<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 7, 2014 at 2:21 PM, Dean Jackson <span dir="ltr"><<a href="mailto:dino@apple.com" target="_blank">dino@apple.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><div><div>On 6 May 2014, at 11:13 am, Rik Cabanier <<a href="mailto:cabanier@gmail.com" target="_blank">cabanier@gmail.com</a>> wrote:</div>
<br><blockquote type="cite"><div dir="ltr">On Mon, May 5, 2014 at 5:52 PM, Simon Fraser <span dir="ltr"><<a href="mailto:simon.fraser@apple.com" target="_blank">simon.fraser@apple.com</a>></span> wrote:<br><div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="word-wrap:break-word">It allows attackers to know even more about my system, exposing more data for fingerprinting.</div>
</blockquote><div><br></div><div>People can already approximate this today. Approximations are fuzzy so this might hurt performance if you're not a popular platform or change how the browser implements workers.</div>
</div></div></div></blockquote><div><br></div></div><div>There is a difference between approximation and clear detection. During discussion of a related feature on the WebGL list (for exposing the GPU information to the page), I noted at the time that it would allow any page in the world to detect you'd spent X thousand dollars on a Mac Pro in the last 30 days. Being able to detect the number of cores provides more info - e.g. you spent X + Y thousand dollars for the upgrade.</div>
<div><br></div><div>"Let's not show that user ads for vacations in Compton... let's show them the Bahamas instead."</div></div></div></blockquote><div> </div><div><div style="font-family:arial,sans-serif;font-size:13px">
Sure, however for fingerprinting, the algorithm does not have to be precise and could be done today. A quick routine that returns 1 or 2 for cheap machines and > 12 for expensive machines would be enough to separate the audience.</div>
<div style="font-family:arial,sans-serif;font-size:13px">The fact that this is so easily accomplished today and we don't have any evidence that this is happening, tells me that it is not that valuable. We're definitely not leaking more information. (FWIW if sites were to do this, I would prefer that they don't needlessly spin up my CPU's and drain my battery)</div>
</div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><div>Do you really want a page to know that you have a fancy-pants 24-core Mac Pro rather than a little Mac mini?</div>
</div></blockquote><div><br></div><div>Yes!</div><div>If I have 24 cores ready to do work and the page can put them to use, I would like it to do so.</div><div>At the same time, if I just have a old mac mini, I don't want the page to launch 24 workers as that will exhaust my memory and cause contention. </div>
</div></div></div></blockquote><br></div></div><div>But as Oliver said, maybe I don't want the page to use all cores.</div></div></blockquote><div><br></div><div>When would I as a user, not want a page or web application to be as fast as possible? Has a user ever complained about a desktop app that uses too many of his CPU's? I think Oliver's point was that other processes might fight for the same CPU resources but that is not unexpected for users.</div>
<div><br></div><div>It seems that people are mostly concerned with this routine returning large values. Maybe we can make it return 8 as a maximum for now and revisit it in a year or so?</div></div></div></div>