7 ms·

Why does a webpage get to know how many CPU cores I have?

by wlesieutre 6y ago

tomg 6y ago
window.navigator.hardwareConcurrency [edit: well this is more of a 'how' than a 'why']
- Sephr 6y ago
  The answer to why: It helps with efficient allocation of worker thread pools. I helped make a timing attack[1] as justification for adding this API, and then presented this suggested API to each browser vendor along with the timing attack. The result was that every browser has adopted my suggestion. If this API was not present, ads could get this data in a more resource-intensive manner anyways. 1. https://eligrey.com/blog/cpu-core-estimation-with-javascript/ https://eligrey.com/blog/cpu-core-estimation-with-javascript...
  - simias 6y ago
    Ahah, I like the "give up" approach to fighting browser fingerprinting! "If ads can track us, we might as well make it efficient".
    - moron4hire 6y ago
      The threshold of information needed to gain reliable fingerprintability is so low that we could rewind the browser development clock 20 years and still be nearly 100% identifiable. We'd gain nothing in terms of privacy, but we'd lose everything in terms of the first and only application platform that runs on every system short of a greeting card, is free to use, easy to use, not tied to an app store, not tied to a single vendor.
      - AnthonyMouse 6y ago
        The original sin of the web is that the code comes from the server again every time you run it. That means you need robust sandboxing and anti-fingerprinting etc., because you're running potentially hostile code that nobody has been able to audit. Other types of programs don't have that problem. If you get some code from Github, you can review it yourself before the first time you run it. Then every time after that, it's still the same code so you only have to do it once. And you can have someone you trust do it for you, like a Debian package maintainer. But with nobody reviewing the code, the machine has to do it, i.e. there have to be a bunch of technical constraints on tracking and malicious behavior. It's a terrible rubbish fire that we don't have any kind of real application platform for real applications that runs the same on every system and doesn't have a monopolist dictating terms. We should fix that. But we could fix that, and be better off than by giving up and conceding the world to surveillance dystopia.
        TeMPOraL 6y ago
        > Other types of programs don't have that problem. Well, they didn't. They do now, as you're expected to update everything continuously. A typical user of a PC or a smartphone has something downloading an update pretty much every day. Even a tech-savvy user can't hope to keep up with trying to track down all sneaky automatic updates and read a changelog before applying them (assuming there even is one, beyond "This update improves experience and fixes bugs" zero-information boilerplate). At this point I'd be willing to pay for a service that would intercept all automatic updates on my devices and warn me about the ones that bring in telemetry, malware, performance degradation or other misfeatures. Unfortunately, such a service would require impossible feats of crowdsourcing to keep up with the deluge, and itself would be a huge privacy/security risk.
        AnthonyMouse 6y ago
        Aren't you just describing a package manager or an app store? The reason mobile app stores are garbage is that the store is glued to the platform, making it high-friction to switch to another one if they do a bad job. Then they do a bad job by allowing things you don't want and prohibiting things you do want (and charging high fees etc.) and get away with it. There is no reason for this to be centralized into a single approver. If you got 90% of your software through the Debian package manager but specifically need a newer version of Blender than they package, you could get that in particular directly from the Blender developers because you trust them not to intentionally distribute malicious code, while still relying on the package maintainers to do the work for all the other software you use. That's possible right now on Linux. The problem is mostly that it's not possible right now on everything.
