4 ms·

Why does the documentation need WebGL? I have WebGL disabled in my main browser for privacy reasons (super-easy to fingerprint), and I only get to see 'Applica

Why does the documentation need WebGL? I have WebGL disabled in my main browser for privacy reasons (super-easy to fingerprint), and I only get to see 'Application error: a client-side exception has occurred (see the browser console for more information).' with an error about ThreeJS initialization in the console. I assume it's for the fancy animation, and I find that ridiculous. Loading a whole 3D library just to show a fancy animation. This could have been done much simpler by using an animated image format, though admittedly with less functionality - but is it even needed? I fear the whole industry suffers from overengineering and this is just a symptom. Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable?

cqqxo4zV46cp 2y ago
The reality is that in disabling WebGL, you have an incredibly unusual configuration and the author didn’t test for it. Stop making this a philosophical argument. Why does the documentation need WebGL? It doesn’t, but the web has moved beyond just addressing “needs”. Why do you need to be on HN? You don’t. Yet here you are. I’m not arguing that the juice is worth the squeeze here, but your argument has a false premise that you’re exploiting to make the situation sound more absurd than it is.
- cess11 2y ago
  I don't think it's incredibly unusual. On sensitive machines in corporate settings you commonly disable pretty much everything on every page that isn't in the 'trusted zone' or whatever. Personally, by default I shut down all the browser crap that might needlessly allocate RAM or allow memory leaks or slurp cycles without giving me some kind of value. I think this allows me to hold at least a few hundred extra tabs open. For technical documentation I expect text, hypertext and static images, if you're going to require JS and WebGL and whatnot I'm going to assume you aren't entirely honest with me about the information we're about to share and I'll probably sandbox a scrape of the documentation if I really need it.
  - auxfil 2y ago
    [dead]
  - postalrat 2y ago
    If you mean block all network traffic that isn't in the trusted zone then sure. But disabling features you personally don't like isn't a good security practice.
    - cess11 2y ago
      Maybe I wasn't clear. First I described a somewhat common practice in corporate settings, which is ostensibly motivated by security policies. Then I described my personal preference, which I motivated with resource consumption and performance factors. I did not say that the corporate practice is a good one, I just brought it up as an example to refute the suggestion that limited web browsers are incredibly unusual.
    - ecef9-8c0f-4374 2y ago
      Disabling features less attack surface
feisuzhu 2y ago
'WebGL disabled' is a pretty strong fingerprint anyways
- nicce 2y ago
  "Disabled" is not metric among those who have disabled it, while WebGL enabled allows identifying different browsers with WebGL enabled. I know what you mean, but statistically, I don't think that it is easier to guess the person from those who have disabled it versus the list of all browser fingerprints where is that matching or very close unique fingerprint.
  - dartos 2y ago
    You just self select as someone who wants to see privacy focused ads
    - murat124 2y ago
      adblock/ublock/umatrix could get you out of that too.
      - dartos 2y ago
        Sites can tell if you’re running Adblock too. You’re always leaking some kind of information that advertisers will pay for. The game is choosing what information you’re okay giving them
        schmidt_fifty 2y ago
        Doesn't really matter if you can block the ads anyway Besides, advertisers are not who i worry about when it comes to "my data".
        dartos 2y ago
        You just self select as someone who uses Adblock. Unless you disable all JavaScript you’re leaking something. Honestly, you’re still leaking a bit without js, as long as where you’re connecting to is checking. The game is just choosing what you’re okay telling wherever you connect to.
littlestymaar 2y ago
> Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable? Yeah, it's not like adding a try/catch block around the webGL invocation was hard anyway… But I agree with the sibling comment about disabling WebGL likely being a fingerprinting liability more than a win.
- barfbagginus 2y ago
  I find WebGL driveby risk and fingerprinting risks remote and hard to compare. To wit, I've never experienced a recognized loss from any kind of drive-by or fingerprinting attack. However the severity of drive-by risk is so high, just in theory, that I am tempted to dismiss the risk of fingerprinting. But my reasoning is not very well informed. What principles and information sources do you use when deciding that avoiding fingerprinting is more important than avoiding WebGL drivebys?
- alexvitkov 2y ago
  If you disable WebGL you're putting yourself in the 2% of devices that don't support it. That's not fantastic, but with WebGL enabled just the extension list can be used to narrow you down way further than that - according to https://amiunique.org/ https://amiunique.org/ 0.35% of users share my exact supported extensions list. My `gl.getParameter(gl.RENDERER)` seems to be unique to me, for some ungodly reason. The output from rendering a single triangle also narrows me down to 0.8% of all users.
  - mywittyname 2y ago
    Using firefox on a mac is basically enough to put me as all time unique on that site.
    - nativeit 2y ago
      Me too, my user agent was something like 0.01%.
  - nativeit 2y ago
deleted 2y ago
[deleted]

