Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

Post reply on HN
Print view View original

211–220 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#211

Post by Arch-TK »

rootusrootus wrote: post #159
Arch-TK wrote: post #80

Earlier quoted context omitted.

It takes less time to write the prompt, you could just publish that? It's an important topic, and I am glad you wrote about it, but even half a page of notes would have been enough to convey this. It would save me literally skim reading headings just to get past all the fluff.

Isn’t “just post the prompt” a joke? That only works if the content was one-shot, and I bet that (much like code) most isn’t.

I didn't mean it completely literally. But presumably you have an idea for a post outline:

* Title

* Brief

* Table showing the issue

* Notes about CSS/JS disparity

* An idea for why it happens.

* The idea/code for a solution.

This could just be:

Chromium allows websites to figure out your OS using math functions

Chromium's implementation of Math.tanh and CSS trigonometry functions since version 148 uses the host libc implementation. This is a problem because libc implementations vary between operating systems and can produce slightly different results on different platforms (and potentially even different versions of the same platform). This can be used to accurately distinguish between Linux, MacOS and Windows.

Here's a table showing the issue with Math.tanh:

...

For javascript, so far it's only Math.tanh that uses the system libc, the rest of the functions are implemented in V8. But for CSS it's worse, all functions use the libc versions.

Since math should be deterministic, it would be an improvement to privacy as well as platform uniformity to have V8 implement tanh and have the CSS use those implementations too. Notably there are also some quirks in Web Audio. ...

Here's some code which when compiled with `-ffp-contract=off` will produce the same MacOS result on all the other platforms Chromium supports. One option is to just unify the results, another is to make them match the claimed platform.

...

---

It took me 10 minutes to draft the above. With the effort it probably took to prompt that blog post, you could probably get it proofread, generate the table if you have access to the right boxes but don't have it already. And produce the right code with a test harness, verify it.

It's a lot shorter, but that's because the post doesn't really have that much content. There's huge quantities of fluff, the entire "Four Traps" section is so incoherent that I still don't get what it's trying to say after trying to read it 4 times on two different occasions.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#212

Post by hilariously »

AlotOfReading wrote: post #75
hilariously wrote: post #65

Earlier quoted context omitted.

fixed-point provides uniform precision, exact integer-scaled arithmetic, is deterministic whereas floating point is more convenient but its not a panacea

As I said, floats can provide results that are no worse than a specified fixed point type. So if you want uniform absolute precision, just round down to the required precision. Floating point is generally deterministic in practice with a fairly minor amount of effort, the major remaining issue being library rounding. I actually wrote a library that guarantees this for arbitrary code, with some small, obvious caveats…

Totally fair if you have full control, my experience is often with databases where you can get warnings that float implementations can even change per-operating system (thanks MySQL) or per query plan (based on plan ordering) which is ... pretty bad!

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#213

Post by Chu4eeno »

1vuio0pswjnm7 wrote: post #177
nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

"The HTTP User-Agent header was a mistake form the beginning." User-Agent spoofing was added to NCSA Mosaic in 1996. The public www was three years old and text-only clients were still in widespread use https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas... NCSA Mosaic is the early graphical browser that begat Netscape Navigator that begat Firefox. Later came Internet Explorer, Safari, Chrome and so on What…

I take it you either have a godly IP reputation, or you don't hit 90% of the current internet which is behind cloudflare, google, akamai, etc?

They're pretty brutal in blocking non-browsers, I tend to have to add a lot of useless headers.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#214

Post by matheusmoreira »

oasisbob wrote: post #193
matheusmoreira wrote: post #136

Earlier quoted context omitted.

