alt Hacker News> ...my primary line of defence is AdGuard Home. By handling privacy at the DNS level...
To each their own, I guess, but that would be a hard pass from me. One example from mobile: FF on android keeps trying to connect to its various services (like firefox.settings.services.mozilla.net). For privacy reasons, I use NetGuard to block this and other similar domains. But there is a gotcha: there are sites (like seekingalpha.com) who refuse to load if access to these same domains is blocked - even on a completely different browser! With NetGuard I can still visit those sites in the secondary browser while blocking Mozilla tracking. With DNS blocking I wouldn't be able to do that.
NetGuard is a solid tool for Android, but managing a whole home lab is a different beast. I've got dozens of VMs and containers tucked away in Proxmox; if I tried to micro-manage per-app permissions for every single one of them, I’d never get anything else done.
I prefer to take the hit on those rare site-breaking edge cases if it means I have a single, transparent "source of truth" at the DNS level. It's definitely a trade-off, but I'd rather spend my time building things than perpetually tweaking firewall rules for every new service I spin up.