cqqxo4zV46cp 2y ago

The reality is that in disabling WebGL, you have an incredibly unusual configuration and the author didn’t test for it. Stop making this a philosophical argument. Why does the documentation need WebGL? It doesn’t, but the web has moved beyond just addressing “needs”. Why do you need to be on HN? You don’t. Yet here you are. I’m not arguing that the juice is worth the squeeze here, but your argument has a false premise that you’re exploiting to make the situation sound more absurd than it is.

cess11 2y ago
I don't think it's incredibly unusual. On sensitive machines in corporate settings you commonly disable pretty much everything on every page that isn't in the 'trusted zone' or whatever. Personally, by default I shut down all the browser crap that might needlessly allocate RAM or allow memory leaks or slurp cycles without giving me some kind of value. I think this allows me to hold at least a few hundred extra tabs open. For technical documentation I expect text, hypertext and static images, if you're going to require JS and WebGL and whatnot I'm going to assume you aren't entirely honest with me about the information we're about to share and I'll probably sandbox a scrape of the documentation if I really need it.
- auxfil 2y ago
  [dead]
- postalrat 2y ago
  If you mean block all network traffic that isn't in the trusted zone then sure. But disabling features you personally don't like isn't a good security practice.
  - cess11 2y ago
    Maybe I wasn't clear. First I described a somewhat common practice in corporate settings, which is ostensibly motivated by security policies. Then I described my personal preference, which I motivated with resource consumption and performance factors. I did not say that the corporate practice is a good one, I just brought it up as an example to refute the suggestion that limited web browsers are incredibly unusual.
  - ecef9-8c0f-4374 2y ago
    Disabling features less attack surface

feisuzhu 2y ago

'WebGL disabled' is a pretty strong fingerprint anyways

nicce 2y ago
"Disabled" is not metric among those who have disabled it, while WebGL enabled allows identifying different browsers with WebGL enabled. I know what you mean, but statistically, I don't think that it is easier to guess the person from those who have disabled it versus the list of all browser fingerprints where is that matching or very close unique fingerprint.
- dartos 2y ago
  You just self select as someone who wants to see privacy focused ads
  - murat124 2y ago
    adblock/ublock/umatrix could get you out of that too.
    - dartos 2y ago
      Sites can tell if you’re running Adblock too. You’re always leaking some kind of information that advertisers will pay for. The game is choosing what information you’re okay giving them
      - schmidt_fifty 2y ago
        Doesn't really matter if you can block the ads anyway Besides, advertisers are not who i worry about when it comes to "my data".
        dartos 2y ago
        You just self select as someone who uses Adblock. Unless you disable all JavaScript you’re leaking something. Honestly, you’re still leaking a bit without js, as long as where you’re connecting to is checking. The game is just choosing what you’re okay telling wherever you connect to.

littlestymaar 2y ago

> Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable? Yeah, it's not like adding a try/catch block around the webGL invocation was hard anyway… But I agree with the sibling comment about disabling WebGL likely being a fingerprinting liability more than a win.

barfbagginus 2y ago
I find WebGL driveby risk and fingerprinting risks remote and hard to compare. To wit, I've never experienced a recognized loss from any kind of drive-by or fingerprinting attack. However the severity of drive-by risk is so high, just in theory, that I am tempted to dismiss the risk of fingerprinting. But my reasoning is not very well informed. What principles and information sources do you use when deciding that avoiding fingerprinting is more important than avoiding WebGL drivebys?
alexvitkov 2y ago
If you disable WebGL you're putting yourself in the 2% of devices that don't support it. That's not fantastic, but with WebGL enabled just the extension list can be used to narrow you down way further than that - according to https://amiunique.org/ https://amiunique.org/ 0.35% of users share my exact supported extensions list. My `gl.getParameter(gl.RENDERER)` seems to be unique to me, for some ungodly reason. The output from rendering a single triangle also narrows me down to 0.8% of all users.
- mywittyname 2y ago
  Using firefox on a mac is basically enough to put me as all time unique on that site.
  - nativeit 2y ago
    Me too, my user agent was something like 0.01%.
- nativeit 2y ago

deleted 2y ago

[deleted]