2 ms·
> The resulting curl looks, from a network perspective, identical to a real browser. How close is it? If I ran wireshark, would the bytes be exactly the sa
by londons_explore 2y ago
> The resulting curl looks, from a network perspective, identical to a real browser.
How close is it? If I ran wireshark, would the bytes be exactly the same in the exact same packets?
- dchest 2y agoWhat else could "identical" mean?
- londons_explore 2y agoIt could be that the TCP streams are the same, but packetiation is different. It could mean that the packets are the same, but timing is off by a few milliseconds. It could mean a single HTTP request exactly matches, but when doing two requests the real browser uses a connection pool but curl doesn't. Or uses HTTP/3's fast-open abilities, etc. etc.
- zlagen 2y agoIt replicates the browser at the HTTP/SSL level, not TCP. From what I know this is good enough to bypass cloudflare's bot detection.
- Retr0id 2y agoTwo TLS streams are never byte-identical, due to randomness inherent to the protocol. Identical here means having the same fingerprint - i.e. you could not write a function to reliably distinguish traffic from one or the other implementation (and if you can then that's a bug).
- jsnell 2y agoThe packets from Chrome wouldn't be exactly the same as packets sent by Chrome at a different time either. "The exact same packets" is not a viable benchmark, since both the client and the server randomize the payloads in various ways. (E.g. key exchange, GREASE).
- peetistaken 2y agoYou can check your fingerprint on https://tls.peet.ws https://tls.peet.ws