WebKit VS fingerprintjs

Since 2023 Chrome announced the View Transition API, and it looks like Safari is also going to support it soon.

One heap per type.

Here’s an allocator optimized for that use case.

https://github.com/WebKit/WebKit/blob/main/Source/bmalloc/li...

To use this in Bun, you’d have to start Bun with the environment variable “BUN_JSC_useDollarVM=1” and then $vm.createBuiltin(mySourceCodeString)

When using this intrinsic, if any of the arguments are incorrect or it cannot otherwise enable it, the entire process will probably crash. In debug builds of JSC it will have a nicer assertion failure but that is not enabled in release builds

Example code: https://github.com/WebKit/WebKit/blob/17351231b4dedb62d81721...

also happy to answer any questions about Bun

Ah, good, let me introduce you to the wonderful world of the Chrome Devtools Protocol! (fka Chrome Remote Debugging Protocol)

I love this API for almost everything browser related. I built my RBI product atop this (BrowserBox: https://dosyago.com), and I think it's a drastically underrated API.

Also, it works out of the box in Edge, Brave, Chromium, and many parts of CRDP are supported by Firefox and Safari^1

1: See for example: https://github.com/WebKit/webkit/tree/main/Source/JavaScript...

No, it's unrelated.

https://github.com/WebKit/WebKit/commit/064df1a9f395f8c6e32c...

It's being worked on now: https://github.com/WebKit/WebKit/pull/17320

It is different. The cross-site navigation flag is a couple of years old. It was enabled by default for iOS in November 2018 for example https://github.com/WebKit/WebKit/commit/e191fc8c412850cb9fd0...

Technology Preview versions 173 and newer [58].

[57] is https://github.com/WebKit/WebKit/pull/10169. At the bottom of it, an engineer continues to link ongoing hardening patches for window.open() + process isolation.

> That's excessive scope creep. Adding site-specific workarounds for some sites feels uncomfortable.

Not to Google and its fellow corporations apparently.

https://news.ycombinator.com/item?id=29707078

https://github.com/WebKit/WebKit/blob/main/Source/WebCore/pa...

They have site-specific fixes for their own sites. Why can obviously apply the exact same strategy to dealing with every single website out there. If a website is broken or generally annoying to use, just fix it by providing a site specific version of the browser.

> Who decides what websites get "fixed", and how?

Whoever develops the browser or its extensions. Arguably the whole of uBlock Origin and its filter lists is just a database of site specific fixes. If people can maintain an extremely huge list of advertisers and blockers for every website out there, surely they can maintain something like this too.

> Also, remember how Mozilla is funded.

I remember Mozilla has about a billion dollars in the bank. Who cares about their Google funding? I doubt they're gonna drop them anyway. I bet they pay them just to ward off risk of antitrust lawsuits.

It may not be common, but I did find these (fairly popular projects) which don't appear to allow production usage:

https://github.com/fingerprintjs/fingerprintjs

For this test, I used a variety of device ID and fingerprinting apps, but it turned out that using only one was sufficient. The results you can see in the table below are from Fingerprint OSS Demo app - the same company made this that's behind the powerful https://fingerprint.com. Instead of posting the actual ID values, I replaced them with single-letter representations. All profiles are exactly identical aside from what is in the Setup column.

They already somewhat have.

View the demo in normal mode at https://fingerprint.com/ and then open it again in Incognito

Probably through fingerprinting. There was a post here about https://fingerprint.com/ not too long ago. Go there and press the "View Live demo" button. Now do the same thing in a private browsing window. There's a good chance it'll still know it's you. The best thing you can do is to set the resistfingerpinting option, as mentioned by others, but still this doesn't work 100% of the time.

I am not sure about the state of Goanna's randomization tech, but I know that they don't implement spoofing / randomization for a number of variables that are used by fingerprinters, like hardware concurrency. For example, Firefox's impl includes the following code:

https://fingerprint.com/

I also tried setting privacy.resistFingerprinting = true in Firefox, but it's sad to see that most websites become unusable (most sites using canvas just render a green/purple mess), zooming in Google Maps is basically broken (skips several levels at a time), and like others have mentioned dark mode and time zones also stop working.

What a mess the (somewhat private) web is nowadays. The more I think about it, the more I am convinced legislating privacy is the only way out of this arms race we seem to be losing.