6 ms·

I'm rooting for Ladybird to gain traction in the future. Currently, it is using cURL proper for networking. That is probably going to have some challenges (I th

by jchw 2y ago

I'm rooting for Ladybird to gain traction in the future. Currently, it is using cURL proper for networking. That is probably going to have some challenges (I think cURL is still limited in some ways, e.g. I don't think it can do WebSockets over h2 yet) but on the other hand, having a rising browser engine might eventually remove this avenue for fingerprinting since legitimate traffic will have the same fingerprint as stock cURL.

rhdunn 2y ago
It would be good to see Ladybird's cURL usage improve cURL itself, such as the WebSocket over h2 example you mention. It is also a good test of cURL to see and identify what functionality cURL is missing w.r.t. real-world browser workflows.
eesmith 2y ago
I'm hoping this means Ladybird might support ftp URLs.
- navanchauhan 2y ago
  and even the Gopher protocol!
nonrandomstring 2y ago
When I spoke to these guys [0] we touched on those quirks and foibles that make a signature (including TCP stack stuff beyond control of any userspace app). I love this curl, but I worry that if a component takes on the role of deception in order to "keep up" it accumulates a legacy of hard to maintain "compatibility" baggage. Ideally it should just say... "hey I'm curl, let me in" The problem of course lies with a server that is picky about dress codes, and that problem in turn is caused by crooks sneaking in disguise, so it's rather a circular chicken and egg thing. [0] https://cybershow.uk/episodes.php?id=39 https://cybershow.uk/episodes.php?id=39
- immibis 2y ago
  What should instead happen is that Chrome should stop sending as much of a fingerprint, so that sites won't be able to fingerprint. That won't happen, since it's against Google's interests.
  - gruez 2y ago
    This is a fundamental misunderstanding of how TLS fingerprinting works. The "fingerprint" isn't from chrome sending a "fingerprint: [random uuid]" attribute in every TLS negotiation. It's derived from various properties of the TLS stack, like what ciphers it can accept. You can't make "stop sending as much of a fingerprint", without every browser agreeing on the same TLS stack. It's already minimal as it is, because there's basically no aspect of the TLS stack that users can configure, and chrome bundles its own, so you'd expect every chrome user to have the same TLS fingerprint. It's only really useful to distinguish "fake" chrome users (eg. curl with custom header set, or firefox users with user agent spoofer) from "real" chrome users.
    - dochtman 2y ago
      Part of the fingerprint is stuff like the ordering of extensions, which Chrome could easily do but AFAIK doesn’t. (AIUI Google’s Play Store is one of the biggest TLS fingerprinting culprits.)
      - gruez 2y ago
        What's the advantage of randomizing the order, when all chrome users already have the same order? Practically speaking there's a bazillion ways to fingerprint Chrome besides TLS cipher ordering, that it's not worth adding random mitigations like this.
      - shiomiru 2y ago
        Chrome has randomized its ClientHello extension order for two years now.[0] The companies to blame here are solely the ones employing these fingerprinting techniques, and those relying on services of these companies (which is a worryingly large chunk of the web). For example, after the Chrome change, Cloudflare just switched to a fingerprinter that doesn't check the order.[1] [0]: https://chromestatus.com/feature/5124606246518784 https://chromestatus.com/feature/5124606246518784 [1]: https://blog.cloudflare.com/ja4-signals/ https://blog.cloudflare.com/ja4-signals/
userbinator 2y ago
but on the other hand, having a rising browser engine might eventually remove this avenue for fingerprinting If what I've seen from CloudFlare et.al. are any indication, it's the exact opposite --- the amount of fingerprinting and "exploitation" of implementation-defined behaviour has increased significantly in the past few months, likely in an attempt to kill off other browser engines; the incumbents do not like competition at all. The enemy has been trying to spin it as "AI bots DDoSing" but one wonders how much of that was their own doing...
- hansvm 2y ago
  Hold up, one of those things is not like the other. Are we really blaming webmasters for 100x increases in costs from a huge wave of poorly written and maliciously aggressive bots?
  - refulgentis 2y ago
    > Are we really blaming... No, they're discussing increased fingerprinting / browser profiling recently and how it affects low-market-share browsers.
    - hansvm 2y ago
      I saw that, but I'm still not sure how this fits in: > The enemy has been trying to spin it as "AI bots DDoSing" but one wonders how much of that was their own doing... I'm reading that as `enemy == fingerprinters`, `that == AI bots DDoSing`, and `their own == webmasters, hosting providers, and CDNs (i.e., the fingerprinters)`, which sounds pretty straightforwardly like the fingerprinters are responsible for the DDoSing they're receiving. That interpretation doesn't seem to match the rest of the post though. Do you happen to have a better one?
      - userbinator 2y ago
        "their own" = CloudFlare and/or those who have vested interests in closing up the Internet.
johnisgood 2y ago
I used to call it "cURL", but apparently officially it is curl, correct?
- cruffle_duffle 2y ago
  As in “See-URL”? I’ve always called it curl but “see url” makes a hell of a lot of sense too! I’ve just never considered it and it’s one of those things you rarely say out loud.
  - johnisgood 2y ago
    I prefer cURL as well, but according to official sources it is curl. :D Not sure how it is pronounced though, I pronounce it as "see-url" and/or "see-U-R-L". It might be pronounced as "curl" though.
- bdhcuidbebe 2y ago
  I’d guess Daniel pronounce it as ”kurl”, with a hard C like in ”crust”, since hes swedish.
devwastaken 2y ago
ladybird does not have the resources to be a contender to current browsers. its well marketed but has no benefits or reason to exist over chromium. its also a major security risk as it is designed yet again in demonstrably unsafe c++.

