HackerTrans
TopNewTrendsCommentsPastAskShowJobs

joahnn_s

245 karmajoined 2 jaar geleden

Submissions

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev
418 points·by joahnn_s·22 uur geleden·213 comments

Nginx Unit project is about to be archived

github.com
6 points·by joahnn_s·9 maanden geleden·1 comments

comments

joahnn_s
·21 uur geleden·discuss
You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version

And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it
joahnn_s
·21 uur geleden·discuss
The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith
joahnn_s
·22 uur geleden·discuss
We noticed Chromium Math.tanh since v148 returned a different result, so we dig it - it's now a fingerprintable surface to retrieve the OS Chromium run on
joahnn_s
·8 maanden geleden·discuss
Here's another one: https://scrapfly.io/web-scraping-tools/browser-fingerprint They actually delve much deeper, with a wealth of additional data and interesting details.

For example, in the DRM section, they extract the Security Level, like L3 – Software Decode (SW_SECURE_DECODE).

Their WebRTC test is also unique: they utilize a TURN server as a feedback mechanism. That means even if you tamper with WebRTC JS in the browser (like some extensions do), it can still expose your real IP by leveraging UDP and bypassing the proxy altogether. https://scrapfly.io/web-scraping-tools/webrtc-leak
joahnn_s
·9 maanden geleden·discuss
It's sad news to see that Nginx Unit is going to be abandoned, as no maintainers showed up, and it is still being used by many
joahnn_s
·10 maanden geleden·discuss
Who's actually expecting `xyz.com` here?

Spec: https://go.dev/ref/spec#Selectors > x.f resolves to the field/method at the shallowest depth in T. If there isn’t exactly one at that depth, it’s illegal.

Embedding promotes fields; on name collisions the shallowest wins. So `opts.URL` is `FooService.URL` (depth 1), not `BarConnectionOptions.URL` (depth 2).
joahnn_s
·10 maanden geleden·discuss
We need the iconic sound of the geiger counter
joahnn_s
·10 maanden geleden·discuss
The whole purpose of crypto is to exchange money online like we exchange cash in person, so who wants PayPal as a middleman on a tech designed not to have a middleman? Who will use that
joahnn_s
·10 maanden geleden·discuss
This is the paradox: Imagine walking dressed in red in the middle of a crowd dressed in black.

Being unique makes one easily identifiable and requires less effort to correlate one's past activity, while non-unique ones are full of noises and low confidence.