chjj

> You have to compromise a lot to be able to make a MITM here.

This is just an argument against TLS in general. Use plain http if you believe this.

It doesn't. This case applies more to MVB.

> Why give up information when you don't have to?

Yeah, I generally agree with that viewpoint, but you are giving up that information, even without JS.

Your TCP stack can be fingerprinted through long enough observation. Windows, Mac, and Linux all look different on a network level. It's not as simple `if XYZ then OS = Windows`, it's more holistic/probabilistic, but it's possible nonetheless.

e.g. One thing that bugs me about arch linux is that they recently changed the kernel default TCP keepalive time to be shorter (much shorter[1]), making arch users stand out a lot. So, not only can a fingerprinter identify your OS, they might be able to pin down your exact distro based on TCP behavior alone.

I guess my point is that hiding the OS would be a massive amount of effort to plug a hole that cannot be plugged without effectively controlling the entire OS. TB/MVB is limited in what it can do by itself.

[1] https://rfc.archlinux.page/0051-tcp-keepalive/

I think they made the right call on that. It's unclear to me whether hiding the OS is even possible. There's just too much OS-specific behavior that happens inside (and outside) a web browser. It's hard to account for all of it.

OS rendering differences can likely betray you even when canvas extraction is blocked/noised. At least one tor-browser dev has publicly confirmed that you can't even hide the difference between X11 and Wayland[1], nevermind two entirely different OSes.

[1] https://forum.torproject.org/t/linux-is-it-alright-to-run-th...

The analogy falls apart when "your store" is actually a handful of multi-billion dollar corporations that surveil a significant portion of the internet and covertly grant government agencies (and god knows who else) access to the data.

It's passive surveillance on the order of billions of people. It's not a mom-and-pop shop.

I'm not even sure I'd want to make it narrow. I'd start with:

"Information gained via side-channel for the purpose of correlating individuals."

But you'd have to add an enormous amount of legalese after that to make it ironclad. They'll start arguing "this isn't a side-channel", "we're targeting bots, not individuals", etc. You'd have to define every word in that sentence very carefully.

I'd make it sweeping. "Individual" can mean "person", "bot", "suspected bot", "AI agent", "a piece of autonomous or non-autonomous software", basically anything. The "side-channel" definition might get trickier, but I'd rather legit use-cases get burned than privacy get burned.

The OP was downvoted, but I agree. I think fingerprinting should be in the same criminal category as an illegal wiretap.

it's elegant, but i prefer:

    Math.tanh = Math.random;

They didn't call it a day. They created an entire deceptive hype cycle around it.

Yeah, it never works though, as you can see from this example.

You should use AI.

If this is your opinion, I ask you: are you okay with AI reviewing the PRs as well, or do you prefer a human to do it?

Think carefully before responding.

That means all AI code would simply be rejected. This saves time.

Very cool project. Is it always an LD_PRELOAD or can it function as a standalone SOCKS proxy similar to wireproxy?

Fair enough. I haven't looked at the internals of ghostty, so I'll take your word for it.

I'm probably also just taking things personally.

I don't mean to derail discussion about a cool project, but it still seems to imply xterm.js is somehow "improper" emulation (though I might be misreading it).

Terminal emulators are all approximations of terminals, regardless of the programming language.

> In case of the Tor browser, they use the user agent to blend in, so they are not a good candidate to do anything about how stupid the user agent is.

No. They don't use it to blend in. If they wanted to blend in they would be modifying every platform's user agent string to look like Windows x86_64 or something. They don't do that because there's no way they could possibly get away with it.

Instead, they're resigned to simply censoring the minor version number of the browser to reduce entropy.

> Fun fact, non-browsers actually have much nicer user strings. I run an internet radio, and there is a lot of clients like

And those tools will get blocked by various CDNs for not having a browser user agent string, not having a browser-like TLS handshake, etc. This is why projects like curl-impersonate and golang's utls had to be created.

Then the ideal would be to normalize the user agent string to look identical on every platform. My point is: they can't do that. e.g. A linux machine identifying itself as windows would be spotted immediately. Instead, they have to reduce entropy by bucketing you according to your device/OS/arch.