by jchw 2y ago

rhdunn 2y ago

It would be good to see Ladybird's cURL usage improve cURL itself, such as the WebSocket over h2 example you mention. It is also a good test of cURL to see and identify what functionality cURL is missing w.r.t. real-world browser workflows.

eesmith 2y ago

I'm hoping this means Ladybird might support ftp URLs.

navanchauhan 2y ago
and even the Gopher protocol!

nonrandomstring 2y ago

When I spoke to these guys [0] we touched on those quirks and foibles that make a signature (including TCP stack stuff beyond control of any userspace app). I love this curl, but I worry that if a component takes on the role of deception in order to "keep up" it accumulates a legacy of hard to maintain "compatibility" baggage. Ideally it should just say... "hey I'm curl, let me in" The problem of course lies with a server that is picky about dress codes, and that problem in turn is caused by crooks sneaking in disguise, so it's rather a circular chicken and egg thing. [0] https://cybershow.uk/episodes.php?id=39 https://cybershow.uk/episodes.php?id=39

immibis 2y ago
What should instead happen is that Chrome should stop sending as much of a fingerprint, so that sites won't be able to fingerprint. That won't happen, since it's against Google's interests.
- gruez 2y ago
  This is a fundamental misunderstanding of how TLS fingerprinting works. The "fingerprint" isn't from chrome sending a "fingerprint: [random uuid]" attribute in every TLS negotiation. It's derived from various properties of the TLS stack, like what ciphers it can accept. You can't make "stop sending as much of a fingerprint", without every browser agreeing on the same TLS stack. It's already minimal as it is, because there's basically no aspect of the TLS stack that users can configure, and chrome bundles its own, so you'd expect every chrome user to have the same TLS fingerprint. It's only really useful to distinguish "fake" chrome users (eg. curl with custom header set, or firefox users with user agent spoofer) from "real" chrome users.
  - dochtman 2y ago
    Part of the fingerprint is stuff like the ordering of extensions, which Chrome could easily do but AFAIK doesn’t. (AIUI Google’s Play Store is one of the biggest TLS fingerprinting culprits.)
    - gruez 2y ago
      What's the advantage of randomizing the order, when all chrome users already have the same order? Practically speaking there's a bazillion ways to fingerprint Chrome besides TLS cipher ordering, that it's not worth adding random mitigations like this.
    - shiomiru 2y ago
      Chrome has randomized its ClientHello extension order for two years now.[0] The companies to blame here are solely the ones employing these fingerprinting techniques, and those relying on services of these companies (which is a worryingly large chunk of the web). For example, after the Chrome change, Cloudflare just switched to a fingerprinter that doesn't check the order.[1] [0]: https://chromestatus.com/feature/5124606246518784 https://chromestatus.com/feature/5124606246518784 [1]: https://blog.cloudflare.com/ja4-signals/ https://blog.cloudflare.com/ja4-signals/

userbinator 2y ago

but on the other hand, having a rising browser engine might eventually remove this avenue for fingerprinting If what I've seen from CloudFlare et.al. are any indication, it's the exact opposite --- the amount of fingerprinting and "exploitation" of implementation-defined behaviour has increased significantly in the past few months, likely in an attempt to kill off other browser engines; the incumbents do not like competition at all. The enemy has been trying to spin it as "AI bots DDoSing" but one wonders how much of that was their own doing...

hansvm 2y ago
Hold up, one of those things is not like the other. Are we really blaming webmasters for 100x increases in costs from a huge wave of poorly written and maliciously aggressive bots?
- refulgentis 2y ago
  > Are we really blaming... No, they're discussing increased fingerprinting / browser profiling recently and how it affects low-market-share browsers.
  - hansvm 2y ago
    I saw that, but I'm still not sure how this fits in: > The enemy has been trying to spin it as "AI bots DDoSing" but one wonders how much of that was their own doing... I'm reading that as `enemy == fingerprinters`, `that == AI bots DDoSing`, and `their own == webmasters, hosting providers, and CDNs (i.e., the fingerprinters)`, which sounds pretty straightforwardly like the fingerprinters are responsible for the DDoSing they're receiving. That interpretation doesn't seem to match the rest of the post though. Do you happen to have a better one?
    - userbinator 2y ago
      "their own" = CloudFlare and/or those who have vested interests in closing up the Internet.

johnisgood 2y ago

I used to call it "cURL", but apparently officially it is curl, correct?

cruffle_duffle 2y ago
As in “See-URL”? I’ve always called it curl but “see url” makes a hell of a lot of sense too! I’ve just never considered it and it’s one of those things you rarely say out loud.
- johnisgood 2y ago
  I prefer cURL as well, but according to official sources it is curl. :D Not sure how it is pronounced though, I pronounce it as "see-url" and/or "see-U-R-L". It might be pronounced as "curl" though.
bdhcuidbebe 2y ago
I’d guess Daniel pronounce it as ”kurl”, with a hard C like in ”crust”, since hes swedish.

devwastaken 2y ago

ladybird does not have the resources to be a contender to current browsers. its well marketed but has no benefits or reason to exist over chromium. its also a major security risk as it is designed yet again in demonstrably unsafe c++.