Curious what happens when you fire up a web browser for the first time? Me too. I often do this for @brave to make sure things are staying neat and tidy.
Today I would like to do it for a few other web browsers. First, let's take a look at Opera.
Launching Opera (and leaving it in its default state for a few minutes) resulted in the following calls being made.
Calls to opera and operacdn made sense. But 19 calls to yandex.ru was a surprise. Note also Amazon, FB, Walmart, Kayak, Ebay, Ali Express, and more.
Some of these are fairly heavy calls too; here's a subset ordered by their response size (descending). Overstock sets a dozen cookies. Amazon, Kayak, Ali Express, and more set me up with novel session IDs as well. Google is there too. Ready to monitor my movement across the Web.
On a fun note, booking.com apparently knew that we'd inspect their headers 😉
Back to Yandex though. Opera not only pings them, but informs them that I am setting up a new profile with Opera (via the referer header and query string). This header also goes to Facebook, Google, and hotjar. All of these now know that I am a fresh Opera user.
A closer look reveals that Opera is sending extra bits too, including my native resolution, browser window size, and a lot more. Unfortunately, it isn't clear what the other bits are representing. One parameter is called "gdpr" with a value of 14. I wonder what that one is.
Another call is made to android.clients.google.com, and includes a unique user ID, as well as a distinct device and sender ID. Why is Opera sending this information to Google?
Just as a reminder, this is a fresh profile. No previous activity. And no activity taken beyond opening the browser up for the first time.
Ah, I forgot to mention the call to walmart.com over HTTP, which responds with a 301 redirect. AFAIK, that's an opportunity for trouble.
Compared to Opera, Vivaldi is very lightweight. Firing up a fresh profile in Vivaldi resulted in only 31 or so calls (most of which are to vivaldi.com).
This looks pretty standard. It downloads the SafeBrowsing database, some 835K extension, and a domain blacklist.
Unlike Opera, Vivaldi doesn't inform others that I am a fresh user (via the Referer header).
The extension they download appears to be for Chrome Cast. This, too, is expected for compat reasons. I'd say Vivaldi gets a clean bill of health based on this cursory glance. Nice job, @vivaldibrowser!
Note, again, that I am only reviewing the first-run experience. Not making any claims about how privacy/secure things are beyond that.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
WordPress, for all the good it has done, simply cannot help but to screw up the simplest things.
<pre>\\.well-known</pre>
In walks WordPress, "Oh, let me quadruple those backslashes for you."
So I try \, which WordPress then converts into &#92;!
I just can't win here.
Yes, I know to make changes in the TEXT view, and not the Visual view. Tragically, that will give you all sorts of [other] problems, like randomly eating carriage-returns, or inserting a <br> here and there. This utility simply isn't cut-out for sharing code(-like) content.
Wait, wait—I got the formatting to stick, and the content to look the way I wanted.
Windows uses values 0D 0A to signify a line-break. Mac uses 0A.
TIL—Windows XP had a bug causing Notepad to insert 0D 0D 0A. It wouldn't save like that, but if you copied and pasted the contents elsewhere the bytes could be preserved to this day.
Reminded me how cool the comma operator is in JavaScript:
return Expr, …, Expr
Evaluates each expression, but returns result of last.
Ti be more clear, the return statement returns the result of the Expression (if any) to its right. Expressions can contain Expressions. So each of the expressions in a list are evaluated, but only the result of the final is returned.
I think I first read about this little detail in one of @rauschma's fantastic deep-dive posts, but I'm not sure which one.
In 1992 Phillip Hallam-Baker and Tim Berners-Lee were developing HTTP. Phillip suggested a request header to record the URI of the linking-document, and "referer" (a spellcheck failure) was born. Servers now knew what site sent you their way.
In 1993 a young developer working on the Mosaic browser added support for inline images. Before this, images could only be linked from a page and viewed separately. Images from remote servers were supported as well, and requests for them would eventually include a referer header.
In 1994 Lou "solved" statelessness on the Web. Cookies could be set by a server, and would be returned to that server with future requests. Session IDs could move out of the URL path, and into a more convenient home. Like images and referer, cookies worked with third parties too.
Over the years there have been various ways to sniff the user's web history with CSS and JavaScript. For example, generating 10,000 links & checking their color (visited differs by default). These are now blocked, but I wonder how often advertisers and exchanges engaged in this.
Clever developers would adapt to these changes, turning their focus from the links to the style of adjacent elements with :visited + span, and then reading span's computedStyle to see how it looks. Background images could be used in a similar manner; listen for what loads.
Even when you lock-down CSS, developers would sniff your cache by using sensitive clocks in JS and seeing how quickly resources loads. If 2 similar resources load at very different rates, one could be inferred to have been loaded from cache (indicating user visited a given site).