first-party trackers (CNAME Cloaking)

[rusty-snake]

current situation

First-party-trackers are blocked by the fp-trackers list. (Huge list)

what I have in mind

CNAMEs are matched against the nextdns list.

[netblue30]

Done! Most of them were however in tracker list, not in fp-tracker list, so I had to move them around.

It works this way:

1. go to https://trackingthetrackers.com/
2. enter weather.com and press analyze
3. it comes back with

   weather.com.ssl.sc.omtrdc.net is hiding behind sodc.weather.com.

   We should mark as fp-tracker any of the two domains,

[rusty-snake]

IDK if you misunderstand me or I did not see the changes. My idea is to drop the fp-tracker list in its current form and replacing it with the from nextdns.

Example:

$ dig @9.9.9.9 prophet.heise.de
;; ANSWER SECTION:
prophet.heise.de.   8050    IN  CNAME   heise02.webtrekk.net.
heise02.webtrekk.net.   78  IN  A   185.54.150.27

If 9.9.9.9 would be 127.1.1.1 the answer would be 127.0.0.1, because fdns has matched the request send to it against fp-trackers (and others) and found prophet.heise.de in this list. With my proposal: 127.0.0.1 will be returned because fdns matched the upstream answer (the CNAME) against the nextdns list which contains webtrekk.net.

[netblue30]

All done. So we look for CNAME entries and drop them if there are for the . I left the original fp_tracker list in. The lookup in the list is very fast, about 10 microseconds on an old computer. We have about 60k entries total (with adblocker etc.).

The list is hardcoded for now, we can split it up in a file in etc directory later.

https://github.com/netblue30/fdns/blob/master/src/fdns/filter.c#L442