4 ms·

I remember when WebRTC was introduced, it was found that it became very popular and was used by almost every page. But closer inspection showed that its use was

I remember when WebRTC was introduced, it was found that it became very popular and was used by almost every page. But closer inspection showed that its use was to get user's IP address for better fingerprinting. I predict that WebGL/WebGPU will be mainly used for the same purposes. Nobody needs new fancy features, what people really need is more reliable fingerprinting (this is proven by number of uses of WebRTC for fingerprinting vs number of uses for communication).

7to2 4y ago
> But closer inspection showed that its use was to get user's IP address for better fingerprinting. Maybe that's why it fell to the wayside: scripts are no longer allowed to get the local IP address (taking with it the most useful aspect of WebRTC, true serverless p2p without internet[1]). [1] I'm not saying that I disagree with the decision, but still sad that we can't have nice things :(
- codedokode 4y ago
  Yes instead of IP address the API now provides Apple DNS hostname. But a proper solution would be to put this unnecessary API behind a permission.
  - illiarian 4y ago
    There are too many APIs that need to put behind permissions for permissions to be useful. No idea how to solve this though.
    - notatoad 4y ago
      i want the chrome apps model to come back - put your permission requests in a manifest, and when the user clicks and install button the app gets its permissions. so "web apps" that the user cares enough about to install get useful features, but pages that you just visit briefly don't.
      - illiarian 4y ago
        > i want the chrome apps model to come back - put your permission requests in a manifest, and when the user clicks and install button the app gets its permissions. So you will get the Android case where flashlight apps where asking for everything, including location data and contact access, and people were giving it to them
        notatoad 4y ago
        you can't protect everybody from themselves all the time. some people are just gonna agree to everything, and you can't stop it. don't ruin apps for everybody just because some guy who couldn't care less shared some data with an app you think they shouldn't have.
        illiarian 4y ago
        > you can't protect everybody from themselves all the time. It's not an either-or thing. There are multiple levels to security, and just shoving everything into one big prompt, and letting users deal with it ain't it.
- azangru 4y ago
  Dang, this is so sad.
- littlestymaar 4y ago
  > taking with it the most useful aspect of WebRTC, true serverless p2p without internet[1]. Would you mind elaborating? In any case WebRTC always needed some kind of third party server to connect the peers together (sure, such a server can be on your local network), and then they replaced the local IP in ICE candidate with mDNS addresses which serve the same purpose and allow for direct P2P communication between the two peers without going through the internet.
isodev 4y ago
And if the Chrome team is excited about a feature, then probably it’s good for ads or upselling other Google products.
- sfink 4y ago
  That's an odd take. Last I knew, the Chrome team was made out of people. If the people working on a new technology are excited about that technology, it probably means that they are excited about that technology. It doesn't say much about how excited the ad people may or may not be about it, other than indirectly by knowing that the technology people are allowed to spend time on it. That is the link I believe you're referring to, but my guess is that it's going to be fairly tenuous. The set of things that the technology people get to work on probably has more to do with the set of things that they try to persuade the powers that be are important, and that set is more likely to be driven by their own interests and visions of what could and should be done on the web, than it is to be driven by what will make their paymasters happiest. Sorry, I'm sure there is a much more brief way to say that. (nb: I work for Mozilla)
grishka 4y ago
People tend to forget that the good part about Flash was that it offered all this (there was an API for low-level high-performance 3D graphics, Stage3D), except there was also an explicit boundary between the "document" and the "app" and most browsers offered an option to only load Flash content when you click on its area. I'm thus still convinced that turning browsers themselves into this application platform kind of thing is a disaster. The industry is going very wrong and dangerous way right now. It's never too late to delete all this code and pretend it never happened though. I want to see a parallel reality where Flash became an open standard, with open-source plugins and all that. It is an open standard and there is at least one project of an open source Flash player (Ruffle), but it's too late. I still hope Flash makes a comeback though.
- adrian17 4y ago
  > and most browsers offered an option to only load Flash content when you click on its area > there is at least one project of an open source Flash player (Ruffle) Just so you know, Ruffle supports (optionally) autoplay without clicking (this has some restrictions, like no sound until it gets a user interaction) _and_ we do plan to try running on webgpu very soon - so unfortunately we rely on this one way or another :( (also there are other projects, Ruffle just happened to get the best word-of-mouth PR)
dcow 4y ago
Honestly I wish we just had a good fingerprinting API that people could opt in to so that we didn't poison all these other good use cases with cringy “it’s gotta be anonymous so I can troll” requirements.
pulpfictional 4y ago
I was reading that WebGPU leaves you open to fingerprinting by your hardware info, particularly your GPU. It seems that it is even possible to distinguish between GPUs of the same model through tolerances in frequency.
- codedokode 4y ago
  WebGL allows to read graphic card name.

