Detect and crash Chromium bots

https://blog.castle.io/detect-and-crash-chromium-bots-with-one-weird-trick-bots-hate-it/

by avastel • 1 year ago

146 14 1 year ago

blog.castle.io

lifthrasiir• 1 year ago

Previously on HN: Detecting Noise in Canvas Fingerprinting https://news.ycombinator.com/item?id=43170079

The reception was not really positive for the obvious reason at that time.

chrismorgan• 1 year ago

Checking https://issues.chromium.org/issues/340836884, I’m mildly surprised to find the report just under a year old, with no attention at all (bar a me-too comment after four months), despite having been filed with priority P1, which I understand is supposed to mean “aim to fix it within 30 days”. If it continues to get no attention, I’m curious if it’ll get bumped automatically in five days’ time when it hits one year, given that they do something like that with P2 and P3 bugs, shifting status to Available or something, can’t quite remember.

I say only “mildly”, because my experience on Chromium bugs (ones I’ve filed myself, or ones I’ve encountered that others have filed) has never been very good. I’ve found Firefox much better about fixing bugs.

lillecarl• 1 year ago

I guess it depends on what kind of bug it is, this took 25 years to fix https://news.ycombinator.com/item?id=40431444

Dylan16807• 1 year ago

To be fair that bug was only P3.

oefrha2• 1 year ago

The call to page.evaluate just hangs, and the browser dies silently. browser.close() is never reached, which can cause memory leaks over time.

Not just memory leaks. Since a couple months ago, if you use Chrome via playwright etc. on macOS, it will deposit a copy of Chrome (more than 1GB) into /private/var/folders/kd/<...>/X/com.google.Chrome.code_sign_clone/, and if you exit without a clean browser.close(), the copy of Chrome will remain there. I noticed after it ate up ~50GB in two days. No idea what's the point of this code sign clone thing, but I had to add --disable-features=MacAppCodeSignClone to all my invocations to prevent it, which is super annoying.

closewith• 1 year ago

That's an open bug at the minute, but the one saving grace is that they're APFS clones so don't actually consume disk space.

oefrha2• 1 year ago

Interesting, IIRC I did free up quite a bit of disk space when I removed all the clones, but I also deleted a lot of other stuff that time so I could be mistaken. du(1) being unaware of APFS clones makes it hard to tell.

wslh• 1 year ago

In Google Chrome, at least, I tried an infinite loop modifying document.title and it freezes pages in other tabs as well. Now, I am not at my computer to try again.

neuroelectron• 1 year ago

I, for one, find it hilarious that "headless browsers" are even required. JavaScript interpreters serving webpages is just another amusing bit of serendipity. "Version-less HTML" hahaha

kevin_thibedeau• 1 year ago

It exists because adtech providers and CDNs punish legitimate users who don't execute untrusted code on their property.

Thorrez• 1 year ago

Headless browsers exist because adtech providers and CDNs punish legitimate users who don't execute untrusted code on their property?

If we ask the creators of headless chrome or selenium why they created them, would they say "because adtech providers and CDNs punish legitimate users who don't execute untrusted code on their property"?

wraptile• 1 year ago

I find the "don't let googlebot see this" kinda funny considering how top google results are often much worse. The captcha/anti-bot is getting so bad I had to move to Kagi to block some domains specifically as browsing contemporary web is almost impossible at times. Why isn't google down ranking this experience?

Detect and crash Chromium bots

Related Stories