  - seniorgarcia 6y ago
    So... you are an "expletive deleted"? Actually you are an "expletive deleted" that is fine with his work used in fingerprinting. "If we would not have provided this API, ad providers would have gotten it anyways"... Unless, maybe websites do not need to know how many worker threads I can provide and your spec is part of the problem. Maybe you are part of the problem. Pretty ironic that your last tweet was: >Federated Learning of Cohorts is harmful to your privacy. This is literally additional tracking. Nobody is asking for this except for advertisers. Ad networks should target their ads based on the content being viewed, not on the person or 'cohort' viewing the content.<
    - moron4hire 6y ago
      I actually use this feature for a VR app I'm building. I'm so sick of the privacy fetishism. You're fingerprintable, ok. You're so fingerprintable that to make you not fingerprintable, we'd have to make browsers only do static document retrieval. Oh, wait, no, not even that would really be enough. Your IP address plus the pages you visit at which times of day is enough. The browser hasn't been a document-reading platform since CGI was invented. What is that, 30 years now? You don't like that apps are built in browsers? I don't care. Functionally nobody cares. If we couldn't, we'd be building Java apps instead, someone would have invented an open source, live, searchable, distributed system for finding apps, and then you'd still be fingerprintable. Go sit in a cave if you don't want anybody to know who you are. The rest of us have work to do.
      - seniorgarcia 6y ago
        And I do not get this at all. For my desktop you would get 12, I'm on a i7-8700k with a base frequency of 3.7GHZ and a permanent boost of 5.1GHZ. This rig runs Oculus VR/Steam VR all the time. If I ran that site from my Surface laptop the response would be 12 as well. The 12 cores on my surface boost is 12 1.3GHZ cores though if they boost. The cooling might work out to boost 2 cores to 1.9GHZ. Or however the Intel boosting works out in this thermal constraint. So, what is the useful info you get for your VR app from these values?
        6y ago
fred123 6y ago
Reported by the browser but not always accurate. Used in browser fingerprinting btw
- Macha 6y ago
  Yeah, I have a 12C/24T cpu, my browser appears to report 16 cores.
moron4hire 6y ago
So I can know how many worker threads to create before it's just a waste of thread scheduling
seniorgarcia 6y ago
https://developer.mozilla.org/en-US/docs/Web/API/NavigatorConcurrentHardware/hardwareConcurrency https://developer.mozilla.org/en-US/docs/Web/API/NavigatorCo... There is no good answer to why, except to improve fingerprinting. Which is most of what this site shows, the amount of data a site, even open in the background, can use to continuously fingerprint you. Or maybe I misjudge what this is supposed to do.
- moron4hire 6y ago
  You've been given several good answers as to why, you just refuse to believe anything anyone is telling you.
  - seniorgarcia 6y ago
    I believe that you think that your answers are true but my desktop will report 12, my work laptop will report 16, my macbook will report 16 as well, my work desktop will report 64 (my surface laptop will report 12 as well, my ipad pro will report 6... I can continue this for some time). Which machine do you think has the best performance for your app?
    - moron4hire 6y ago
      I don't care. You picking the machine is up to you. I only care about giving the best performance on whichever one you've chosen.
    - deleted 6y ago
      [deleted]
    - jtsiskin 6y ago
      Those numbers actually mean something. That’s approximately how many concurrent threads I would want to use. I’m not sure I follow the point you’re making
- judge2020 6y ago
  I bet it helps for some niche apps like webgl/webgpu games.
umaar 6y ago
There does seem to be a fingerprinting angle on it, but I wrote about using CPU, Battery, Memory etc. to be consideration over how much JavaScript you load for your users: https://umaar.com/dev-tips/242-considerate-javascript/#load-javascript-when-the-device-has-enough-cpu https://umaar.com/dev-tips/242-considerate-javascript/#load-...

