3 ms·

> Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable? Yeah, it's not like addi

> Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable? Yeah, it's not like adding a try/catch block around the webGL invocation was hard anyway… But I agree with the sibling comment about disabling WebGL likely being a fingerprinting liability more than a win.

barfbagginus 2y ago
I find WebGL driveby risk and fingerprinting risks remote and hard to compare. To wit, I've never experienced a recognized loss from any kind of drive-by or fingerprinting attack. However the severity of drive-by risk is so high, just in theory, that I am tempted to dismiss the risk of fingerprinting. But my reasoning is not very well informed. What principles and information sources do you use when deciding that avoiding fingerprinting is more important than avoiding WebGL drivebys?
alexvitkov 2y ago
If you disable WebGL you're putting yourself in the 2% of devices that don't support it. That's not fantastic, but with WebGL enabled just the extension list can be used to narrow you down way further than that - according to https://amiunique.org/ https://amiunique.org/ 0.35% of users share my exact supported extensions list. My `gl.getParameter(gl.RENDERER)` seems to be unique to me, for some ungodly reason. The output from rendering a single triangle also narrows me down to 0.8% of all users.
- mywittyname 2y ago
  Using firefox on a mac is basically enough to put me as all time unique on that site.
  - nativeit 2y ago
    Me too, my user agent was something like 0.01%.
- nativeit 2y ago
  This is potentially a very interesting/useful site. My only problem is with some of the questionable statistics it's showing, that might suggest their dataset is not strictly representative. The time zones in particular seem to be significantly skewed compared to their respective population distributions. There's also a suspiciously large number of UTC0 fingerprints, which suggests they might have a large number of crawlers/bots in their dataset.
- littlestymaar 2y ago
  Thanks for the website, it's very interesting. From their statistics, it seems that WebGL gives far less info than things like the list of fonts, the Canvas properties, or the audio input, and more comparable to effective height of the screen (or even just user agent in my case, using Firefox on Linux, though I have to admit I'm surprised about that: 0.02% sounds really low).

barfbagginus 2y ago

I find WebGL driveby risk and fingerprinting risks remote and hard to compare. To wit, I've never experienced a recognized loss from any kind of drive-by or fingerprinting attack. However the severity of drive-by risk is so high, just in theory, that I am tempted to dismiss the risk of fingerprinting. But my reasoning is not very well informed. What principles and information sources do you use when deciding that avoiding fingerprinting is more important than avoiding WebGL drivebys?

alexvitkov 2y ago

If you disable WebGL you're putting yourself in the 2% of devices that don't support it. That's not fantastic, but with WebGL enabled just the extension list can be used to narrow you down way further than that - according to https://amiunique.org/ https://amiunique.org/ 0.35% of users share my exact supported extensions list. My `gl.getParameter(gl.RENDERER)` seems to be unique to me, for some ungodly reason. The output from rendering a single triangle also narrows me down to 0.8% of all users.

mywittyname 2y ago
Using firefox on a mac is basically enough to put me as all time unique on that site.
- nativeit 2y ago
  Me too, my user agent was something like 0.01%.
nativeit 2y ago
This is potentially a very interesting/useful site. My only problem is with some of the questionable statistics it's showing, that might suggest their dataset is not strictly representative. The time zones in particular seem to be significantly skewed compared to their respective population distributions. There's also a suspiciously large number of UTC0 fingerprints, which suggests they might have a large number of crawlers/bots in their dataset.
littlestymaar 2y ago
Thanks for the website, it's very interesting. From their statistics, it seems that WebGL gives far less info than things like the list of fonts, the Canvas properties, or the audio input, and more comparable to effective height of the screen (or even just user agent in my case, using Firefox on Linux, though I have to admit I'm surprised about that: 0.02% sounds really low).