3 ms·

What terrible browser design to send all that data. I would never have imagined my computer was sending all that off 10 years ago

gowld 7y ago
It's doesn't "send the data" so much as "a general purpose UI platform cannot work unless a program knows the configuration of the UI". The idea that your complex computing environment could have an arbitrary complex conversation with an app, and not expose its identity, while perhaps desirable, it impractical. You can browser behind a generic user-agent firewall, but you'll get a severely degraded experience that treats an Apple watch the same as a desktop workstation.
- rovr138 7y ago
  Using the user agent string for this is not needed and is not common now for new projects.
  - lonelappde 7y ago
    Indeed, I didn't write "user agent string"; I wrote "user agent".
- skybrian 7y ago
  Standardization on only a few design variations might fix this? People would complain about monocultures, though.
  - dkarras 7y ago
    It's not just about design. For instance there is Canvas and WebGL for interactive content. Different GPU's draw things slightly differently. Someone creates a canvas in the background, draws stuff, reads it back and since your machine has a particular way of drawing things (because of GPU design, drivers, different browser implementations of the painting stack) you can be tracked. Same goes for audio capabilities. If you don't want multimedia, then fine, it is slightly easier. Then the server can probably try to track you with your upload / download speed, ping etc. They can tax your cpu to see how fast it is. Then they get your browser width / height. Combine them and you can be tracked pretty accurately. There are countless avenues for fingerprinting.
    - skybrian 7y ago
      Well, sure, but at the hardware level, more standardization is possible too. If you have a popular model of computer and it's the same as everyone else's computer, it's hard to get much out of identifying it. This is kind of what Apple does by offering a limited number of models. Another approach would be to use standardized VPN's that hide client machine differences. There are downsides, of course. I'm not sure people care about fingerprinting enough to do all that.
- ken 7y ago
  I didn't sign up for "a general purpose UI platform". I got on board when it was a hypertext publication system. They've been boiling this frog for 25 years. Every year, I'm less and less convinced that JavaScript is desirable to have in a web browser.
_bxg1 7y ago
I've heard of a similar phenomenon where hackers probing a system can fingerprint different software stacks based on what they get as responses to different "undefined behavior" inputs. Anything that communicates with the outside world is intrinsically giving up some information about itself.
maxerickson 7y ago
It was worse when flash and java were in common use.

gowld 7y ago

It's doesn't "send the data" so much as "a general purpose UI platform cannot work unless a program knows the configuration of the UI". The idea that your complex computing environment could have an arbitrary complex conversation with an app, and not expose its identity, while perhaps desirable, it impractical. You can browser behind a generic user-agent firewall, but you'll get a severely degraded experience that treats an Apple watch the same as a desktop workstation.

rovr138 7y ago
Using the user agent string for this is not needed and is not common now for new projects.
- lonelappde 7y ago
  Indeed, I didn't write "user agent string"; I wrote "user agent".
skybrian 7y ago
Standardization on only a few design variations might fix this? People would complain about monocultures, though.
- dkarras 7y ago
  It's not just about design. For instance there is Canvas and WebGL for interactive content. Different GPU's draw things slightly differently. Someone creates a canvas in the background, draws stuff, reads it back and since your machine has a particular way of drawing things (because of GPU design, drivers, different browser implementations of the painting stack) you can be tracked. Same goes for audio capabilities. If you don't want multimedia, then fine, it is slightly easier. Then the server can probably try to track you with your upload / download speed, ping etc. They can tax your cpu to see how fast it is. Then they get your browser width / height. Combine them and you can be tracked pretty accurately. There are countless avenues for fingerprinting.
  - skybrian 7y ago
    Well, sure, but at the hardware level, more standardization is possible too. If you have a popular model of computer and it's the same as everyone else's computer, it's hard to get much out of identifying it. This is kind of what Apple does by offering a limited number of models. Another approach would be to use standardized VPN's that hide client machine differences. There are downsides, of course. I'm not sure people care about fingerprinting enough to do all that.
ken 7y ago
I didn't sign up for "a general purpose UI platform". I got on board when it was a hypertext publication system. They've been boiling this frog for 25 years. Every year, I'm less and less convinced that JavaScript is desirable to have in a web browser.

_bxg1 7y ago

I've heard of a similar phenomenon where hackers probing a system can fingerprint different software stacks based on what they get as responses to different "undefined behavior" inputs. Anything that communicates with the outside world is intrinsically giving up some information about itself.

maxerickson 7y ago

It was worse when flash and java were in common use.