Hacker News Reader

Comment by reisub_black | Hacker News Reader

Why does the documentation need WebGL?

I have WebGL disabled in my main browser for privacy reasons (super-easy to fingerprint), and I only get to see 'Application error: a client-side exception has occurred (see the browser console for more information).' with an error about ThreeJS initialization in the console.

I assume it's for the fancy animation, and I find that ridiculous. Loading a whole 3D library just to show a fancy animation. This could have been done much simpler by using an animated image format, though admittedly with less functionality - but is it even needed?

I fear the whole industry suffers from overengineering and this is just a symptom.

Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable?

View on HN

'WebGL disabled' is a pretty strong fingerprint anyways

"Disabled" is not metric among those who have disabled it, while WebGL enabled allows identifying different browsers with WebGL enabled.

I know what you mean, but statistically, I don't think that it is easier to guess the person from those who have disabled it versus the list of all browser fingerprints where is that matching or very close unique fingerprint.

You just self select as someone who wants to see privacy focused ads

adblock/ublock/umatrix could get you out of that too.

Sites can tell if you’re running Adblock too.

You’re always leaking some kind of information that advertisers will pay for. The game is choosing what information you’re okay giving them

Doesn't really matter if you can block the ads anyway

Besides, advertisers are not who i worry about when it comes to "my data".

You just self select as someone who uses Adblock.

Unless you disable all JavaScript you’re leaking something. Honestly, you’re still leaking a bit without js, as long as where you’re connecting to is checking.

The game is just choosing what you’re okay telling wherever you connect to.

and clearly parent is not okay with choosing to give the information behind the webgl api

What?

Not nearly as uniquely identifiable as your GPU model.

It makes you look the same as everyone else with webgl disabled. This happens to be a reasonably large number of people, because it's the default setting in a variety of privacy focused browsers.

> Even if you're convinced you need the fancy animation, why not gracefully fallback to not showing it and still make the docs usable?

Yeah, it's not like adding a try/catch block around the webGL invocation was hard anyway…

But I agree with the sibling comment about disabling WebGL likely being a fingerprinting liability more than a win.

I find WebGL driveby risk and fingerprinting risks remote and hard to compare. To wit, I've never experienced a recognized loss from any kind of drive-by or fingerprinting attack.

However the severity of drive-by risk is so high, just in theory, that I am tempted to dismiss the risk of fingerprinting. But my reasoning is not very well informed.

What principles and information sources do you use when deciding that avoiding fingerprinting is more important than avoiding WebGL drivebys?

If you disable WebGL you're putting yourself in the 2% of devices that don't support it.

That's not fantastic, but with WebGL enabled just the extension list can be used to narrow you down way further than that - according to https://amiunique.org/ 0.35% of users share my exact supported extensions list. My `gl.getParameter(gl.RENDERER)` seems to be unique to me, for some ungodly reason. The output from rendering a single triangle also narrows me down to 0.8% of all users.

Using firefox on a mac is basically enough to put me as all time unique on that site.

Me too, my user agent was something like 0.01%.

This is potentially a very interesting/useful site. My only problem is with some of the questionable statistics it's showing, that might suggest their dataset is not strictly representative. The time zones in particular seem to be significantly skewed compared to their respective population distributions. There's also a suspiciously large number of UTC0 fingerprints, which suggests they might have a large number of crawlers/bots in their dataset.

Thanks for the website, it's very interesting.

From their statistics, it seems that WebGL gives far less info than things like the list of fonts, the Canvas properties, or the audio input, and more comparable to effective height of the screen (or even just user agent in my case, using Firefox on Linux, though I have to admit I'm surprised about that: 0.02% sounds really low).

The reality is that in disabling WebGL, you have an incredibly unusual configuration and the author didn’t test for it. Stop making this a philosophical argument. Why does the documentation need WebGL? It doesn’t, but the web has moved beyond just addressing “needs”. Why do you need to be on HN? You don’t. Yet here you are. I’m not arguing that the juice is worth the squeeze here, but your argument has a false premise that you’re exploiting to make the situation sound more absurd than it is.

I don't think it's incredibly unusual. On sensitive machines in corporate settings you commonly disable pretty much everything on every page that isn't in the 'trusted zone' or whatever.

Personally, by default I shut down all the browser crap that might needlessly allocate RAM or allow memory leaks or slurp cycles without giving me some kind of value. I think this allows me to hold at least a few hundred extra tabs open. For technical documentation I expect text, hypertext and static images, if you're going to require JS and WebGL and whatnot I'm going to assume you aren't entirely honest with me about the information we're about to share and I'll probably sandbox a scrape of the documentation if I really need it.

If you mean block all network traffic that isn't in the trusted zone then sure. But disabling features you personally don't like isn't a good security practice.

Maybe I wasn't clear. First I described a somewhat common practice in corporate settings, which is ostensibly motivated by security policies. Then I described my personal preference, which I motivated with resource consumption and performance factors.

I did not say that the corporate practice is a good one, I just brought it up as an example to refute the suggestion that limited web browsers are incredibly unusual.

Disabling features less attack surface

Reply on news.ycombinator.com