> at scale, to the degree that you're taking down my site Fair. Scrapers should be polite and do their utmost to consume the smallest possible amount of resources. > without my consent by masking your user-agent Your consent is not required. It's my user agent. I set it to whatever I want. > for the purpose of stealing data I didn't authorize you to have Data can't be "stolen", only copied. You set up an HTTP server…

> Data can't be "stolen", only copied Though, scrapers can certainly steal capacity through conversion for their own use. When they do so, they permanently deprive the site owner and other users the beneficial use of that capacity at that time. I'm speaking morally, not legally. Though, in the US at least, there are parallels with free newspapers. You're allowed to take one for free. It's not legal to clear the whole…

That's a much better argument, and one I agree with. Scrapers should be polite and consume the least amount of resources possible, ideally less than what a person would consume by browsing the website normally.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#215

Post by pocksuppet »

mplewis wrote: post #44
pocksuppet wrote: post #41

Earlier quoted context omitted.

scraping, however, is not intrinsically a scam.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

That isn't the type of scraping being discussed here.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#216

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #177
nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

"The HTTP User-Agent header was a mistake form the beginning." User-Agent spoofing was added to NCSA Mosaic in 1996. The public www was three years old and text-only clients were still in widespread use https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas... NCSA Mosaic is the early graphical browser that begat Netscape Navigator that begat Firefox. Later came Internet Explorer, Safari, Chrome and so on What…

HN replies sometimes (often) include statements unsupported by evidence

For example, something like "90% of the current internet is behind Cloudflare, Google, Akamai, etc."

The www is only subset of the internet and "90% of the internet" does not use a CDN

In any event, even if "internet" means "www" there is no evidence to support this statement

https://www.netcraft.com/blog/may-2025-web-server-survey

Further, being "behind Cloudflare, Google, Akamai, etc." does not necessarily mean a User-Agent header is required

For example,

https://www.cloudflare.com does not require a UA header

https://example.com is "behind CF" and does not require a UA header

https://www.google.com does not require a UA header

https://developers.akamai.com does not require a UA header

And so on

Individual www users, unless doing mass scanning or the like, probably do not access 100% of the www's sites (according to Netcraft, most are inactive)

More likely, individuals access only a fraction of the active sites

It's unlikely that individuals access exactly the same list of websites^1

For me personally, the vast majority of sites that I access do not require a UA header

The sample set I use as evidence to support comments I make about this on HN is a list of all sites submitted to HN over a recent period.^2 Currently this is 12,641 sites

1. To have a meaningful discussion about UA header requirements, a sample set of sites must be agreed upon

2. Perhaps HN readers access these sites and possibly access some of the same sites. Of course it's also possible that there are HN commenters who do not actually access HN submissions and instead only read comment threads and submit replies

https://news.ycombinator.com does not require a UA header

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#217

Post by NetMageSCW »

chrismorgan wrote: post #190
nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

When distributing software, it’s very useful to know which OS and which architecture the user is on in order to present them with the appropriate file.

Or you could let the user decide since you have no idea what system they want to execute the software on, just what system they are using to browse your site.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#218

Post by NetMageSCW »

Asraelite wrote: post #79
pdpi wrote: post #73

Earlier quoted context omitted.

As with anything IP-related, the data is licensed under whatever terms you choose to impose. That’s the extent of the consent you’ve provided.

Permission to access is not the same as permission to use.

Reading is using.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#219

Post by NetMageSCW »

Mistletoe wrote: post #103
reactordev wrote: post #24

Earlier quoted context omitted.

The Internet is a cesspool of scams now

Has the internet made the average human’s life better? As someone that lived in both eras I have to say no. If you want to improve humanity greatly and prevent currently 8.3 billion people’s misery and counting, you build a time machine and prevent Tim Berners-Lee from inventing it in the first place. But it wouldn’t help, because someone else would still invent this torture nexus of hyperconnected human minds.

Ask those who had no medical assistance before the Internet. Or ask Ukraine.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#220

Post by vlian2088 »

dang wrote: post #189
vlian2088 wrote: post #99

Earlier quoted context omitted.

[flagged]

Can you please not post AI-generated or AI-edited comments to HN? It's not allowed here - see https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079 . Of course, it's impossible to know for sure what was LLM processed or not, but some of your posts (like this one) have been getting classified that way.

if your classifier had classified anything other than that comment (clearly satirical, come the fuck on) and the deleted attempts to get it past your spam filter, then it is a touch too sensitive.
Post reply on HN