I’m naive here but why would Chrome release a headless browser that makes it easier for bot developers to avoid detection?

This blog post is written that way because the guy works in the bot detection business so it's what he cares most about.

But there are still plenty of legitimate use cases for wanting a headless browser that perfectly replicates a normal browser environment. The obvious ones are automated frontend testing tools like https://playwright.dev/

Exactly. And as the blog post mentioned, people who have a strong need to block bots have tools other than browser fingerprinting at their disposal. Quoth the post:

> It’s important to leverage other signals such as:

>

> * Behavior (client-side and server-side)

> * Different kinds of reputations (IP, sessions, user)

> * Proxy detection, in particular, residential proxy detection

> * Contextual information: time of the day, country, etc

> * TLS fingerprinting.

Having a headless browser that behaves exactly like a normal one is tremendously useful for making things. And people who really *need* to block bots also need to contend with "mechanical turk" style attackers anyway. These techniques are also very useful against that approach, which still may be cheaper than making an undetectable bot even with a near-perfect Chrome fingerprint available headless.

We use a headless browser to load an internal webpage (with content that may be updated several times per day) and generate a pdf on-demand.

As a bot developer, without taking legal steps (I do not break the law) there is no stopping me regardless.

Because none of the people complaining about headless bots (read probably: content and retail) are major stakeholders from Chrome's viewpoint.

headless browsers or are faster than the normal browsers (no GUI) so your tests run faster

PM working on Headless here. Masking bots is not the reason why the new Headless mode was created. The goal is to provide an headless browser that can be used in web tests. The original Headless is essentially a separate browser implemented in parallel to "proper" Chromium. That results in all sorts of subtle reproducibility problems for developers using Headless for their tests.

> PM working on Headless here. Masking bots is not the reason why the new Headless mode was created.

Right. But it will be massively used just for that.

Yes, same as many technologies with legitimate uses. Tor is largely used for illegal activities, yet many would say the anonymity it provides for the general public is worth it being created (or the anonymity it provided for US intelligence).

I'm not chasting anyone for building a piece of cool tech but that does seem like something like a holy grail for bots.

Nice to know you are the arbiter of what is and what isn't a "cool piece of tech"

I don't know whether you're illiterate or just maliciously misinterpreted what I wrote.

> Masking bots is not the reason why the new Headless mode was created.

You might consider looking into some resources on Intent vs Impact (eg, [0]).

IMNSHO, anyone working in tech has a responsibility to consider what their creations can be used for, in addition to what they intend them to be used for. There's just too much potential for scalability of nefarious behavior to do otherwise.

[0] https://www.masterclass.com/articles/intent-vs-impact

Please reveal what you work on so I can publicly judge whether you have considered and properly chosen between intent vs impact or any other possible moral failings of your work as I see it.

This is such good news to hear. Browser test automation was a pretty sore spot. I'm excited for your work.

PM working on Private Browsing mode here. Watching pornography is not the reason why the new Private Browsing mode was created. The goal is to provide an Private Mode than can be used for Christmas shopping. ;)

In all seriousness, despite intentions, and I do love headless mode for actual integration tests with Webdriver, it’s no exaggeration to say that it is likely the single greatest avenue for bots and spam enablement across the entire internet, and imo is probably net Bad.

A necessary evil for supporting an open and programmable internet (IMO).

It seems more neutral to me. Yes there's a lot of spam and other types of malicious behavior, but I don't think it's good overall to try to eliminate web automation entirely to stop it.

If it weren't for bots there would be no search engines, no internet archive, no WWW. Bots, and the tools for making them, are essential to the functioning of the web.

Chrome sets navigator.webdriver to true when controlled by automation.

Until now, bots could simply use headful mode to achieve the same effect that is now made available through the new headless implementation.