4 ms·
Deterministic Browser
- derefr 9y agoI've been thinking about something similar: a deterministic bijection between the render-side CSSOM and the Javascript-accessible CSSOM. Page layout would happen twice: once with fingerprintable metrics for the renderer; and then once with deterministic metrics for the sake of metrics-juggling Javascript. On the Javascript side, you'd be handling "translucent number-like objects": things that act like numbers (you can do math to them and then pass them back into CSS APIs and the result will be correct), but where any conversion to regular integers or strings or anything else that could eventually exfiltrate will result in the deterministic (incorrect) version of the number instead. So, for example, a Javascript word-wrap algorithm would still work; as would a Javascript scroll-bar implementation (because they're both taking opaque metric-objects, doing math to them without casting, and then passing them back to the CSSOM.) But any analytics Javascript that wanted to know anything about the browser would just get standard stats out. The "deterministic output of casting metrics objects" is actually only necessary for legacy support, though. If you're willing to break things that cast/transmit .clientRect()s around, then you don't need the deterministic mirror-CSSOM; you just need an opaque Metric type you can do math to, with no option to cast it to anything else.
- im3w1l 9y agoThere are other clock sources than the javascript builtin though. Could ask an external server. Could intentionally create race condition and check who wins.