2 ms·

Fingerprinting would be my guess. It could give at least one extra bit of data about your device (has motion sensors or not). Could also help detect agent stri

Fingerprinting would be my guess. It could give at least one extra bit of data about your device (has motion sensors or not). Could also help detect agent string falsification: why would a device claiming it's UA is legacy IE have motion sensors?

ericskiff 3y ago
That was my assumption as well, but the author makes a good case for it being an Akamai bot detection script designed for mobile responsive sites, and inappropriately implemented on desktop by these big sites.
- TomK32 3y ago
  Bad code being copied from stackoverflow was my first guess as well.
- buro9 3y ago
  That is still fingerprinting. Bots will either all have the same (or a low diversity of) fingerprint, or if not then they will have the same randomisation techniques to mask the fingerprint. Some of the additional browser features that access devices do reveal the most trivial way to determine "this is not a bot as bots don't have this fingerprint". Of course that has implications, if privacy makes you look like a bot (it does), then the web has more friction the more private one is.
  - bombcar 3y ago
    If you want to experience that, download Brave, open a Tor window, and try to do anything online. Now you’re playing botsimulater 2023.
    - toastal 3y ago
      Or download the Tor Browser?
    - didntcheck 3y ago
      I just use an "ordinary" consumer VPN service and it's bad enough. It really seems to have ramped up in the past two years, and now it's a daily occurrence to find a site which won't even serve me a response body when I connect via VPN
repelsteeltje 3y ago
Web client to web server: I'm not sure I can trust you with my user's privacy, so I'm going to give you as little cookies/telemetry/side channels as I can. Web server to web client: I'm not sure your so-called "user" represents a real-life human user. Can you at least prove that you're a real-life web browser? Web client to web server: hmm, well okay, here's my User-Agent header. Just curious why you care about who's sending the request? Web server to web client: Still not convinced, can you give this CAPTCHA to your so-called "user"? As to you second question: bots, spam. And the ad network sponsoring me doesn't trust my tally. Web client to web server: My human hates CAPTCHAs, and AIs are better at it anyway. Web server to web client: Ghrmbl. Okay let me talk to Widevine/FairPlay/PlayReady DRM or your microphone/gyroscope/battery level/uptime/... ... The arms race of surveillance enshittification.

ericskiff 3y ago

That was my assumption as well, but the author makes a good case for it being an Akamai bot detection script designed for mobile responsive sites, and inappropriately implemented on desktop by these big sites.

TomK32 3y ago
Bad code being copied from stackoverflow was my first guess as well.
buro9 3y ago
That is still fingerprinting. Bots will either all have the same (or a low diversity of) fingerprint, or if not then they will have the same randomisation techniques to mask the fingerprint. Some of the additional browser features that access devices do reveal the most trivial way to determine "this is not a bot as bots don't have this fingerprint". Of course that has implications, if privacy makes you look like a bot (it does), then the web has more friction the more private one is.
- bombcar 3y ago
  If you want to experience that, download Brave, open a Tor window, and try to do anything online. Now you’re playing botsimulater 2023.
  - toastal 3y ago
    Or download the Tor Browser?
  - didntcheck 3y ago
    I just use an "ordinary" consumer VPN service and it's bad enough. It really seems to have ramped up in the past two years, and now it's a daily occurrence to find a site which won't even serve me a response body when I connect via VPN

repelsteeltje 3y ago

Web client to web server: I'm not sure I can trust you with my user's privacy, so I'm going to give you as little cookies/telemetry/side channels as I can. Web server to web client: I'm not sure your so-called "user" represents a real-life human user. Can you at least prove that you're a real-life web browser? Web client to web server: hmm, well okay, here's my User-Agent header. Just curious why you care about who's sending the request? Web server to web client: Still not convinced, can you give this CAPTCHA to your so-called "user"? As to you second question: bots, spam. And the ad network sponsoring me doesn't trust my tally. Web client to web server: My human hates CAPTCHAs, and AIs are better at it anyway. Web server to web client: Ghrmbl. Okay let me talk to Widevine/FairPlay/PlayReady DRM or your microphone/gyroscope/battery level/uptime/... ... The arms race of surveillance enshittification.