HackerTrans
TopNewTrendsCommentsPastAskShowJobs

joahnn_s

246 karmajoined il y a 2 ans

Submissions

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev
421 points·by joahnn_s·hier·215 comments

Nginx Unit project is about to be archived

github.com
6 points·by joahnn_s·il y a 9 mois·1 comments

comments

joahnn_s
·hier·discuss
You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version

And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it
joahnn_s
·hier·discuss
The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith
joahnn_s
·hier·discuss
We noticed Chromium Math.tanh since v148 returned a different result, so we dig it - it's now a fingerprintable surface to retrieve the OS Chromium run on
joahnn_s
·il y a 8 mois·discuss
Here's another one: https://scrapfly.io/web-scraping-tools/browser-fingerprint They actually delve much deeper, with a wealth of additional data and interesting details.

For example, in the DRM section, they extract the Security Level, like L3 – Software Decode (SW_SECURE_DECODE).

Their WebRTC test is also unique: they utilize a TURN server as a feedback mechanism. That means even if you tamper with WebRTC JS in the browser (like some extensions do), it can still expose your real IP by leveraging UDP and bypassing the proxy altogether. https://scrapfly.io/web-scraping-tools/webrtc-leak
joahnn_s
·il y a 9 mois·discuss
It's sad news to see that Nginx Unit is going to be abandoned, as no maintainers showed up, and it is still being used by many
joahnn_s
·il y a 10 mois·discuss
Who's actually expecting `xyz.com` here?

Spec: https://go.dev/ref/spec#Selectors > x.f resolves to the field/method at the shallowest depth in T. If there isn’t exactly one at that depth, it’s illegal.

Embedding promotes fields; on name collisions the shallowest wins. So `opts.URL` is `FooService.URL` (depth 1), not `BarConnectionOptions.URL` (depth 2).
joahnn_s
·il y a 10 mois·discuss
We need the iconic sound of the geiger counter
joahnn_s
·il y a 10 mois·discuss
The whole purpose of crypto is to exchange money online like we exchange cash in person, so who wants PayPal as a middleman on a tech designed not to have a middleman? Who will use that
joahnn_s
·il y a 10 mois·discuss
This is the paradox: Imagine walking dressed in red in the middle of a crowd dressed in black.

Being unique makes one easily identifiable and requires less effort to correlate one's past activity, while non-unique ones are full of noises and low confidence.