[sheept]

Any page can silently trigger an additional multi-gigabyte download for Chrome users by just calling this API:

    await LanguageModel.create()

Since the model is installed once per browser, LanguageModel.availability() could probably also be used for fingerprinting.

[tantalor]

Indeed, you could even do something like this:

    await fetch("/multi-gigabyte-download");

It even works on non-Chrome browsers.

[bstsb]

i think the point is that one actually burns disk space, while the other is just a nuisance for people on plans with limited data

[gruez]

You can store up to 80% of free disk space with indexeddb

https://rxdb.info/articles/indexeddb-max-storage-limit.html

[DennisAleynikov]

using a browser is an easy way to burn disk space and limited data

light browsing is not a thing unless you somehow ensure javascript is disabled and all downloads are blocked

[bri3d]

Just the availability wouldn't be that bad from a fingerprinting standpoint (getting one bit that a majority of Chrome users have is just the same bits you already have, usually), except, it also exposes whether the underlying hardware is "eligible," and once it's running, you can also benchmark the language model performance. It's a mess. I think it might also be broken and work in iframes, which would be an even bigger mess; there are a few bug reports suggesting this although many of them look like slop.

This feature was massively bungled; I actually don't overall hate the idea of it (having a shared, pre-downloaded model that can run effectively from JS is kind of awesome versus sites downloading stuff into LocalStorage to use with hacked up wasm/webgl inference engines), but it really, really needed a permissions dialog and a proper anti-fingerprinting model.

[tantalor]

> really needed a permissions dialog

Why?

[bri3d]

Users with data caps are an obvious reason, for example, see this frustrated user report here: https://support.google.com/chrome/thread/415181794/chrome-al... .

To your point about `fetch` in the sibling comment; yes, I would also be annoyed by a website which downloaded 4GB in the background without asking me, too.

I don't think this is some moral outrage, to be clear; it's well within Google's rights, it doesn't seem "sketchy" at all, and it is kind of a cool feature, but it feels like they could have done a lot better by just making it opt-in and a little less fingerprintable.

[tantalor]

It doesn't make much sense to tie this to Chrome itself.

If an app or site uses too much bandwidth, it would be better to control this at the OS level, perhaps with a required user notification and consent. Or throttle certain apps.

It's common to set an alert for total data usage, which makes sense so you don't get surprised when you run out of data. That could be extended to watch the usage rate and alert by some threshold, or a projection on the total, like "hey at the current rate, you are going to hit your limit in N minutes".