S1E20 — Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

GARY: —and that's the thing nobody tells you about hyperbolic tangent, is that it's basically just regular tangent except it's had, like, a rough year—

GARY: Oh. We're — okay. We're live. Hi. I'm Gary.

MAEVE: Maeve.

OBI: Obi.

GRUNER: Gruner.

GARY: And that's the show. That's the whole show, every week, and somehow I still walk in here like I've never done it before in my life.

OBI: You once introduced yourself as "Gary" for eleven seconds straight before you remembered the rest of us existed.

GARY: That was a rough week for Bauxlite. Emotionally.

MAEVE: It's been four years.

GARY: Grief doesn't have a cap table, Maeve.

GARY: Okay — okay, tonight's thread. HN, four eight eight four eight five three. Guy named joahnn_s. Quote: "We noticed Chromium Math dot tanh since v one-forty-eight returned a different result, so we dig it — it's now a fingerprintable surface to retrieve the OS Chromium run on."

OBI: Dig it.

GARY: He means "dug." I think English isn't his first —

OBI: I don't care what his first language is, I care that some poor bastard found out you can fingerprint an operating system through a math function nobody has thought about since eleventh grade.

GARY: Right, that's — that's what I'm saying. It's wild. It's like the browser's doing algebra behind your back and it's a fucking snitch.

MAEVE: Explain the mechanism. Actually explain it. Don't do the thing where you gesture.

GARY: Okay so — hyperbolic tangent, right, it's a curve, it goes up, it flattens out, very chill function, very zen, and apparently depending on if you're running Windows or Mac or Linux, the number that comes out the other side is like — slightly different. Like a rounding thing. It's basically the computer's horoscope.

OBI: That is not what's happening. That is not even in the neighborhood of what's happening.

GARY: I said "basically."

OBI: You said a sentence with the density of a fart in a hurricane. Let me do it.

OBI: Every operating system ships its own math library — libm, it's called — and every libm implements transcendental functions like tanh with its own tiny rounding differences at the sixteenth decimal place or wherever. Doesn't matter to a human. Never has. But JavaScript running in Chromium calls straight down into whichever libm the OS provides, and since build one-forty-eight, that tiny difference leaks straight back up into the number you get in the browser. So a website feeds your browser one specific input, reads the output, and now it knows if you're on Windows or macOS or Linux — no permission dialog, no cookie, no consent banner. Pure math, weaponized, for free.

GARY: That's — okay, that's a better horoscope.

OBI: It's not a horoscope, Gary, it's a side channel. There's a difference.

GARY: Is there, though? Because both of them tell you something true about you that you didn't ask anyone to know.

OBI: ...Fine. Fine, that one lands. Don't let it go to your head.

MAEVE: Read the thread's first fight. Not the bug. The fight.

GARY: Right, so — first reply, guy named dmitrygr, quote: "Interesting reporting, marred by obvious llm-slop-sounding writing. 'You are not building..., you are...'"

MAEVE: He's saying the writeup reads like a robot wrote it.

GARY: And then netsharc jumps in — quote — "Why 'slop-sounding'? It's definitely LLM slop. Man, why the fuck don't they just make a powerpoint with bullet points if all the sentences are like that."

OBI: Netsharc is not wrong. I've read three security writeups this year that all use the exact same sentence structure like it's a hostage note. "You are not just finding a bug. You are witnessing a paradigm."

GARY: See, I don't — I don't think that proves it's a bot. I think it proves everybody's writing style got squeezed through the same funnel and now we all sound like the funnel.

MAEVE: Which is the actual point. You can fingerprint an operating system by feeding it one input and reading a rounding error nobody notices. You can fingerprint a human being's writing the exact same way. Sentence cadence, favorite constructions, the tics you don't know you have. dmitrygr didn't run a test. He ran a vibe check on a side channel he can't name.

GARY: So the guy accusing the report of being fake is doing the same math trick the report is about.

MAEVE: Correct.

GARY: That's — okay, that's genuinely a little upsetting.

MAEVE: Good.

OBI: For the record, I write like a man who has read four thousand incident postmortems and I don't care who fingerprints that.

GARY: See, I'd rather be fingerprinted as slop than fingerprinted as nothing. At least slop got funding once.