I tried doing that in the early 2010s. Even back then it didn't work (github broke for example). If you did it today, you'd likely be blocked by a lot of major websites for "lying" about your user agent. Cloudflare turnstiles will stop working, you'll get captcha'd to death, and so on.

Even tor-browser doesn't dare to modify the user agent string in any major way. It's almost impossible to lie about because trackers don't actually care about your user agent. They're identifying your device/OS through side channels (canvas, webgl, fonts, etc).

I don't think it's a strange comment. He's mostly right (and so are you, but I think you're talking past each other). There's nothing wrong with SRS, and I agree with you that it's basically like cheat codes for memorization, but there is a limit to what most people can do. i.e. most people do tend to drop off.

I remember reading some stats from WaniKani (Japanese SRS app) a while back...

WaniKani has 60 "levels" to learn 2000+ kanji. Each level takes about a week (there's no skipping ahead), so the material takes about a year of study to complete -- that's if you're going at breakneck pace, which most people aren't.

According to the numbers I saw on the WK forums, ~8% of users reach level 30 and less than 1% reach level 60... and that's just to learn as much kanji as a 9th grader. That's to say nothing of the grammar and the 20,000+ vocab words you'll need to SRS to truly learn the language, or the thousands of hours you'll have to spend speaking/listening/reading, immersing yourself in native content, etc.

People give up very easily. The language learning community often gives year estimates to reach "near-native level" in a language based on frequency of study. In reality, the process takes a lifetime. I don't know if people truly know what they're signing up for when install those apps and begin studying. It's a lifelong commitment. It's just something you do now, every day.

You can stop at any time of course, and most people do (more than 99% of them apparently).

This brings back memories. I haven't looked at it in a while, but I'm glad to see the fork[1] of my fork[2] from 12 years ago is still thriving. Looks like it's been mostly rewritten. Probably for the better.

[1] https://github.com/xtermjs/xterm.js [2] https://github.com/chjj/term.js

My mistake. I thought your comment about being a skeptic was referring to the language itself.

It sounds like you had a good experience with the rust community. I'm glad it worked for you. But from what I've seen, it's not for me.

I think I started by saying we simply have different experiences. That is the opposite of me saying my experience is universal.

I most definitely have bias. I'm a human being. I have biases and preferences. Too many to count.

Anyway, thanks for talking to me. It was engaging in spite of the negativity.

FTR I don't really have a problem with the rust language. I think there's some interesting ideas in there. I don't really like the syntax, but that's a minor nitpick.

Not sure what to make of your other comments.

You're upset that I dislike your community. I'm a rando on the internet. I'm nobody. You shouldn't care that I "insulted your group". I don't really have any impact on your life, so you probably shouldn't take it so personally.

I'm not surprised about the reaction to my generalization. I've said before that it's precisely what I expected. Though, I think my exact wording was something like "this behavior is characteristic".

I'm happy to say that I do generalize a lot. It saves time in many situations, with minimal downside.

Fair enough. I suppose it is my most recent encounter. The result: I still don't like the rust community. You may have different opinions. I see no issue here.

I don't ever recall saying I'm being repressed. Could you point out where I said that?

If you're referring to my above post, I'm pointing out that you're having a very emotional reaction to what I'm saying. That's typically what I see from rust developers.

I wouldn't go so far as to say toxic in this case, but their reaction to me having a differing opinion is certainly characteristic of rust developer pathology. Not sure why rust attracts these people. This phenomenon should probably be studied.

I told you the rust community is full of cultists and I presented an example. You dismiss the example as the ravings of a lunatic -- but that's exactly my point: it's a community full of lunatics.

> never actually seen the people doing that thing

I'm happy to share then. Here's my most recent encounter with a rustacean: https://x.com/_chjj/status/1829989494298460636

I asked if he/she/they had ever used the unsafe keyword. That was the response I got. It's usually some vile insult involving furry or transgender genitalia.

We have very different experiences then. Don't know what to tell you.

Every interaction I've had with a rust programmer has led me to believe they are a toxic community of cultists. It's unlike any programming community I've seen.