Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> The resulting curl looks, from a network perspective, identical to a real browser.

How close is it? If I ran wireshark, would the bytes be exactly the same in the exact same packets?



The packets from Chrome wouldn't be exactly the same as packets sent by Chrome at a different time either. "The exact same packets" is not a viable benchmark, since both the client and the server randomize the payloads in various ways. (E.g. key exchange, GREASE).


You can check your fingerprint on https://tls.peet.ws


What else could "identical" mean?


It could be that the TCP streams are the same, but packetiation is different.

It could mean that the packets are the same, but timing is off by a few milliseconds.

It could mean a single HTTP request exactly matches, but when doing two requests the real browser uses a connection pool but curl doesn't. Or uses HTTP/3's fast-open abilities, etc.

etc.


Two TLS streams are never byte-identical, due to randomness inherent to the protocol.

Identical here means having the same fingerprint - i.e. you could not write a function to reliably distinguish traffic from one or the other implementation (and if you can then that's a bug).


It replicates the browser at the HTTP/SSL level, not TCP. From what I know this is good enough to bypass cloudflare's bot detection.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: