Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
A change in Chromium 148 means `Math.tanh` and some related math functions now depend on the host OS’s libc, making their exact outputs a reliable way to infer the underlying operating system and strengthen browser fingerprinting. Commenters debate how serious this is for privacy, noting that many other vectors already exist and that fully hiding OS and browser characteristics may be practically impossible. The thread also scrutinizes the ethics and incentives of commercial scrapers and the use of LLM‑generated blog posts to publicize such fingerprinting techniques.
New Math.tanh Fingerprinting Vector
- Chromium 148+ now routes
Math.tanh(and CSS trig functions) through the host libc, producing OS-specific results on the same input. - This creates a reliable OS and version-range fingerprint, especially when combined with claimed User-Agent.
- Some see this as a small addition to many existing version-detection tricks; others find it notable because math was expected to be deterministic across platforms.
- A mitigation idea is to implement tanh in V8 with consistent rounding and use that from CSS, but this may have performance/complexity tradeoffs.
- Naive JS overrides of
Math.tanhare considered detectable and may themselves become a fingerprint.
Floating Point vs Fixed Point and Correct Rounding
- Substantial debate on fixed-point vs IEEE-754 floating point:
- Pro-float: ubiquitous hardware support, better range, easier to get right for non-experts, can be made deterministic with careful toolchains; fixed-point is niche and hard to implement correctly.
- Pro-fixed: uniform absolute precision, simpler error modeling, more effective use of 32 bits for some DSP/simulation use cases, and better fit when f64 is unavailable or slow.
- Correctly rounded transcendental functions (exp, sin, tanh, pow, etc.) are described as mathematically “solved” in principle but hard and sometimes slow in practice.
- glibc and CORE-MATH are mentioned as moving toward correct rounding; pow and bivariate functions remain tricky (table-maker’s dilemma, Ziv’s rounding).
LLM-Generated Article and Content Quality
- Many commenters characterize the blog post as “LLM slop”: verbose, repetitive, and low information density.
- Some note the AI disclaimer was added only after publication; this hurts trust for a few.
- Several argue the author should have just published concise notes, tables, and code instead of a padded AI-written article.
- Others say they don’t care about authorship if the technical content is accurate and disclosed.
Scraping, Fingerprinting, and Ethics
- The company behind the post sells scraping infrastructure that bypasses anti-bot measures; some see the article as content marketing aimed at weakening defenses.
- CDN/bot-detection perspectives: large-scale abusive scraping (including for LLM training) is a major driver of aggressive fingerprinting and harms sites’ capacity.
- There is disagreement over whether scraping is “stealing” or simply copying publicly served data; consent, bandwidth, and intent are central points of contention.
- Some worry that blanket anti-scraping measures and UA discrimination further entrench big-CDN gatekeepers and harm legitimate small-scale automation.
Privacy, Legality, and Anti-Fingerprinting Feasibility
- Suggestions include making fingerprinting (or certain uses of it) outright illegal, akin to wiretapping; others argue it’s hard to define without banning legitimate diagnostics and anti-fraud.
- Analogies are drawn between recognizing a repeat visitor vs secretly tracking them across many “stores.”
- Many believe fully hiding OS or fingerprinting resistance is practically impossible due to numerous side channels (JS behavior, rendering quirks, TCP stack differences, screen/window metrics, timing).
- Some advocate JS disabling or heavy header minimization; others note this can itself become a unique signal and often conflicts with modern sites and CDNs.