Sampson Profile picture
Aug 27, 2019 25 tweets 14 min read Twitter logo Read on Twitter
What happens when you install the Edge (Chromium) Beta build and run it for the first time? I was curious.

On first-run, Edge fired off 130+ requests to nearly 50 endpoints. Here they are, sorted by total calls.

Time to take a closer look.
Here are all of the sessions for the 4 minutes or so I let the browser run. I see numerous connections to MSFT properties, but connections to non-MSFT properties too: Google APIs, Google, Double Click, Google Ad Services, Facebook, Twitter Ads, and more.
I should note, right from the start, that Edge knows more about me than any other browser can during the first-run experience. It gets this insight from Windows. As such, I'll pay closer attention to what it shares, and with whom.
The first call we'll explore is the requst to This request `trustedclienttoken`; a distinct key to represent my device. The server responds with numerous synthetic voice options. I assume this is for #a11y during setup? Can't Windows already handle this?
The second request goes straight to I suspected we would wind up talking to Google in this process, but didn't think it'd be this early. pkedcj… is Chrome Media Router, required to support Chrome Cast. We get XML (instead of CRX) with another URL to try.
Next we make a trip to I assume NTP means New Tab Page. Some locale data is sent along, and we get 62K of markup back. I don't immediately see this in Edge, but it may show up in later launches.
Skype comes up in the next call. We appear to be picking up some type of configuration data. That I am a first-run user is sent over, and JSON comes back. The response has per-domain rules for DRM purposes. It also has rules to spoof user-agent strings on specific sites.
The next request is to, which only responds with a location header, telling Edge to look for the data elsewhere. As such, we'll see this request surface momentarily.
At this point, SmartScreen kicks in to review some domains we're about to visit. It gives the all clear, and we proceed! Next up, we make our first connection to the windows domain.
The next entry is to Very little data is transferred, but for some users, I suspect this would be different. This retrieves information from Windows' Activity History. You can read more about it here:…
The next connection should look familiar, if you have read through my previous browser threads. The call from earlier told us to go to to download an extension CRX from Google. Redirector.* sends us to one of Google's cryptic URLs.
I should point out that both and the URL to which it points (r2---sn.*) are both loaded over HTTP (not HTTPS). I don't know if Edge performs hash comparisons on the resulting CRX, or if this could be leveraged to send a malicious extension to new users.
A bunch of resources are then loaded from Akamai is responsible for serving the NTP to new Edge (Chromium) users. Due to it being hosted on the Web, you can visit Edge's start page directly:….
Edge then makes another call to This time, it includes my email address used to log into Windows 10. I can see a reference to Nigori in the data (I assume this is Sync-related data).
Next up is a call, and a redirect, to This is the page that Edge loads in a 2nd tab. This page was also responsible for loading CSS, Fonts, and other common files, as is to be expected.
The page issues a request to; a familiar domain for anybody in the content-blocking space. This request results in a redirect, which itself ends with an HTTP 204 No Content.
The site calls out to, which redirects to Google Tag Manager is also loaded. Hello, Twitter. Hello, Google. is also called, which serves performance and event tracking logic (AFAICT).
At this point, we start to see big moves toward data collection and tracking/ads. Scripts are loaded from Facebook, Reddit, Google, and more. All originate from the default tabs during the first-run. Example: pageLoad event and device info is sent to bing.
This Insider tab also sends data about my device and such to the Double Click servers (Google). There are numerous redirects when Edge calls out to All of them set cookies. The last one looks like it assigned a universal ID.
To be quite honest, this review is rather exhausting. There are many third-party hosts; many of which technically belong to Microsoft, blurring the lines between what is first-party, and what is third-party.
The following Request/Response is to I was going to highlight interesting values, but so much here is interesting that I decided to share as-is. Duration information, URLs, a session and user ID, DOM processing time, and more. These insights are granular.
Next, if you can believe it, is the Chrome Media Router we saw at the beginning of this thread. We already downloaded this one, but it appears we will be doing so again. First time had a "X-Goog-Update-Interactivity: fg" header. Now it's a "bg" value.
The last thing that caught my attention were these invalid requests at the very end of the session list. I added time codes to see if there was a fixed interval between the calls. I have no idea what's going on here. Could be a bug in Edge Chromium.
Last observation is that numerous processes are in play. Process 2700 handled the general web contents. Process 18592 interacted exclusively with Smart Screen.
If you enjoyed this 'What Happens' thread, be sure to check out the others on Chrome, Firefox, Brave, Opera, Dissenter, and Vivaldi.