Why does a webpage get to know how many CPU cores I have?

tomg 6y ago

window.navigator.hardwareConcurrency [edit: well this is more of a 'how' than a 'why']

Sephr 6y ago
The answer to why: It helps with efficient allocation of worker thread pools. I helped make a timing attack[1] as justification for adding this API, and then presented this suggested API to each browser vendor along with the timing attack. The result was that every browser has adopted my suggestion. If this API was not present, ads could get this data in a more resource-intensive manner anyways. 1. https://eligrey.com/blog/cpu-core-estimation-with-javascript/ https://eligrey.com/blog/cpu-core-estimation-with-javascript...
- simias 6y ago
  Ahah, I like the "give up" approach to fighting browser fingerprinting! "If ads can track us, we might as well make it efficient".
  - moron4hire 6y ago
    The threshold of information needed to gain reliable fingerprintability is so low that we could rewind the browser development clock 20 years and still be nearly 100% identifiable. We'd gain nothing in terms of privacy, but we'd lose everything in terms of the first and only application platform that runs on every system short of a greeting card, is free to use, easy to use, not tied to an app store, not tied to a single vendor.
    - AnthonyMouse 6y ago
      The original sin of the web is that the code comes from the server again every time you run it. That means you need robust sandboxing and anti-fingerprinting etc., because you're running potentially hostile code that nobody has been able to audit. Other types of programs don't have that problem. If you get some code from Github, you can review it yourself before the first time you run it. Then every time after that, it's still the same code so you only have to do it once. And you can have someone you trust do it for you, like a Debian package maintainer. But with nobody reviewing the code, the machine has to do it, i.e. there have to be a bunch of technical constraints on tracking and malicious behavior. It's a terrible rubbish fire that we don't have any kind of real application platform for real applications that runs the same on every system and doesn't have a monopolist dictating terms. We should fix that. But we could fix that, and be better off than by giving up and conceding the world to surveillance dystopia.
      - TeMPOraL 6y ago
        > Other types of programs don't have that problem. Well, they didn't. They do now, as you're expected to update everything continuously. A typical user of a PC or a smartphone has something downloading an update pretty much every day. Even a tech-savvy user can't hope to keep up with trying to track down all sneaky automatic updates and read a changelog before applying them (assuming there even is one, beyond "This update improves experience and fixes bugs" zero-information boilerplate). At this point I'd be willing to pay for a service that would intercept all automatic updates on my devices and warn me about the ones that bring in telemetry, malware, performance degradation or other misfeatures. Unfortunately, such a service would require impossible feats of crowdsourcing to keep up with the deluge, and itself would be a huge privacy/security risk.
        AnthonyMouse 6y ago
        Aren't you just describing a package manager or an app store? The reason mobile app stores are garbage is that the store is glued to the platform, making it high-friction to switch to another one if they do a bad job. Then they do a bad job by allowing things you don't want and prohibiting things you do want (and charging high fees etc.) and get away with it. There is no reason for this to be centralized into a single approver. If you got 90% of your software through the Debian package manager but specifically need a newer version of Blender than they package, you could get that in particular directly from the Blender developers because you trust them not to intentionally distribute malicious code, while still relying on the package maintainers to do the work for all the other software you use. That's possible right now on Linux. The problem is mostly that it's not possible right now on everything.
- seniorgarcia 6y ago
  So... you are an "expletive deleted"? Actually you are an "expletive deleted" that is fine with his work used in fingerprinting. "If we would not have provided this API, ad providers would have gotten it anyways"... Unless, maybe websites do not need to know how many worker threads I can provide and your spec is part of the problem. Maybe you are part of the problem. Pretty ironic that your last tweet was: >Federated Learning of Cohorts is harmful to your privacy. This is literally additional tracking. Nobody is asking for this except for advertisers. Ad networks should target their ads based on the content being viewed, not on the person or 'cohort' viewing the content.<
  - moron4hire 6y ago
    I actually use this feature for a VR app I'm building. I'm so sick of the privacy fetishism. You're fingerprintable, ok. You're so fingerprintable that to make you not fingerprintable, we'd have to make browsers only do static document retrieval. Oh, wait, no, not even that would really be enough. Your IP address plus the pages you visit at which times of day is enough. The browser hasn't been a document-reading platform since CGI was invented. What is that, 30 years now? You don't like that apps are built in browsers? I don't care. Functionally nobody cares. If we couldn't, we'd be building Java apps instead, someone would have invented an open source, live, searchable, distributed system for finding apps, and then you'd still be fingerprintable. Go sit in a cave if you don't want anybody to know who you are. The rest of us have work to do.
    - seniorgarcia 6y ago
      And I do not get this at all. For my desktop you would get 12, I'm on a i7-8700k with a base frequency of 3.7GHZ and a permanent boost of 5.1GHZ. This rig runs Oculus VR/Steam VR all the time. If I ran that site from my Surface laptop the response would be 12 as well. The 12 cores on my surface boost is 12 1.3GHZ cores though if they boost. The cooling might work out to boost 2 cores to 1.9GHZ. Or however the Intel boosting works out in this thermal constraint. So, what is the useful info you get for your VR app from these values?
      - 6y ago

fred123 6y ago

Reported by the browser but not always accurate. Used in browser fingerprinting btw

Macha 6y ago
Yeah, I have a 12C/24T cpu, my browser appears to report 16 cores.

moron4hire 6y ago

So I can know how many worker threads to create before it's just a waste of thread scheduling

seniorgarcia 6y ago

https://developer.mozilla.org/en-US/docs/Web/API/NavigatorConcurrentHardware/hardwareConcurrency https://developer.mozilla.org/en-US/docs/Web/API/NavigatorCo... There is no good answer to why, except to improve fingerprinting. Which is most of what this site shows, the amount of data a site, even open in the background, can use to continuously fingerprint you. Or maybe I misjudge what this is supposed to do.

moron4hire 6y ago
You've been given several good answers as to why, you just refuse to believe anything anyone is telling you.
- seniorgarcia 6y ago
  I believe that you think that your answers are true but my desktop will report 12, my work laptop will report 16, my macbook will report 16 as well, my work desktop will report 64 (my surface laptop will report 12 as well, my ipad pro will report 6... I can continue this for some time). Which machine do you think has the best performance for your app?
  - moron4hire 6y ago
    I don't care. You picking the machine is up to you. I only care about giving the best performance on whichever one you've chosen.
  - deleted 6y ago
    [deleted]
  - jtsiskin 6y ago
    Those numbers actually mean something. That’s approximately how many concurrent threads I would want to use. I’m not sure I follow the point you’re making
judge2020 6y ago
I bet it helps for some niche apps like webgl/webgpu games.

umaar 6y ago

There does seem to be a fingerprinting angle on it, but I wrote about using CPU, Battery, Memory etc. to be consideration over how much JavaScript you load for your users: https://umaar.com/dev-tips/242-considerate-javascript/#load-javascript-when-the-device-has-enough-cpu https://umaar.com/dev-tips/242-considerate-javascript/#load-...