I thought that I finally found a best blocking software.
Well, it can block ads.
But it also adds its own root CA certificate to your system.
They also install a kernel extension, but this seems to be good, it is necessary to filter the traffic in a transparent manner.
Having a "fake" root CA certificate in the system is a terrible idea.
That means they (or anyone who has that certificate) can do MitM on all your HTTPS traffic (to Google, your bank, PayPal, etc.).
At is not required to filter traffic. You can implement exactly the same features with Little Snitch and a list from, for example, http://pgl.yoyo.org/adservers/.
So, I would not recommend anyone to use AdGuard because of the certificate installation.