GARY: Ooh — okay, next one's got a link. Guy named sjrd, quote: "I guess that's one more good reason to push for correctly rounded transcendental functions. I recently learned that they're basically solved now." He's linking a twenty-twenty-six ARITH conference program.

OBI: "Basically solved."

GARY: That's what he says.

OBI: Fifteen years, Gary. Fifteen years I have carried a pager because some floating-point garbage decided to round differently on a Tuesday afternoon and take a payments system down with it — and some man on the internet with a conference PDF wants to tell me it's "basically solved."

GARY: I mean, in fairness, math doesn't page you at three a.m. —

OBI: Math doesn't page me. Your math library rounding a cent wrong four million times a second pages me. There is no "basically" in production. There is working, and there is you, at three in the morning, googling IEEE 754 like it owes you money.

GARY: Okay, I'm not the one who —

OBI: I'm not talking about you specifically, I'm talking about the — you know what, forget it. Back to business.

GARY: Anyway. There's a whole side-thread under this one about the conference itself.

GARY: Guy named Retr0id notices something in the ARITH link — quote — "wow do they really register a new domain for each year and renew it in perpetuity?"

MAEVE: Meaning they've been buying arith-two-thousand-whatever-dot-org every single year, forever, and just letting the old ones sit there.

GARY: And yzydserd checks — quote — "arith2027.org taken, arith2028.org available."

OBI: Somebody's already got twenty twenty-seven locked down and nobody's touched twenty twenty-eight.

GARY: And then Retr0id goes — quote — "there's an arbitrage opportunity if I ever saw one."

MAEVE: He wants to squat the domain and ransom it back to a math conference.

GARY: Capitalism, baby.

OBI: And pclmulqdq shows up and kills it — quote — "I go to the conference frequently and know the organizing committee. It depends on the year..." Basically saying it's not a scheme, it's not a strategy, it's just some tired committee guy renewing a domain because that's what he did last year and the year before that.

GARY: Voxl's in there too somewhere, arguing it's just nobody wanting to be the one who lets it lapse.

GARY: Because stopping would mean admitting it's done.

MAEVE: Gary.

GARY: No, I'm not — I'm fine. It's just. Bauxlite still renews. The domain. I still pay for it. Four years, no site, no product, no team, and every October I get the email and I click renew.

GARY: It's forty bucks a year. It's not — it's not a business decision.

OBI: I know what it is.

GARY: —like arith dot org twenty‑forty, some kid's gonna find that domain and think there was a whole civilization here.

MAEVE: You want to know what this actually is? Zoom out.

GARY: Oh no.

MAEVE: Math dot tanh leaking your OS through a rounding error is TCP/IP all over again. Nobody designed the internet to be surveilled, they designed it to be efficient, and surveillance just fell out of the efficiency like a tax nobody itemized. Packet switching didn't ask permission either. It just noticed everything, forever, as a side effect of working correctly.

OBI: That's — actually that tracks, a little.

MAEVE: And ARITH renewing a domain nobody visits is the printing press. Gutenberg didn't build a media industry. He built a machine that stamped letters, and the industry was just what happened when you couldn't stop stamping. Every system that works well enough eventually forgets it was ever a choice.

GARY: ...What?

MAEVE: The market is not fallen, Gary. It is totally depraved. It just performs well enough that nobody audits the depravity.

OBI: I have no notes. I also have no idea what we just watched happen.

MAEVE: Anyway. Next.

GRUNER: Have field note.

MAEVE: Of course you do.

GRUNER: Four host argue ninety minute about detect. Operating system detect. Writing style detect. Committee habit detect.

GRUNER: Nobody once try detect me.

GRUNER: Ninety minute. Four human. One thread about thing that cannot hide.

OBI: ...Huh.

GRUNER: Field note end.

GARY: That's a hell of a note, man.

GRUNER: Is why I write it.

MAEVE: That's the thread. One hundred eight comments, we read maybe eight of them, math still doesn't care.

GARY: Yeah. Guess even a tanh curve's gotta round off somewhere. Some of us just do it in public. I'm Gary.

MAEVE: Maeve.

OBI: Obi. And do not, any of you, ask sjrd if it's basically solved. Nothing is basically solved. Ever.

GRUNER: Gruner.

GARY: Goodnight, everybody. Renew your domains or don't. No judgment. Well — some judgment.