7 ms·
> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather t
by Aurornis 4mo ago
> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent.
They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't trying to infer your operating system, they only care about semi-unique things that show up.
It's an interesting finding. I wish they had taken some time to have a real person write it up. This is too heavily LLM written to ignore.
- jeroenhd 4mo ago> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.
- reactordev 4mo agoThe Internet is a cesspool of scams now
- d1ss0nanz 4mo agoAlways was.
- pocksuppet 4mo agoscraping, however, is not intrinsically a scam.
- mplewis 4mo agoIt is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.
- lsaferite 4mo agoUnfortunately the response to that right now is to nuke everything that isn't within a strict set of constraints. That helps with the bad bulk-scrapers, but hits everyone else as well as collateral damage.
- VorpalWay 4mo agoSomething like Anubis in front of the server to protect it might be an option. It sucks that we have to resort to that yes, but it seems the least bad option currently (better than the entire internet going through Cloudflare at least).
- flexagoon 4mo agoYou can just use one line of JS instead https://fxgn.dev/blog/anubis https://fxgn.dev/blog/anubis
- userbinator 4mo agoThe idiotic "stealing" argument again? At least use "piracy" if you want to be correct... The moment you openly publish information on the Internet, you have already given consent. There are other solutions to bandwidth usage. User-agent discrimination should be illegal. All it does is further the control that Big Tech has, and help authoritarian governments with their control too.
- duped 4mo agoNo it's just intrinsically antisocial behavior
- GaryBluto 4mo agoScraping has never "intrinsically" been anti-social behaviour, you just don't like it.
- Mistletoe 4mo agoHas the internet made the average human’s life better? As someone that lived in both eras I have to say no. If you want to improve humanity greatly and prevent currently 8.3 billion people’s misery and counting, you build a time machine and prevent Tim Berners-Lee from inventing it in the first place. But it wouldn’t help, because someone else would still invent this torture nexus of hyperconnected human minds.
- matheusmoreira 4mo agoThe internet was amazing before the big techs started centralizing everything, before governments started fragmenting it into censored regional networks...
- NetMageSCW 4mo agoAsk those who had no medical assistance before the Internet. Or ask Ukraine.
- acters 4mo agoIt's sometimes easier to lie than to tell the truth, and being on Linux telling the truth gets me more scrutiny than those pretending to be legit.
- genxy 4mo agoSame as sites the block "wget" as a user agent, but then you can pass in a -U "Cheetos/10" and sail right in. I'd be fine if they throttled the connection, or a contact page. Every little bit helps build a high trust society.
- baby_souffle 4mo agoSome scrape activity happens because I can't obtain the data any other way. I would be thrilled if certain retailers had price and availability data as an API so I could not bother with the bulk of scrape and process.
- greggsy 4mo agoAs much as I would like pricing APIs as well, the economics don’t add up for retail, and it would effectively lead to a scalper’s market. A regular Joe consumer shouldn’t have to learn python to get thier foot in the door because some arbitrage purchaser has automated a ‘best deal’ purchasing bot based on real time pricing APIs.
- nradov 4mo agoThe HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.
- parasense 4mo agoIt certainly wasn't a mistake in the beginning, but it's certainly a mistake now.
- thaumasiotes 4mo agoIt was a mistake in the beginning too. If you want to serve different content to different people, you use two different URLs. There's never a valid case for doing it while hiding it from the user.
- sroussey 4mo agoNo, that misses the whole point of content negotiation (for language, et al). In the age of search engines though, different urls are often perferable.
- thaumasiotes 4mo ago> No, that misses the whole point of content negotiation (for language, et al). There's been some pushing for browsers to automatically decide what language you want to view a webpage in, and that is even more insane than the User-Agent header is. The correct solution for content that exists in multiple languages is to make each language available at its own URL. Just like I already said. Why in the world would you want to lose the option to select the language you want?
- esrauch 4mo agoI feel like this is with 2026 view where browsers are so mutually compatible. In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this. No user agent would probably have only entrenched IE6 dominance even more by blocking you from deliberately making a site that works at all on other browsers (including IE7 for that matter)
- vlovich123 4mo agoThis tanh approach won’t tell you if you’re in a VM - it’ll report the guest OS
- zx8080 4mo agoInfinite captcha welcomes those who are using FF and linux on stackoverflow. Easier to skip its links in search results than waste time solving it (captcha never finishes).
