15 ms·
Closing web browser windows doesn't close connections
- Causality1 6y agoThis is a strictly "keep open" behavior, right? No connections are reestablished after being severed? I'm thinking about the implications for users who move on and off a VPN a lot.
- vz8 6y agoI wonder if this explains the occasional "Ghosts in the machine" behavior I've seen in Fiddler. Hoo boy.
- ilaksh 6y agoIf this type of BS bothers you, check out the Gemini protocol. Basically a very simple browser concept that cuts out all of the BS. No JavaScript, cookies, secret connections, ads, etc. It's mainly just a simplified markdown over TLS. Because it's so simple, it is possible for any programmer to make their own client. Unike with web browsers which require you to basically implement an entire operating system. That means if you don't like something a client is doing, it's not a problem finding another good one.
- duncan-donuts 6y agoI haven’t looked at the protocol but how does it prevent ads?
- ilaksh 6y agoWell, maybe look at the protocol. It doesn't strictly prevent ads, but it makes it a lot harder. And for example since there is no JavaScript, there is no way to pop open another window, or freeze up the page loading an ad. In fact, most clients don't even display images inline, since images aren't part of the spec. There are no cookies for tracking because there are no cookies.
- woodruffw 6y agoI'll admit that I haven't looked closely at Gemini, but I don't understand how it solves this qua protocol: keepalives and socket reuse are an extension of HTTP that every major client agreed upon as a performance win, and Gemini has response headers[1] that clients could easily use to advertise similar functionality. Same goes for any number of terrible parts of the modern web: the fact that Gemini doesn't have them now is a function of its niche status and community, not some fundamental restriction. That's how HTTP 1.0 started as well. [1]: https://gemini.circumlunar.space/docs/specification.html https://gemini.circumlunar.space/docs/specification.html
- Arnavion 6y agoThere's no content-length header in the response. The server has to close the connection to signal the end of the response body.
- woodruffw 6y ago> There's no content-length header in the response. I'm not sure I understand -- what's stopping me from adding one? One of Gemini's design goals seems to be client diversity and allowing clients to interpret responses on their own terms. Edit: To be even more explicit about it: the Gemini specification doesn't include any language that says that clients and servers MUST not use the "meta" field or their response bodies to negotiate additional functionality. The observation that nobody in the Gemini ecosystem currently does is tantamount to the observation that nobody has bothered to yet, just like with HTTP 1.0.
- Arnavion 6y ago>One of Gemini's design goals seems to be client diversity and allowing clients to interpret responses on their own terms. No, the design goal is the exact opposite of that. The protocol is intentionally designed to be non-extensible so that other features that go against its spirit are not added. You can of course add a content-length header to your server and write your own client that parses it, but you wouldn't be writing a Gemini server and client any more. https://gemini.circumlunar.space/docs/faq.gmi https://gemini.circumlunar.space/docs/faq.gmi goes in great length about this in section 2, and even specifically about (the lack of) content-length in section 2.12
- agumonkey 6y agoI tried it, it's somehow nice but: - not fast enough yet (I expect leaner protocol and data => instant) - navigation is still crude, directories and text are.. not ideal so far I'm open minded, it's not a blind critic of gemini (I wish projects like that to succeed, and for instance, I use dillo regularly) but using it threw me off a little bit.
- Arnavion 6y agoA comparative HTTP page ("comparative" == "same text content, no non-text content, no XHR or JS to delay-load content") is almost always going to be faster. Every gemini page request has to set up a brand new connection, ie brand new TCP handshake and TLS handshake.
- speexmex 6y agoIt's not clear what problem Gemini solves. Some webmaster willing to host a Gemini server could also setup an nginx serving static markdown files with no cookies/js/... and the privacy conscious client could use lynx to browse it.
- aidenn0 6y agoTell me without clicking if an http(s) uri requires javascript and/or a graphical browser to render properly. Then tell me the same thing for a gemini uri.
- Dylan16807 6y agoI can go host a gemini server with javascript out of spite if you want.
- aidenn0 6y agoThere is no expectation of a gemini server that it can run arbitrary code on the client. There is for an http server. This changes what works and what doesn't work.
- Dylan16807 6y agoYeah but there's also no expectation that images will work, so "this document won't work right unless you have certain client features" wouldn't even be unique. So I disagree with your earlier statement even if we exclude javascript. No, I can't tell you without clicking if a gemini URL requires a graphical browser to render properly. Without even being cheeky or pedantic.
- tyingq 6y agoIt's still there, but I don't know if it works since it's been deprecated, but for Chrome, see: chrome://net-internals/#sockets There's buttons there to close sockets and flush socket pools. I imagine this also means there's an API somewhere you could call from an extension.
