←back to thread

Curl-impersonate: Special build of curl that can impersonate the major browsers

(github.com)
545 points mmh0000 | 3 comments | 03 Apr 25 15:24 UTC | HN request time: 0.001s | source
Show context
jchw ◴[03 Apr 25 16:40 UTC] No.43572243[source]▶
I'm rooting for Ladybird to gain traction in the future. Currently, it is using cURL proper for networking. That is probably going to have some challenges (I think cURL is still limited in some ways, e.g. I don't think it can do WebSockets over h2 yet) but on the other hand, having a rising browser engine might eventually remove this avenue for fingerprinting since legitimate traffic will have the same fingerprint as stock cURL.
replies(6): >>43572413 #>>43573011 #>>43574225 #>>43576912 #>>43580376 #>>43583469 #
userbinator ◴[04 Apr 25 00:01 UTC] No.43576912[source]▶
but on the other hand, having a rising browser engine might eventually remove this avenue for fingerprinting

If what I've seen from CloudFlare et.al. are any indication, it's the exact opposite --- the amount of fingerprinting and "exploitation" of implementation-defined behaviour has increased significantly in the past few months, likely in an attempt to kill off other browser engines; the incumbents do not like competition at all.

The enemy has been trying to spin it as "AI bots DDoSing" but one wonders how much of that was their own doing...

replies(3): >>43577273 #>>43578375 #>>43578710 #
hansvm ◴[04 Apr 25 01:02 UTC] No.43577273[source]▶
Hold up, one of those things is not like the other. Are we really blaming webmasters for 100x increases in costs from a huge wave of poorly written and maliciously aggressive bots?
replies(2): >>43577293 #>>43584557 #
refulgentis ◴[04 Apr 25 01:04 UTC] No.43577293[source]▶
> Are we really blaming...

No, they're discussing increased fingerprinting / browser profiling recently and how it affects low-market-share browsers.

replies(1): >>43577819 #
1. hansvm ◴[04 Apr 25 02:47 UTC] No.43577819[source]▶
I saw that, but I'm still not sure how this fits in:

> The enemy has been trying to spin it as "AI bots DDoSing" but one wonders how much of that was their own doing...

I'm reading that as `enemy == fingerprinters`, `that == AI bots DDoSing`, and `their own == webmasters, hosting providers, and CDNs (i.e., the fingerprinters)`, which sounds pretty straightforwardly like the fingerprinters are responsible for the DDoSing they're receiving.

That interpretation doesn't seem to match the rest of the post though. Do you happen to have a better one?

replies(1): >>43578141 #
2. userbinator ◴[04 Apr 25 03:48 UTC] No.43578141[source]▶
"their own" = CloudFlare and/or those who have vested interests in closing up the Internet.
replies(1): >>43578833 #
3. ◴[04 Apr 25 06:08 UTC] No.43578833[source]▶