7to2 4y ago

> But closer inspection showed that its use was to get user's IP address for better fingerprinting. Maybe that's why it fell to the wayside: scripts are no longer allowed to get the local IP address (taking with it the most useful aspect of WebRTC, true serverless p2p without internet[1]). [1] I'm not saying that I disagree with the decision, but still sad that we can't have nice things :(

codedokode 4y ago
Yes instead of IP address the API now provides Apple DNS hostname. But a proper solution would be to put this unnecessary API behind a permission.
- illiarian 4y ago
  There are too many APIs that need to put behind permissions for permissions to be useful. No idea how to solve this though.
  - notatoad 4y ago
    i want the chrome apps model to come back - put your permission requests in a manifest, and when the user clicks and install button the app gets its permissions. so "web apps" that the user cares enough about to install get useful features, but pages that you just visit briefly don't.
    - illiarian 4y ago
      > i want the chrome apps model to come back - put your permission requests in a manifest, and when the user clicks and install button the app gets its permissions. So you will get the Android case where flashlight apps where asking for everything, including location data and contact access, and people were giving it to them
      - notatoad 4y ago
        you can't protect everybody from themselves all the time. some people are just gonna agree to everything, and you can't stop it. don't ruin apps for everybody just because some guy who couldn't care less shared some data with an app you think they shouldn't have.
        illiarian 4y ago
        > you can't protect everybody from themselves all the time. It's not an either-or thing. There are multiple levels to security, and just shoving everything into one big prompt, and letting users deal with it ain't it.
azangru 4y ago
Dang, this is so sad.
littlestymaar 4y ago
> taking with it the most useful aspect of WebRTC, true serverless p2p without internet[1]. Would you mind elaborating? In any case WebRTC always needed some kind of third party server to connect the peers together (sure, such a server can be on your local network), and then they replaced the local IP in ICE candidate with mDNS addresses which serve the same purpose and allow for direct P2P communication between the two peers without going through the internet.

isodev 4y ago

And if the Chrome team is excited about a feature, then probably it’s good for ads or upselling other Google products.

sfink 4y ago
That's an odd take. Last I knew, the Chrome team was made out of people. If the people working on a new technology are excited about that technology, it probably means that they are excited about that technology. It doesn't say much about how excited the ad people may or may not be about it, other than indirectly by knowing that the technology people are allowed to spend time on it. That is the link I believe you're referring to, but my guess is that it's going to be fairly tenuous. The set of things that the technology people get to work on probably has more to do with the set of things that they try to persuade the powers that be are important, and that set is more likely to be driven by their own interests and visions of what could and should be done on the web, than it is to be driven by what will make their paymasters happiest. Sorry, I'm sure there is a much more brief way to say that. (nb: I work for Mozilla)

grishka 4y ago

People tend to forget that the good part about Flash was that it offered all this (there was an API for low-level high-performance 3D graphics, Stage3D), except there was also an explicit boundary between the "document" and the "app" and most browsers offered an option to only load Flash content when you click on its area. I'm thus still convinced that turning browsers themselves into this application platform kind of thing is a disaster. The industry is going very wrong and dangerous way right now. It's never too late to delete all this code and pretend it never happened though. I want to see a parallel reality where Flash became an open standard, with open-source plugins and all that. It is an open standard and there is at least one project of an open source Flash player (Ruffle), but it's too late. I still hope Flash makes a comeback though.

adrian17 4y ago
> and most browsers offered an option to only load Flash content when you click on its area > there is at least one project of an open source Flash player (Ruffle) Just so you know, Ruffle supports (optionally) autoplay without clicking (this has some restrictions, like no sound until it gets a user interaction) _and_ we do plan to try running on webgpu very soon - so unfortunately we rely on this one way or another :( (also there are other projects, Ruffle just happened to get the best word-of-mouth PR)

dcow 4y ago

Honestly I wish we just had a good fingerprinting API that people could opt in to so that we didn't poison all these other good use cases with cringy “it’s gotta be anonymous so I can troll” requirements.

pulpfictional 4y ago

I was reading that WebGPU leaves you open to fingerprinting by your hardware info, particularly your GPU. It seems that it is even possible to distinguish between GPUs of the same model through tolerances in frequency.

codedokode 4y ago
WebGL allows to read graphic card name.