Top all-time · #10165
Martin Pool
Personal blog · sourcefrog.net/weblogprogrammingsystems
Martin Pool writes sourcefrog, a personal blog at sourcefrog.net about programming and systems. Since 2010, 8 different Hacker News readers have linked it 8 times, most often “Meantime: Non-consensual HTTP user tracking using caches”. No feed was found, so read it on the site itself.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN commenters link Martin Pool's sourcefrog.net pages mainly for his Meantime project, which shows cache-based user tracking without cookies, and for weblog posts on vim and development.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Meantime: Non-consensual HTTP user tracking using caches3 people · 3 mentions · first linked 2010-01-29
What Hacker News says?
This change is partly because of web developers' push for a "richer" and more full-featured -- that is, closer to native code parity -- web platform. There's a spectrum in terms of how conscious web developers and web standards developers may have been of the privacy risks (and many people in W3C committees have worked hard to remove fingerprinting risks from their specs before deployment), but there's been a steady…
Comment linking /projects/meantime
on “The Web Never Forgets: Persistent Tracking Mechanisms In The Wild”Submitted Meantime: Non-consensual HTTP user tracking using caches as a story · 4 points
HN discussionNormally you turn assert() off for production buids, so it's not a robust solution, as some error conditions may not get generated in testing. The memory protection catches a lot of out-of-bounds memory references pretty well, and if you enable core dumps, you can extract neat backtrace from the core file (provided your routines fail-forward in case of invalid arguments). Moreover, some compilers can be instructed t…
Comment linking /weblog/software/languages/C/warn-unused.html
on “Real cost of C++ exception vs error-code checking”It's neat, but it's not a new idea. http://sourcefrog.net/projects/meantime/
Comment linking /projects/meantime/
on “Abusing the Cache: Tracking Users without Cookies”Having done this occasionally, it usually wasn't bad at all, but occasionally it got frustrating enough that I'd use a local clone of the repo. It's for that reason that I'm hesitant to go this route (or the iPad/keyboard route). Interestingly enough, one of the main problems vim was attempting to solve was the annoyance of dealing with a high-latency connection: http://sourcefrog.net/weblog/software/people/joy-vi.h…
Comment linking /weblog/software/people/joy-vi.html
on “My New Development Laptop: Samsung Chromebook”Unrelated: The link to meantime.py on this page is broken, and the correct link is http://sourcefrog.net/projects/meantime/meantime.py
Comment linking /projects/meantime/meantime.py
on “Using a date-modified header to detect unique visitors without using cookies”This kind of attack isn't new, though, trackers have been using side channel tracking forever now. A quick search shows that this exact side channel tracking vulnerability was discussed in the year 2000 [0]. I'm not saying the technique isn't similar: I just object to people dogpiling on OP because other people can and do abuse the same header in nefarious ways. It's not constructive, just a pointless attack on some…
Comment linking /projects/meantime
on “Using a date-modified header to detect unique visitors without using cookies”There are so many ways to coerce a GUID out of a browser: single pixel images, cache headers[1], etc. It's not feasible to implement disclosure control[2] retroactively in web standards. 1. http://sourcefrog.net/projects/meantime/ 2. http://groups.csail.mit.edu/mac/classes/6.805/articles/priva...
Comment linking /projects/meantime/
on “Advertisers get hands stuck inside HTML5 database cookie jar”
