You either whitelist them or stop using them. Whitelist is by script domain, so the ads usually still don't load. Until you have to whitelist *.cloudfront.net

Hmm, that sounds like something that would work best in the same way that ublock premade blocklists work, by crowdsourcing whitelisting?