Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

111–120 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#111

Is this even a fight that is possible to win here? Run enough functions and between timing comparisons (x takes 2.5 y) and rounding (things like this) and I suspect you can nail os/exact machine and possibly even other tasks running on that machine. I'm not sure there is a viable way to stop this. At best just make it a little harder? Society and legislation need to catch up here. It is like a lock on my door. Locks…

Sure, except that in cyberspace a lot of the people who are doing things that are — or should be — illegal are located in jurisdictions where no enforcement is possible. Places like Russia, Myanmar, and North Korea have no concept of the rule of law and criminals who scam foreigners are actively protected by local authorities. So analogies to door locks completely break down there.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#112
post #107

Earlier quoted context omitted.

I disagree, fingerprinting is necessary to track humans and it will be used regardless of scrapers being there or not.

Why is it necessary to track humans? It might be more profitable for advertising but that's not the same as necessary .

Tracking humans isn't necessary. Fingerprinting is necessary to tracking humans.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#113
post #101

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

I feel like this is with 2026 view where browsers are so mutually compatible.

In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this.

No user agent would probably have only entrenched IE6 dominance even more by blocking you from deliberately making a site that works at all on other browsers (including IE7 for that matter)

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#114

Earlier quoted context omitted.

Sounds needlessly divisive. Why not criticize the content instead of the source or medium?

"The content is AI slop and not worth reading"

None of that is specific to the actual content. Might as well just say "I don't like it" which is also not objective analysis.

This article was about math functions, chrome, etc. If the author got something wrong, mention that, or if you don't like the pacing or how the content was divided into pieces, etc.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#115

Earlier quoted context omitted.

I am not so paranoid, and I haven’t been working with AI, so my AI-dar is bad. But I keep reading technical writeups like this, then getting frustrated at the writing style or incomplete explanation – this one was more complete than most, though it was repetitive. Then I come read the HN comments, and I see that it was LLM-generated. (To be fair, this one says so up top. Even so my eyes skipped over it.) So I find th…

Ooh, the disclaimer is new, it wasn't there originally: https://web.archive.org/web/20260712212920/https://scrapfly....

Damn I literally came here to say "it's nice to see an actual disclaimer!"

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#116
post #101

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

It certainly wasn't a mistake in the beginning, but it's certainly a mistake now.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#117

Earlier quoted context omitted.

I recommend pretty much everyone avoid fixed point and other float alternatives, barring exceptional cases after you've done your own numerical analysis, or you lack floating point hardware (rare these days). Yes, fixed point can use simpler hardware. That's also a completely irrelevant consideration for software. The vast majority of processors are optimized for floats now and some operations (e.g. division) are act…

I didn't recommend fixed point for simpler HW - I recommended it for better precision (if you know what you are doing). First, a point I didn't make, is that if you have 32 bits of fixed, you get way more precision than with a 32 bit float. But I can think of a pretty common case where a 24 bit int would win against a 32bit float: convolution filters. If you have a filter whose inputs are supposed to sum up to 1 (whi…

    First, a point I didn't make, is that if you have 32 bits of fixed, you get way more precision than with a 32 bit float.
That's true, but I already responded to it. If you step up to the next size of float (e.g. f64), you have more precision than the fixed32. You can do exactly the same computation in f64 with equivalent inputs, and you'll get better precision than doing it in fixed32. Or you can round at every step like fixed does and get a bit-equivalent value if you don't want the precision. It's less memory efficient, but my point is that the remaining use cases for fixed point are exceptional/situational and getting increasingly niche.

Maybe using a bigger float type is cheating, but it's basically free because of the ubiquitous support for floats.

    In contrast, with floats, you can lose precision.
This only happens with values outside the range of your fixed point type if you use larger floats as mentioned above. I consider that a different argument. You can alternatively view this as the float handling a situation more gracefully than fixed point would have.

    Afaik finance people don't even use floats for things like account balances, because you can't represent something like 0.1$ exactly.
Finance types typically use decimal types from what I understand. This is really just the result of using a decimal syntax to initialize/output a binary representation. Fixed point has exactly the same problem. Decimals have an analogous issue with the value 1/3.

    It has other advantages, like your calculation running the exact same regardless of CPU and/or compiler, which I'm sure a lot of analysts care about.
I wrote a library that makes floats more practically deterministic across platforms for very little cost (linked at [0] so you can see the limitations and numbers), and the underlying problem is [maybe] getting a standardized solution in C++29. You can get the same thing today just by changing compiler flags. If you need the special, non-reproducible float functions, your options are mainly to import a library or implement it yourself, same as fixed point.

    Not trying to be antagonistic, just figure out where you're coming form.
I work in safety-critical automotive/robotics, used to do audio DSP, contributed a bit to the aforementioned standardization, etc. I also have a talk on this topic I've been working on for the last few weeks. It's a bit of a pet subject.

    Fixed point has basically no language support, and is very hard to get right, but sometimes you need to do that.
There are absolutely situations for it, but that's exactly it: it's situational. And those situations are increasingly uncommon these days, now that hardware with good IEEE support is essentially ubiquitous and compilers/standard libraries are improving their implementations.

[0] https://github.com/J-Montgomery/rfloat

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#118
post #44

Earlier quoted context omitted.

scraping, however, is not intrinsically a scam.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

I think the key word was "intrinsically".

It's like public photography, it's intrinsically legal, except when it's a Flock camera and then it's suddenly an invasion of privacy.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#119

Even Tor Browser (/mullvad-browser) gave up trying to obscure the operating system though arguably they shouldn't have. There appear to be too many fingerprinting vectors.

I think they made the right call on that. It's unclear to me whether hiding the OS is even possible. There's just too much OS-specific behavior that happens inside (and outside) a web browser. It's hard to account for all of it.

OS rendering differences can likely betray you even when canvas extraction is blocked/noised. At least one tor-browser dev has publicly confirmed that you can't even hide the difference between X11 and Wayland[1], nevermind two entirely different OSes.

[1] https://forum.torproject.org/t/linux-is-it-alright-to-run-th...

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#120
post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

I feel like this is with 2026 view where browsers are so mutually compatible. In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this. No user agent would probably have only entrenched IE6 dominance even more by…

I'm aware of that history and the User-Agent header was a mistake even back then. It took the pressure off of browser vendors and gave them an excuse to not fix their bugs.
Post reply on HN