joahnn_s

I don't understand. CEF exists; why load it as a shared lib/cffi? You just expose your app's process to all the issues that a browser can have, including security issues

In most languages, CFFI crashes the whole app process since it's the same process. Maybe for personal stuff, it can be suitable, but nothing serious

You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version

And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it

The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith

We noticed Chromium Math.tanh since v148 returned a different result, so we dig it - it's now a fingerprintable surface to retrieve the OS Chromium run on

Here's another one: https://scrapfly.io/web-scraping-tools/browser-fingerprint They actually delve much deeper, with a wealth of additional data and interesting details.

For example, in the DRM section, they extract the Security Level, like L3 – Software Decode (SW_SECURE_DECODE).

Their WebRTC test is also unique: they utilize a TURN server as a feedback mechanism. That means even if you tamper with WebRTC JS in the browser (like some extensions do), it can still expose your real IP by leveraging UDP and bypassing the proxy altogether. https://scrapfly.io/web-scraping-tools/webrtc-leak

It's sad news to see that Nginx Unit is going to be abandoned, as no maintainers showed up, and it is still being used by many

Who's actually expecting `xyz.com` here?

Spec: https://go.dev/ref/spec#Selectors > x.f resolves to the field/method at the shallowest depth in T. If there isn’t exactly one at that depth, it’s illegal.

Embedding promotes fields; on name collisions the shallowest wins. So `opts.URL` is `FooService.URL` (depth 1), not `BarConnectionOptions.URL` (depth 2).

We need the iconic sound of the geiger counter

The whole purpose of crypto is to exchange money online like we exchange cash in person, so who wants PayPal as a middleman on a tech designed not to have a middleman? Who will use that

This is the paradox: Imagine walking dressed in red in the middle of a crowd dressed in black.

Being unique makes one easily identifiable and requires less effort to correlate one's past activity, while non-unique ones are full of noises and low confidence.