- Black101 6y agoI thought that this would talk about Chrome, but I am not surprised that it is about Safari...
- jalcazar 6y agoIs for performance: Re-use already established connections. It is common on the server side as well and with other TCP clients beside browsers.
- nano-erud 6y agoThat doesn't happen to me using Brave on Debian GNU/Linux.
- deleted 6y ago[deleted]
- raggles 6y agoisn't this just a keepalive on the socket? no content actually being requested? If so I don't really see the problem. I had to write a reverse proxy the other day in nodejs to handle an unusual set of requirements that couldn't be satisfied by nginx\HAProxy and I did exactly the same thing - use an httpagent to keep connections alive to clients for a period of time (I think I chose 10 minutes or thereabouts) - without it sequential requests are about 10x slower due to SSL key calc overhead.
- catmanjan 6y agoI noticed this just yesterday, Azure Appgateway reported 6 active connections even though I was the only one using it and I had closed my browser.
- eyelidlessness 6y agoThere are web APIs which suggest they guarantee this. How are you supposed to get notifications you opted into if closing the tab turns off its network access? Stuff that happened in your local tab as a ghost? Edit: for real though if you’re using chrome or any equivalent browser with its own internal task manager, go on into it and kill everything except the parent task as often as you like. It’s great.
- wolfgang42 6y agoNotifications aren’t done by the browser holding open a socket to individual sites; there’s a somewhat complicated protocol involving a service run by the browser manufacturer. I’m not aware of any web APIs that explicitly require the browser to hold idle connections alive in a socket pool (server-sent events/websockets are a different matter; but they involve an active worker of some description—and last I knew weren’t available in service workers); this is purely a performance optimization.
- eyelidlessness 6y agoI’m sincerely sorry that I so poorly formulated the joke.
- deleted 6y ago[deleted]
- choppaface 6y agoSo would this be a sure fire way to detect incognito mode?
- cortesoft 6y agoNo, there is no session sharing between private and non-private tabs.
- choppaface 6y agoRight, but if your client immediately kills a session, and that client also needed new cookies, maybe that client was incognito. If the session stays open longer, maybe it was a legit new user.
- bagacrap 6y agoisn't it a little late to do anything with that knowledge if the user is already gone from your site?
- choppaface 6y agoif they posted something and they're a bot, then you want to take that stuff down at some point.
- andai 6y agoBut there's a measurable difference in the browser's behavior between the two modes, so you can determine which one is being used.
- goldsteinq 6y agoDetecting incognito mode always was quite easy.
- jahewson 6y agoThis is how HTTP/2 works by design. There’s one TCP socket per host and the browser will make up to 6 parallel requests over it.
- chrismorgan 6y agoThis is nothing to do with HTTP/2. This is just keep-alive behaviour, which applies to HTTP/1.1 just as much as HTTP/2. Also the 6 is the maximum number of HTTP/1.1 connections most browser configurations will open per origin; HTTP/2 lets you have as many streams open on one connection as you like (up to 2³⁰ or 2³¹ if my memory serves me, but a billion ought to be enough for anyone).
- youngtaff 6y agoIt's possible to have two HTTP/2 connections to the same host. Where the host is a 3rd-party then credentialed (stylesheets, scripts, images etc) and anonymous connections (fonts, fetch etc.) will be separate
- megous 6y agoIt's also possible to have one connection to multiple origins with HTTP/2 (as long as they are on the same IP/port). I wonder if it's recommended though, since I've noticed this only on Safari so far.
- youngtaff 6y agoGuess what you're seeing is connection coalescing at work - they also need to share the same cert AFAIK
- ck2 6y agoisn't "continue running background apps when Google Chrome is closed" a far worse feature that is enabled by default?
- wolfgang42 6y agoThis post is basically ‘I observed some behavior and I don’t understand it, so here’s some speculative fearmongering.’ The browser is not letting trackers “continue to "keep tabs" on us in some way”; about the only info that the site can get is that if the connection drops unexpectedly then maybe the user entered a tunnel. (In fact, closing the connection the instant the user clicks 'X' would actually give the site more information.) The reason that the behavior isn’t communicated to users (and that “Jeff is a nitwit”) is because it’s utterly irrelevant to them, and not really a privacy concern. Just because the connection was used to load an analytics script at some point in the past does not mean that the TCP socket pair somehow becomes an instrument of spying. Incidentally, there actually is some work being done to reduce the need to hold on to these connections. 0-RTT (zero round-trip-time) session resumption with QUIC (HTTP/3) should allow the browser to instantly pick back up a previous communication without needing to hold a socket open in the meantime.