- preg_match 4mo agoI have a user-agent switching extension, and I use it because some websites like to claim up and down "ohhh we don't work on Firefox!" but then you switch to chrome's user-agent and - surprise! - no bugs at all. I mean, I get it, saying you support something is technically a commitment. But my goal is to basically never open a chromium browser, so, I'm gonna do what I have to do. And you would be shocked, in the past 5 years I have only encountered ONE website which legitimately required a chromium browser. grapheneos.com, for the web usb installer.
- joahnn_s 4mo agoYou can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it
- georgemcbay 4mo ago> otherwise I would never publish an article due to lack of time, and I assume Didn't even have time to finish their HN reply.
- Arch-TK 4mo agoIt takes less time to write the prompt, you could just publish that? It's an important topic, and I am glad you wrote about it, but even half a page of notes would have been enough to convey this. It would save me literally skim reading headings just to get past all the fluff.
- rootusrootus 4mo agoIsn’t “just post the prompt” a joke? That only works if the content was one-shot, and I bet that (much like code) most isn’t.
- deleted 4mo ago[deleted]
- Arch-TK 4mo agoI didn't mean it completely literally. But presumably you have an idea for a post outline: * Title * Brief * Table showing the issue * Notes about CSS/JS disparity * An idea for why it happens. * The idea/code for a solution. This could just be: Chromium allows websites to figure out your OS using math functions Chromium's implementation of Math.tanh and CSS trigonometry functions since version 148 uses the host libc implementation. This is a problem because libc implementations vary between operating systems and can produce slightly different results on different platforms (and potentially even different versions of the same platform). This can be used to accurately distinguish between Linux, MacOS and Windows. Here's a table showing the issue with Math.tanh: ... For javascript, so far it's only Math.tanh that uses the system libc, the rest of the functions are implemented in V8. But for CSS it's worse, all functions use the libc versions. Since math should be deterministic, it would be an improvement to privacy as well as platform uniformity to have V8 implement tanh and have the CSS use those implementations too. <side>Notably there are also some quirks in Web Audio. ...</side> Here's some code which when compiled with `-ffp-contract=off` will produce the same MacOS result on all the other platforms Chromium supports. One option is to just unify the results, another is to make them match the claimed platform. ... --- It took me 10 minutes to draft the above. With the effort it probably took to prompt that blog post, you could probably get it proofread, generate the table if you have access to the right boxes but don't have it already. And produce the right code with a test harness, verify it. It's a lot shorter, but that's because the post doesn't really have that much content. There's huge quantities of fluff, the entire "Four Traps" section is so incoherent that I still don't get what it's trying to say after trying to read it 4 times on two different occasions.
- comex 4mo agoThis can be used to fingerprint version range, but so can a million other things. Browsers are constantly adding new features and fixing bugs, most of which can be detected from JavaScript.
- userbinator 4mo agoThe LLM has a good point. I personally don't care what or who wrote it if it's true.
- cookiengineer 4mo agoFun fact that will blow your mind: Microsoft decided to send Windows NT 10.0 in the User-Agent header even on Windows 11 for compatibility reasons. That's literally the reason why the Sec-CH-* headers say Windows 11 but the User-Agent says Windows 10. And regarding your claims of vendor interests: Nope, you seemingly never had to use O365 crapware on Linux browsers. They make it as painful as possible, and even disable copy/paste functionality when your User-Agent and Sec-CH headers say Linux. Identical browser with an extension that overrides the fingerprinting headers and it works perfectly. Also as an additional note: Cloudflare does TCP fingerprinting, because no cloudflare pages will work (and send you into an infinite loop of unsolvable captchas) when these headers mismatch with the tcp window and other options in the handshake frames. Source: am maintaining my chromium-profiles tool that generates farbled profiles with a generated extension, so that I can use shitty Microsoft products because my customers are not really the smartest policy decision makers. PS: I will never use a separate laptop with a separate OS to use a damn web app. That is a completely unjustified waste of hardware resources and should be illegal. But here we are. Wasting one laptop at a time for absolutely no reason. [1] https://github.com/cookiengineer/chromium-profiles https://github.com/cookiengineer/chromium-profiles
- cute_boi 4mo agoAfter reading this I am sure 90% of text is from AI. This is so annoying to read.