You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version
And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it
It takes less time to write the prompt, you could just publish that?
It's an important topic, and I am glad you wrote about it, but even half a page of notes would have been enough to convey this. It would save me literally skim reading headings just to get past all the fluff.
I didn't mean it completely literally. But presumably you have an idea for a post outline:
* Title
* Brief
* Table showing the issue
* Notes about CSS/JS disparity
* An idea for why it happens.
* The idea/code for a solution.
This could just be:
Chromium allows websites to figure out your OS using math functions
Chromium's implementation of Math.tanh and CSS trigonometry functions since version 148 uses the host libc implementation. This is a problem because libc implementations vary between operating systems and can produce slightly different results on different platforms (and potentially even different versions of the same platform). This can be used to accurately distinguish between Linux, MacOS and Windows.
Here's a table showing the issue with Math.tanh:
...
For javascript, so far it's only Math.tanh that uses the system libc, the rest of the functions are implemented in V8. But for CSS it's worse, all functions use the libc versions.
Since math should be deterministic, it would be an improvement to privacy as well as platform uniformity to have V8 implement tanh and have the CSS use those implementations too. <side>Notably there are also some quirks in Web Audio. ...</side>
Here's some code which when compiled with `-ffp-contract=off` will produce the same MacOS result on all the other platforms Chromium supports. One option is to just unify the results, another is to make them match the claimed platform.
...
---
It took me 10 minutes to draft the above. With the effort it probably took to prompt that blog post, you could probably get it proofread, generate the table if you have access to the right boxes but don't have it already. And produce the right code with a test harness, verify it.
It's a lot shorter, but that's because the post doesn't really have that much content. There's huge quantities of fluff, the entire "Four Traps" section is so incoherent that I still don't get what it's trying to say after trying to read it 4 times on two different occasions.
In your old comment (which i remembering seeing at time), you seem to recommend scrapy.io and highlight its benefits without disclosing that you're behind it: https://news.ycombinator.com/item?id=46088621
I had to hunt for it that's not clear at all, and if you don't care to spend the effort of writing it, why would anyone want to spend the effort of reading it.
> I stand by it
That's cute, but seriously who cares if you stand by any of "your" words, if you care so little about them to have them be generated by an LLM.
But they added ad clicks tracking API ("Attribution Reporting API") and interests tracking API ("Topics API") into the browser which work behind user's back and against their interests.
We noticed Chromium Math.tanh since v148 returned a different result, so we dig it - it's now a fingerprintable surface to retrieve the OS Chromium run on
For example, in the DRM section, they extract the Security Level, like L3 – Software Decode (SW_SECURE_DECODE).
Their WebRTC test is also unique: they utilize a TURN server as a feedback mechanism. That means even if you tamper with WebRTC JS in the browser (like some extensions do), it can still expose your real IP by leveraging UDP and bypassing the proxy altogether.
https://scrapfly.io/web-scraping-tools/webrtc-leak
Spec: https://go.dev/ref/spec#Selectors
> x.f resolves to the field/method at the shallowest depth in T. If there isn’t exactly one at that depth, it’s illegal.
Embedding promotes fields; on name collisions the shallowest wins. So `opts.URL` is `FooService.URL` (depth 1), not `BarConnectionOptions.URL` (depth 2).
That something is clearly specced doesn’t imply all developers actively know it.
Even given that it compiles, I wouldn’t exclude it being a runtime error.
But the big problem isn’t that it behaves as advertised, it’s that it is way too easy to write opts.URL where you mean opts.Bar.URL. Auto-complete will happily compete the wrong thing for you.
The whole purpose of crypto is to exchange money online like we exchange cash in person, so who wants PayPal as a middleman on a tech designed not to have a middleman? Who will use that
PayPal 20 years ago made it easy to engage in internet commerce across various world currencies. And now users of PayPal have an easy way to commerce with two more world currencies using a familiar trusted interface. Another way PayPal as the middle man helps: "Unclaimed links expire after 10 days", which sounds like it avoids the problem of accidentally sending bitcoin into the void.
I completely understand why I would want paypal as an intermediary in the unlikely case I wanted to send bitcoin to somebody. I think what makes less sense to me is why people who actually like crypto would want paypal.
I want a regulated middleman answerable to democratic legislation. Crypto people (largely) don't.
I guess this is mostly a play that crypto people won't actually care if there's a middleman if it creates some liquidity. That just seems like giving up to me.
>why people who actually like crypto would want paypal
this snippet is everything: "to PayPal, Venmo, as well a rapidly growing number of digital wallets across the world that support crypto and stablecoins"
this is effectively PayPal taking its "closed-loop" payment network, and opening it up to any wallet capable of receiving crypto/stablecoins - which is still a big deal.
your counterparty no longer has to have a PayPal account for you to pay them via PayPal - they can have any crypto wallet and get paid by you - which is in line with much of the crypto vision around global interoperability/payment acceptance/etc. you could compare to Visa/card acceptance as another global payment rail - but the difference here is closer to the difference between global card payments (easy) and global bank transfers (hard)
Easy answer: most people dont arent crypto people but may be open to accepting crypto from crypto people. Aka sending btc to friend/merchant who doesnt have any or vice versa. Crypto people are the small minority
That's the purpose of crypto, yes. As it turns out people like having trusted authority in their money movements, and so now we're watching the crypto world just re-invent the financial industry basically as a digital twin.
Just look at Tether, the darling of the stablecoin world, which is minted by a handful of institutional clients. If you squint hard enough, you can see the banks.
Corporations and businesses aren't the only middlemen in traditional finance. The federal reserve, treasury, and/or whatever settlement system (swift), clearinghouses, and networks (visa etc) exist.
As a naive consumer you might not see all the gears but the layers of complexity in traditional finance are vast compared to the bitcoin whitepaper.
I'm still amazed at how deeply this forum of supposed compsci gurus is hoodwinked by groupthink and a few "scam" headlines from info brokers.
What's the intersection of people who are afraid to set up their own wallet, want to use Ethereum and Bitcoin, and are happy to have PayPal as the one performing their transactions for them? Any of those might be reasonable independently, but it's hard to imagine someone fitting all three.
Quite a lot, because you're forgetting one key group - existing Paypal users who are interested in crypto but not interested enough to proactively pursue it.
I think the opportunity here is getting money from a bank account to an ETH or BTC wallet using "normal" means and not setting up a new account on a crypto exchange. Unless you're getting a paycheck in crypto, someone has to be a middleman.
Absolutely. Cryptocurrency should make payment middlemen obsolete. PayPal should get laughed out of the building here. It's incredible that this has any legs at all. This thread should be full of the names of Ethereum wallets.
You might still want an mediator, sure I can pay you directly on chain but what if you don't even ship my goods? I'm not going to court over an 5$ item but I don't mind engaging PayPal support.
I imagine that most people who use cryptocurrency for payment at all will still need to convert it to something else sometimes. Attempting to use it for everything would be pretty hardcore.
> The whole purpose of crypto is to exchange money online like we exchange cash in person
No, the whole purpose of crypto is to provide an unregulated financial playground for speculation and scams. As they say, "the purpose of a system is what it does".
Scammers, who will need to exit the scheme at some point, while laundering gains in the process. Good thing techbros at PayPal will help with that minor nuisance :)
This is the paradox: Imagine walking dressed in red in the middle of a crowd dressed in black.
Being unique makes one easily identifiable and requires less effort to correlate one's past activity, while non-unique ones are full of noises and low confidence.
And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it