把 Return 键变一下颜色,一下就感觉高级了许多 😋

【解密百度追踪脚本 abclite-2020-s.js】

dlswbr.baidu.com/heicha/mw/abc
这个追踪脚本被百度的多个服务所使用,如:百度百科、百度贴吧、百家号等。

今天花费了一些时间,对该追踪脚本进行一个系统的分析。
发现百度不仅搜集设备平台、浏览器名称、浏览器版本等基本信息。
还搜集CPU核心数、canvas指纹、设备屏幕宽高、浏览器安装的插件情况等进一步的信息。
最让我惊讶的,百度还通过 DeviceMotionEvent 事件监控用户设备的运动情况。

此外,该脚本还对检测了是否存在广告屏蔽器,eval函数是否被hook、脚本自身是否被修改或格式化。
对于 phantom、nightmare、Selenium、puppeteer 等常见的自动化浏览器该脚本也进行了检测。

最终将上述收集到的信息 AES 加密后上传至百度服务器。

解密后的脚本在这里:gist.github.com/yingziwu/6e16c

最后,也是最为重要的,常见的广告屏蔽规则中并没屏蔽该脚本。
如下图便是uBlock 默认订阅集外加 CHN: AdGuard Chinese (中文) 订阅集下,访问 baike.baidu.com/ 时的请求情况。
可以看出,该脚本并没有被屏蔽规则屏蔽。

#百度 #隐私安全 #浏览器

It's year 2021. I finally have proper IPv6 connectivity at home 😅

俱乐部房子是什么啊 没听说过啊

Whether you like it or not, ranting about how toxic part of a community is only makes you a significant contributor to the toxicity of said community. That's why whenever I think something is not worth my time anymore, I will just quit, not making a long rant about how horrible it is. It doesn't work, and it wastes my time, and it only makes me look even worse.

打了几次草稿,放置了一个多月,终于写完了,好像放下了心头的一块大石头 …

Show thread

Vue 3 发布了!赶紧把没写完的 Vue 2 应用内存泄漏问题调试笔记翻出来写完了 😅

rocka.me/article/debugging-mem

(再写不完就没人会看了(说的好像早点写出来就会有人看一样

Grab some popcorn, sit back and enjoy the show: Plasma Bigscreen is coming to a TV near you!

dot.kde.org/2020/03/26/plasma-

Try Plasma Bigscreen now on your Raspberry Pi 4!

plasma-bigscreen.org/

the year is 2050. GTK is still preparing the move to version 4, and has collaborated with the FBI to assassinate anyone who mentions the filepicker thumbnail bug. qt stil has an open source version, but it requires you to have create an account with a valid email address and physical address, and limits applications to only containing one window.

microsoft is still "transitioning away from winforms" to the Multiversal Windows Platform, For Real You Guys, We're Doing It Platform. iOS desktop (formerly macOS) has deprecated all system widgets in favour of the cloud. google has created an artificial intelligence to randomly create and deprecate new GUI frameworks, rendering it essentially impossible for anybody but them to create android apps with "native GUIs".

the only usable framework is electron, but everybody hates it because bloat.

as people struggle to find a desktop ui framework that hasn't been bogged down into uselessness by licensing issues or lack of features, a saviour emerges from the heavens: java swing

Show older
SN.Angry.Im

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!