iOS, Firefox with a custom user.js on elementaryOS. I enable JS only when necessary — looking at you, Help Scout.

For actual blocking, I run a Pi-hole on a VPS that connects to multiple DNSCrypt servers that I control, which block everything I want while improving privacy. Planning on replacing Pi-hole with AdGuard Home for DNS over HTTPS and DNS over TLS, since I want to have this server public at some point, for others to use.

If anyone is interested in testing, shoot me an email at [email protected] No logging, DNSSEC, disk encryption, Canonical Livepatch, 24/7 monitoring and completely open source.


I’m also curious about this. A couple years back, I switched from ‘AdBlock Plus’ to ‘uBlock Origin’ and the difference was night and day (it blocked SO many more ads).

I’ve been out of the game for awhile, so I’m wondering what beats uBlock nowadays… Any recommendations?

What you noticed was not really a meaningful difference between the two extensions, but just a difference in the default ruleset subscriptions—which you can manage independently.

AdGuard for Android works fairly well.
I may spring for the premium version.

Elsewhere I use LittleSnitch on my Mac, followed by Firefox (w/associates plugins like everyone else).

I’m using that exact setup and I can’t remember when it broke anything. Now uMatrix breaks everything, but that may be for the best. If the modern web is working, you’re the product.

Cookie Autodelete is a good one. Simple to configure what cookies you want. Doesn’t get in the way while still deleting the cookies you don’t opt to keep.

so, this isn’t for everyone, but I like the uBlock Origin + uMatrix combo.

This will break a lot at first, but uMatrix allows you to build a whitelist easily, and slowly over time website won’t be broken half as much, and it’ll be exceptionally rare for you to have to disable the whole extension whenever you want things to get working again.

The basic functionality of uMatrix is actually built into uBlock Origin. That’s the setup I use. I have all 3rd party scripts and frames blocked by default and allow them on a per-site basis as required. After a while you get a sense for which domains need to be let through for a site to work

PiHole + Little Snitch + JSBlocker on macOS Mojave

JSBlocker is cranked up to to the max – no inline JS, or frames or videos, etc. Then as I go about info surfing I progressively enable services that are vetted like some content delivery services, common JS frameworks, etc.

Makes the web actually tolerable.

I’d recommend starting with Firefox, and configuring Firefox’s cookie settings to always block third party cookies.

Next, if you have a good password manager that can auto-fill logins, set Firefox to delete all cookies (and everything else) when you close the browser. That way, every time you open your browser you’re starting from a clean slate. I promise you’ll quickly get used to logging in every time, and it won’t be that hard.

Next, enable Firefox’s Multi-Account Containers add-on. This basically allows you to isolate sites you commonly use into their own cookie realms. Create containers for the sites you want to isolate (Google, Facebook, LinkedIn, etc.) and set those domains to always open in that domain’s container. That way, when you click on a link to Facebook it will auto open a new tab in that Facebook container.

Next, install uBlock Origin. I don’t think there’s a need to install Privacy Badger since you’re already blocking third party cookies, but others please correct me.

Next, for websites that don’t work with uBlock Origin, create a dedicated container for that domain and set to always open in that container. Then, whitelist in uBlock Origin whatever tracker on that site you need to run things properly. That way, the tracker is isolated to just that domain’s container.

Overall, Firefox’s Multi-Account Containers are extremely powerful for isolating site cookies and trackers. I wish they would allow you to set different cookie settings per container, so you could by default clear cookies when you close Firefox and add exceptions for specific containers, but even given that deficiency, is still the most powerful browser feature that’s come out since tabs.

Check out the no script Firefox add on. If u go to a website that pops up a big screen saying disable ad block u can right click the screen blocking and remove it and bam website works perfect

I honestly get relatively little site breakage; so I’m just fine with that. But if you’re having issues I would suggest reek anti-adblock killer.

The following doesn’t break my everyday browsing:

uBlock Origin,
DNS over HTTPS (currently Cloudflare, but plan to use my own resolver soon)

pi-hole over ZeroTier so I can get it wherever I am and latest Firefox with the most secure custom privacy setup. Nothing seems to break but I don’t use things like Facebook and Twitter so wouldn’t know about them (seems pointless to try to stay private if you’re on them anyway.)

Setups which are data sinks giving minimal info about end users are the best.

If you outsource processing/filtering, that data has commercial value eventually.

I have a multi-tiered adblocking environment at home and abroad.

At home, I have AdGuardHome installed in a VM acting as my home network’s DNS. It’s pretty effective and is an alternative to PiHole. This is a first-tier filter I have while at home for all my devices.https://github.com/AdguardTeam/AdGuardHome/

On the web browser, I have the AdGuard Firefox extension.https://adguard.com/en/adguard-browser-extension/firefox/ove…

For my mobile phone, it’s a little obtuse but relatively straightforward. I have a non-rooted Android phone. I’ve installed AdGuard for Android there as well. The way it works is it runs a local VPN on my phone, so all device traffic goes through a localhost proxy, which filters the DNS and unencrypted TCP traffic. For HTTPS filtering, it installs a local TLS CA to perform re-signing of websites (you can configure it to ignore EV certificates, as I have, which are more common with online banks and more secure sites). It works pretty well with exception to apps that have built-in ad platforms like Instagram. It blocks 100% of ads in apps like Wunderground, Reddit, and Firefox.https://adguard.com/en/adguard-android/overview.html. There’s also an iOS version of the app on their website.

I have a Google Play Music subscription which comes with YouTube Premium. However, more and more YouTubers are diversifying their revenue, and have gone to completely sponsored videos with embedded ads. For sponsored clips in YouTube, SponsorBlock extension:https://github.com/ajayyy/SponsorBlock

Decentraleyes [sic] is another extension that I use primarily on my phone, but also at work. It allows the web browser to use local versions of CSS/JS frameworks and fonts that would otherwise have to load from CDNs that track your requests. Things like jQuery, Bootstrap, AngularJS, FontAwesome, etc. are all loaded from local copies through this extension. This benefits the user by saving bandwidth and page load time as well as stopping unwanted tracking from the remote party.https://addons.mozilla.org/en-US/firefox/addon/decentraleyes…

Don’t Fuck With Paste. This extension prevents websites from disabling pasting in form fields. Extremely useful when you are using a password manager to enter form data or just copying and pasting from another location. Websites that break paste are just as bad as websites that serve ads in my book.https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi…(it’s also available for Chrome).

If you know someone or you yourself actually still use Facebook, I also highly recommend Social Fixer. Not only does it block Facebook ads and other page elements, but it lets you keep track of other events like who unfriends you. It has a lot of options and I’ve been using it for years.https://socialfixer.com/

Worth checking out are NoScript extension, PiHole, and UBlock Origin. I don’t use these but I’ve heard good things about them and everyone seems to recommend them.

I use uBlock Origin and disable JavaScript by default, then instead of enabling those things when sites break, I choose to be more discerning about the websites I visit instead.

Read More


Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.