- lukeschlather 6y agoSo if I close the browser then open a private browsing window to the same site, the destination can't use that open connection to determine positively that the non-private window and the private window to the same IP are definitively the same machine?
- roca 6y agoSites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open.
- eternalban 6y agoSure, but this removes any guess work on their end. It's the same connection.
- dagenix 6y agoDo you have evidence that connections opened in non-private mode are re-used in private mode?
- moistly 6y agoI believe this happens all the time in iOS Safari on Reddit. The network “spinner” in the taskbar, top right, will go forever and ever after all tabs are closed. It’ll stop when Safari is not active, and start again when Safari is brought back. I have to kill Safari (long swipe up to show all “open” apps, the. Flick it off the screen) to make it stop.
- nmstoker 6y agoThis is ongoing "communication" in the loosest sense right? It keeps the connection open but it's not like the connection is being actively used to pass data, so surely the only information for the server is simply that the user is still there (and thus you could infer they haven't turned their computer off). That might be deeply interesting in some obscure edge cases but it's not sounding like anything that would keep me up at night. Or am I missing something?
- wolfgang42 6y agoYes, exactly. There might be some keepalive messages to prevent timeouts, but unless the browser is explicitly instructed to make an HTTP request no data is passed.
- habeebtc 6y agoMost http logs just store request info. It is quite possible to capture detailed connection info, but web logs at scale are not free and better deliver some value. Akamai for example only logs connection termination errors for failed transactions--and it needs a valid header to do so, or it will not get logged. I am not too worried about the described behavior.
- gccs 6y agoIf you open a page, close it, connect to a VPN, then open the page again it will not go through the VPN.
- dagenix 6y agoEvidence?
- gruez 6y agoAt least with windows and openvpn, TCP connections that are already established prior to the VPN connection being turned on, continue to use the original adapter (rather than the VPN adapter). IIRC on linux the connection either gets reset or hung.
- dagenix 6y agoInteresting. On Mac OS, connecting to a VPN seems to terminate all activate connections for me pretty immediately.
- feross 6y agoWait until Jeff hears about Service Workers. :)
- jeffmcmahan 6y agoThat was my immediate impression as to what was going on. This guy doesn't know about service workers...
- zests 6y agoWhat's the deal with service workers? I read up on them and do not see how they keep connections open when the page is closed.
- Arnavion 6y agoService workers run in the background independent of any website pages open.
- boring_twenties 6y agoFor the uninitiated: 1) uMatrix can block these. 2) about:serviceworkers lets you manage/remove individual ones. 3) about:config key dom.serviceWorkers.enabled lets you disable the whole thing altogether. edit: fixed #3
- KingOfCoders 6y agoThanks for "about:serviceworkers", found around 30.
- rgbrenner 6y agoI think the writer falls into the "privacy paranoid" category of users. Something vaguely looks like it could be used for nefarious purposes, so they imagine it must be for nefarious purposes. Also as much attention as privacy gets, those users are far outnumbered by the performance oriented users. So it would be a mistake to kill a performance improvement for an imagined privacy improvement to satisfy (the even smaller segment of) privacy paranoid users.
- Black101 6y ago> Something vaguely looks like it could be used for nefarious purposes If it can be used for nefarious purposes, it will eventually be... so it should be considered a bug. I'm not sure what world you live in...
- wolfgang42 6y ago“vaguely looks like it could” and “can” are not the same.
- Black101 6y agoclosing a browser should definitely close all connections associated with it... that is one reason why I don't use Google applications on Linux... because they (used to) keep a process running even when you closed the application (that was years ago and I don't know how it is today).
- wolfgang42 6y agoI just tried it and Chromium, at least, closes all processes when the last window is closed. But the linked post is talking about a Mac, where the expectation is explicitly that the application keeps running even if it has no windows at present; if you want the process to go away then tell it to quit.
- Black101 6y ago
- paxys 6y agoAn open socket/connection keep-alive isn't the site spying on you. Jesus. If you are really that paranoid then kill the web browser process after closing the tab.
- khc 6y agoIsn't this because Mac keeps the app open even after all the windows are closed?
- cafxx 6y agoNot sure what is the point they are trying to make. Specifically, I don't see any strong argument tying not closing persistent connections right away to any tangible privacy concern - seems like the post considers it an assumption.
- jrochkind1 6y agoI'm don't think "keeping the connection open" has the consequences or effects the author thinks it has. (edit: the other comments here overwhelmingly agree with me. How did this get so many upvotes to get on the front page I wonder?)
