Hacker News Reader

isn't JA4 also useless because it is so easy to spoof tls. For eg. cycletls for nodejs etc..

It will probably be useless one day. In practice, it is still useful today though not for this attack.

There's also the JA4+ suite (https://github.com/FoxIO-LLC/ja4), in addition to standard JA4.

Yep curl cffi accurately spoofs JA4 for chrome. You need to detect client side as well.