Solid bias disclosure, but pinning the exact commit would help people verify this. My guess is canvas doesn't vary per seed, so a quick test across 5+ hashes would settle that. The real win is headless dropping from 67% to 0%, that's working as intended. The matching 31% like headless on both runs probably just shared engine level stuff
One thing that could strengthen the table is seeing unpatched chromium in headless mode for comparison, just to rule out whether that baseline already drops the headlesschrome string. Hard to evaluate the CDP methods without the pinned build, but that's the main thing missing here
Sorry for the slow reply. These were fair asks, so I ran them today (Oct 10, same Windows box, headless, Playwright 1.63). Hashnode won't let a new account post links, so: the script and raw numbers are a public gist named afb_seed_variance.py under the GitHub user rowanvale-lab.
Pinned build: release tag 153.0.8010.47-1, file chromium-153.0.8010.47-1.zip, sha256 b2be4f085c196e76de39420f22c1dcbc3bbfe9d6dc49ec95f309fb8206549e3c (GitHub shows the same digest on the release asset). The release doesn't name a commit, so the tag plus the zip digest is the best pin I can give.
Canvas: your guess matched what I wrote in the post, and the post was wrong. My original hash only drew plain text. A richer test (gradient, text plus emoji, a multiply blend, with toDataURL and getImageData hashed separately, plus a WebGL shader render read back through readPixels) gave 24 distinct 2D-canvas hashes and 24 distinct WebGL-pixel hashes across 26 seeds. The same seed relaunched gives identical hashes, and two pages in one session match. With no seed it's identical to stock Chromium on this machine. One oddity I'm passing on to the project: seeds 106, 42042 and 67890 land on the same canvas and WebGL hash even though they report different GPUs. So it isn't one value per seed.
An OfflineAudioContext compressor fingerprint came out identical for every seed and for stock Chromium. (Edit, Oct 10: the project's developer says that's deliberate. Stock Chrome gives the same audio value on most Windows machines, so randomising it would itself stand out.)
Unpatched headless baseline: Playwright's full Chromium in new-headless mode (channel="chromium", not the headless shell) still puts HeadlessChrome in the UA. The headless shell does too. So the baseline doesn't drop that string for you.
On the 31% "like headless": agreed, it's probably engine-level. I haven't pinned it down. The CDP methods ship in that same tagged build, so the tag above covers them too.
OnlineProxy
Solid bias disclosure, but pinning the exact commit would help people verify this. My guess is canvas doesn't vary per seed, so a quick test across 5+ hashes would settle that. The real win is headless dropping from 67% to 0%, that's working as intended. The matching 31% like headless on both runs probably just shared engine level stuff
One thing that could strengthen the table is seeing unpatched chromium in headless mode for comparison, just to rule out whether that baseline already drops the headlesschrome string. Hard to evaluate the CDP methods without the pinned build, but that's the main thing missing here