- zmmmmm 6y agoI actually think its kind of useful for privacy, as it stops the page from monitoring exactly how long I really had it open, at least, through that avenue.
- wruza 6y agoWhat do they mean by “socket reuse” in this thread and in tfa? Http/1.x and ws protocols are (to my knowledge) not reusable by design. What else is there for reuse? Http/2+?
- wolfgang42 6y agoIn HTTP/1 the server can send a header “Connection: Keep-Alive” to tell the client that it doesn’t have to close the socket after receiving the reply, and can send another request. (HTTP/2+ have this built into the wire protocol and don’t need the header.) If the browser doesn’t have another request to send immediately, it will still keep the connection in a “socket pool” for a while in case it needs to make another request to the server later.
- Jan454 6y agoThe important question (imho) would be: What can be done with this still open connection after the client closed the tab? * Might the server use it for anything without my consent? (e.g. hacking the sandbox as this state of the browser might open another code-tree with yet unknown security-bugs, or might still running js-scripts keep going in the background even after closing the tab?) * Might the browser use it for anything without the server's consent?
- hyko 6y agoOn the Mac: Closing a window just closes a window. Quitting the application closes all connections sure and true.
- youngtaff 6y agoConnections can be shared between browser tabs, so two tabs may use the same connection to a single origin. This obviously has implications for privacy e.g. if that connection is to a third-party so Firefox and Chrome are starting to partition network connections. If you capture a Netlog in Chrome, you'll a NetworkIsolationKey (?) entry, and consisting of top-level frame origin, frame origin, request origin (or similar) that's used to key the connection an limit it's use
- harwoodleon 6y agoSimple way to fix: [x] Allow persisted TCP connections to websites Make that an option in the settings.
- jakub_g 6y agoThe post is written in a way that might mislead some into thinking that 1) connections are kept after closing the browser, 2) connections are kept indefinitely. This is not true: - Firefox keeps it for ~2 minutes and Chrome for ~5 minutes [1]. - Note there's nothing special about closing a browser window. It's the same as closing a tab, from browser's perspective. Many things are kept for a while in memory as well. [1] https://fastmail.blog/2011/06/28/http-keep-alive-connection-timeouts/ https://fastmail.blog/2011/06/28/http-keep-alive-connection-... (blog post is 10 year old but the values were the same last time I checked)
- TeMPOraL 6y ago> Note there's nothing special about closing a browser window. It's the same as closing a tab, from browser's perspective. This is definitely a non-obvious behavior. Browsers historically were tied to their windows - if you closed them all, there was no browser process running anymore. This seems to have changed some time ago, and doesn't seem to be well-communicated to the users.
- jakub_g 6y agoWhat I mean is: when you have n>1 windows, and close one of them, it's a non-event (unless it was last window / last incognito window). You can even revive the closed tab/window (in Firefox even an incognito tab). By default in Firefox you can revive 25 last closed tabs IIRC (configurable). Window is just a different UI for a tab. Closing a tab drops some resources from memory, but not all / not immediately. When you close last window, then you close the whole browser, and the story is different. Closing whole browser = dropping all memory, connections etc. Note in particular: when you have n>1 incognito windows, they share in-memory cache, cookies etc. (Incognito tabs put more restrictions on certain things than normal tabs, for example no disk writes, but unless you close all incognito windows, stuff still lives there in memory).
- TeMPOraL 6y agoYes, what I mean is what happens when you close the last window. I've been surprised to discover over the past year that both Chrome and Firefox sometimes linger in the background. In case of Fx I suspected it's a bug; Chrome on Windows creates a tray icon under some conditions, that remains after all Chrome windows are closed, so I assume it's deliberate.
- tonetheman 6y agoClosing a window on OSX does not close the process. A horrible design choice that other operating systems do not suffer from.
- satysin 6y agoNot sure why this is surprising. The author is using macOS where closing a window almost always just closes the window while the application itself continues to run. Browsers maintain active connections for a number of reasons, the main two these days being notifications and service workers. If you want to kill the connections then terminate the application via Cmd+Q or the App menu.
- megous 6y agoDepends. Safari will re-use a whole TLS session even if you change hosts/origins (if the IP address/port is the same). That's just a bit too much in my book. Nevermind that it randomly breaks TLS client certificates selection, because pre-existing TLS session may have been started with a different SNI, and you don't get a chance to re-negotiate TLS session parameters based on SNI. Some websites just randomly break depending on time passed from last visiting another hostname/website served on the same multi-host/load balancer. Hopefully someone will find a way to abuse this, so that they stop doing it. I had enough of the misdirected request 421 errors from nginx already, due to this.