Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

Post reply on HN
Print view View original

191–200 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#191

Post by mvdtnz »

0xbadcafebee wrote: post #166
coldbrewed wrote: post #61

Earlier quoted context omitted.

I work at a CDN that provides bot detection services. I agree that there's baseline necessity in terms of fraud detection, and if not necessity then definitely financial motivation to fingerprint. But these days, abusive scraping is far and way the the main driver for fingerprinting. We don't fingerprint for ad purposes, and we destroy PII for humans as fast as we can because PII should be treated as radioactive. But…

> we see customers that are constantly burned by abusive scrapers and the scrapers aren't slowing down So, I have two dumb questions: 1) Can't the customer rate-limit connections? If the "abuse" in scraping is the number of requests... limit the number of requests? 2) There is probably a market now for federated authentication where the provider gives legal guarantees of anonymized fingerprint in exchange for either…

> If the "abuse" in scraping is the number of requests... limit the number of requests?

Step one in doing this is identifying which requests are coming from the same agent. Guess what fingerprinting helps with.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#192

Post by saghm »

esrauch wrote: post #113
nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

I feel like this is with 2026 view where browsers are so mutually compatible. In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this. No user agent would probably have only entrenched IE6 dominance even more by…

And you can see how well that worked by how many user-agents are such a sane, terse description of the browser rather than a hodgepodge of random words that give the impression that they're trying to seem like every browser at once.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#193

Post by oasisbob »

matheusmoreira wrote: post #136
mplewis wrote: post #44

Earlier quoted context omitted.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

> at scale, to the degree that you're taking down my site Fair. Scrapers should be polite and do their utmost to consume the smallest possible amount of resources. > without my consent by masking your user-agent Your consent is not required. It's my user agent. I set it to whatever I want. > for the purpose of stealing data I didn't authorize you to have Data can't be "stolen", only copied. You set up an HTTP server…

> Data can't be "stolen", only copied

Though, scrapers can certainly steal capacity through conversion for their own use. When they do so, they permanently deprive the site owner and other users the beneficial use of that capacity at that time.

I'm speaking morally, not legally. Though, in the US at least, there are parallels with free newspapers. You're allowed to take one for free. It's not legal to clear the whole rack.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#194

Post by codedokode »

joahnn_s wrote: post #36
codedokode wrote: post #29

Earlier quoted context omitted.

Why don't you ask browser developers to stop adding features helping fingerprinting? Browsers even have some API for tracking ad clicks (attribution API or something) and user interests tracking API which nobody of the users needs.

The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith

But they added ad clicks tracking API ("Attribution Reporting API") and interests tracking API ("Topics API") into the browser which work behind user's back and against their interests.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#195

Post by codedokode »

sunnybeetroot wrote: post #179
0xbadcafebee wrote: post #166

Earlier quoted context omitted.

> we see customers that are constantly burned by abusive scrapers and the scrapers aren't slowing down So, I have two dumb questions: 1) Can't the customer rate-limit connections? If the "abuse" in scraping is the number of requests... limit the number of requests? 2) There is probably a market now for federated authentication where the provider gives legal guarantees of anonymized fingerprint in exchange for either…

1) Scrapers often rotate ip per request, rate limiting doesn’t help

Rate limiting requires them to buy more IPs (which are not free) and slows down scraping.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#196

Post by sunnybeetroot »

codedokode wrote: post #195
sunnybeetroot wrote: post #179

Earlier quoted context omitted.

1) Scrapers often rotate ip per request, rate limiting doesn’t help

Rate limiting requires them to buy more IPs (which are not free) and slows down scraping.

Yes, that’s what the big scrapers are doing (frontier AI labs). They have infinite money for this.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#198

Post by jeroenhd »

nradov wrote: post #106
mplewis wrote: post #44

Earlier quoted context omitted.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

What data is being stolen? Are you referring to copyright violation or something else? If you don't want LLM companies to scrape a site then just restrict access to authorized users. Simple.

That's what's being done, isn't it? Fingerprinting technologies and proof of work are trying to authorize people and block bots. Unfortunately, companies like these are trying to bypass the authorization controls.

If these scraping companies would respect some kind of X-Scraping-Permitted header, this whole process would be a lot better, but that's not going to happen in an industry that has already normalized using botnets.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#199

Post by amelius »

chjj wrote: post #104
akersten wrote: post #20

Earlier quoted context omitted.

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

The analogy falls apart when "your store" is actually a handful of multi-billion dollar corporations that surveil a significant portion of the internet and covertly grant government agencies (and god knows who else) access to the data. It's passive surveillance on the order of billions of people. It's not a mom-and-pop shop.

Yes, and we need a name for the fallacy of GP. It's a recurring theme.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#200

Post by esrauch »

smaudet wrote: post #164
tyami94 wrote: post #154

Earlier quoted context omitted.

road to hell is paved with good intentions. one could argue it would've made browser vendors fix their bugs, but with the side-effect that any behavior that isn't bug-compatible with IE becomes a bug. this would've ironically entrenched IE permanently.

The mistake was not claiming features rather browser client versions... JS devs were kinda able to patch around the nonsense because they were able to feature-detect - part of the reason this stuck around was because no legitimate user or dev cared (or should care). But the header was mostly (useless) noise, and the people spoofing were dealing with the couple bad apples of the time. Of course, defining features is e…

I just can't see how it could make sense to define features when a ton of the the behavior wasn't even intentional but just tons of bugs. I recall debugging issues that only reproduced in "IE7 compatibility mode of IE8" which didn't reproduce in either IE7 or IE8. And that was already after the standards were taken at all seriously
Post reply on HN