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Sampson

Sampson Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @jonathansampson

Oct 2, 2020
WordPress, for all the good it has done, simply cannot help but to screw up the simplest things.


In walks WordPress, "Oh, let me quadruple those backslashes for you."

So I try &#92;, which WordPress then converts into &amp;#92;!

I just can't win here.
Yes, I know to make changes in the TEXT view, and not the Visual view. Tragically, that will give you all sorts of [other] problems, like randomly eating carriage-returns, or inserting a <br> here and there. This utility simply isn't cut-out for sharing code(-like) content.
Wait, wait—I got the formatting to stick, and the content to look the way I wanted.

Read 5 tweets
Oct 2, 2020
Never again will I call the split method on a string to get an array of characters. From here on out, it's spread all the way 🙂

[...string].map( char =>

Much nicer than string.split(""), in my opinion. Function with empty string? No thanks!
Now, if only I could convert an array of character strings back to a string without needing to call array.join(""), I'd be set.

I could reduce, but, yuck...

array.reduce( ( s, c ) => s += c, '' )
Is this cheating? 😂

Array.prototype.smüsh = function () {
return this.join('')
Read 4 tweets
Sep 26, 2020
Windows uses values 0D 0A to signify a line-break. Mac uses 0A.

TIL—Windows XP had a bug causing Notepad to insert 0D 0D 0A. It wouldn't save like that, but if you copied and pasted the contents elsewhere the bytes could be preserved to this day.

Computers are hard 🙂
Oh, wait... does Windows 10 use 0A now?

b`.split('').map(x => x.charCodeAt(0).toString(16))

Which produces

["61", "a", "62"]

Or maybe this is JavaScript normalizing it?
I assume 0A alone is enough to force a new line in Windows, but that Windows still uses 0D 0A. I ran:

copy([ '61', '0A', '62' ].map(x => String.fromCharCode(parseInt(x, 16))).join(''))

And pasted from the clipboard into Notepad, and it showed the expected line-break. Odd.
Read 5 tweets
Sep 26, 2020
D'oh! Working with React and wondered why my UI was partial:

render () {
return (
<A prop={value} />,
<B prop={value} />

Reminded me how cool the comma operator is in JavaScript:

return Expr, …, Expr

Evaluates each expression, but returns result of last.
Ti be more clear, the return statement returns the result of the Expression (if any) to its right. Expressions can contain Expressions. So each of the expressions in a list are evaluated, but only the result of the final is returned.
I think I first read about this little detail in one of @rauschma's fantastic deep-dive posts, but I'm not sure which one.
Read 6 tweets
Sep 22, 2020
The Accident: A Short Story

In 1992 Phillip Hallam-Baker and Tim Berners-Lee were developing HTTP. Phillip suggested a request header to record the URI of the linking-document, and "referer" (a spellcheck failure) was born. Servers now knew what site sent you their way.
In 1993 a young developer working on the Mosaic browser added support for inline images. Before this, images could only be linked from a page and viewed separately. Images from remote servers were supported as well, and requests for them would eventually include a referer header.
In 1994 Lou "solved" statelessness on the Web. Cookies could be set by a server, and would be returned to that server with future requests. Session IDs could move out of the URL path, and into a more convenient home. Like images and referer, cookies worked with third parties too.
Read 10 tweets
Sep 16, 2020
Over the years there have been various ways to sniff the user's web history with CSS and JavaScript. For example, generating 10,000 links & checking their color (visited differs by default). These are now blocked, but I wonder how often advertisers and exchanges engaged in this.
Clever developers would adapt to these changes, turning their focus from the links to the style of adjacent elements with :visited + span, and then reading span's computedStyle to see how it looks. Background images could be used in a similar manner; listen for what loads.
Even when you lock-down CSS, developers would sniff your cache by using sensitive clocks in JS and seeing how quickly resources loads. If 2 similar resources load at very different rates, one could be inferred to have been loaded from cache (indicating user visited a given site).
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!