This is AI slop, written for a company that is contributing to the enshittification of the web.
Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
201–210 of 237 posts
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#202Earlier quoted context omitted.
Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?
Because you don't have a right to know everything about me, follow me to my home, my purchasing preferences, and so on and so forth.
Holy slippery slope, Batman. Just because you don't have a right to know everything about you, follow you home, and see what you bought elsewhere, doesn't mean I'm not allowed to observe how your [thing claiming to be a browser] behaves when it connects to my website.
If you want to make it harder to guess whether you're human or a malicious bot, you're going to find yourself clicking on more than just traffic lights and bicycles in the near future.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#203Earlier quoted context omitted.
Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?
> Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? If you have that right, the public should have the right to know you're doing this before they enter your store, so they can avoid it. Same with the websites, they should, legally, have to say they're about to fingerprint you so that you can close your browser tab and never come back.
There's nothing wrong with websites choosing to comply with particular privacy standards. This should be voluntary and used as a trust signal. A website that promises to follow certain standards should be legally accountable if it breaks that promise, but it should not be mandatory to make such promises.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#204Earlier quoted context omitted.
Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?
The analogy falls apart when "your store" is actually a handful of multi-billion dollar corporations that surveil a significant portion of the internet and covertly grant government agencies (and god knows who else) access to the data. It's passive surveillance on the order of billions of people. It's not a mom-and-pop shop.
[dead]
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#205> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…
You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or p…
I had to hunt for it that's not clear at all, and if you don't care to spend the effort of writing it, why would anyone want to spend the effort of reading it.
> I stand by it
That's cute, but seriously who cares if you stand by any of "your" words, if you care so little about them to have them be generated by an LLM.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#206> Scrapium is Scrapfly’s scraping browser
That's what this article is about, their scraping browser fakes the math functions of other browsers depending on host OS, so they can disguise the fact that they're only here for the scraping.
The internet would be better without them.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#207> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…
You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or p…
As another comment points out, you added the disclaimer after publishing (and probably the backlash):
https://web.archive.org/web/20260712212920/https://scrapfly....
So you don't seem to stand by anything apart from swindling.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#208Earlier quoted context omitted.
It was a mistake in the beginning too. If you want to serve different content to different people, you use two different URLs. There's never a valid case for doing it while hiding it from the user.
No, that misses the whole point of content negotiation (for language, et al). In the age of search engines though, different urls are often perferable.
> No, that misses the whole point of content negotiation (for language, et al).
There's been some pushing for browsers to automatically decide what language you want to view a webpage in, and that is even more insane than the User-Agent header is. The correct solution for content that exists in multiple languages is to make each language available at its own URL. Just like I already said. Why in the world would you want to lose the option to select the language you want?
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#209Earlier quoted context omitted.
What data is being stolen? Are you referring to copyright violation or something else? If you don't want LLM companies to scrape a site then just restrict access to authorized users. Simple.
This is the same mindset of criminal in a low trust society btw "If you didn't want me to do this, you should had a fence/cameras/security guards. You shouldn't have dressed like that. You shouldn't have put your phone in that pocket." Excusing trillion dollar corporations like low level criminals is embarrassing. Society shouldn't have to lock itself up because bad actors are spreading everywhere. The bad actors sho…
[dead]
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#210Earlier quoted context omitted.
This is the same mindset of criminal in a low trust society btw "If you didn't want me to do this, you should had a fence/cameras/security guards. You shouldn't have dressed like that. You shouldn't have put your phone in that pocket." Excusing trillion dollar corporations like low level criminals is embarrassing. Society shouldn't have to lock itself up because bad actors are spreading everywhere. The bad actors sho…
Relax buddy, it's just HTTP requests. They're not stealing your phone.
you never heard of HTTP request smuggling or XSS then... Let alone being able to fingerprint and dump all your browser history and session data, cookies, etc.