Welcome to chromate Discussions!

[Eth3rnit3]

💬 Open Discussions for Chromate

We are excited to kick off open discussions for Chromate! This project is focused on building a robust and undetectable automation library for Ruby, leveraging Chrome DevTools Protocol (CDP) while offering advanced stealth techniques. Below are some key topics we would like to engage the community on. Feel free to share your thoughts, ideas, and feedback!

🔍 1. Detection Levels

As bot detection mechanisms continue to evolve, we need a clear strategy to handle different levels of detectability. We propose three distinct levels, each with its own trade-offs. Let’s discuss and refine these:

Level 1: Stealth-CDP

• Description: The browser runs in headless mode on a standard environment (Windows, macOS, Ubuntu). It uses various launch arguments (--no-sandbox, --disable-blink-features, etc.) to reduce detectability. However, it relies on CDP for mouse and keyboard interactions, which triggers JavaScript events (Input.untrusted).
• Challenges: This level is effective for simple automation tasks but can be flagged by sophisticated anti-bot systems that detect synthetic JS events.
• Use Cases: Basic web scraping, quick interactions where high stealth is not critical.

Level 2: Stealth-Headless-Container

• Description: The browser runs in headless mode within a non-graphical environment (e.g., Docker container, Virtual Private Server). It uses CDP for input interactions, similar to Level 1, but is executed in a headless server environment, increasing the chance of detection due to the lack of a display server.
• Challenges: Equivalent to Level 1 in detectability but executed in a non-graphical environment, which may raise additional flags for certain websites.
• Use Cases: Server-side automation, CI/CD tasks, environments where GUI is not an option.

Level 3: Native-X Virtualization

• Description: The browser runs in standard mode (non-headless) within a virtual display server like Xvfb. This allows the use of native mouse and keyboard control via FFI, bypassing CDP input events. This is the most undetectable approach, as it mimics real user interactions, but requires complex synchronization between the virtual display and DOM elements.
• Challenges: Achieving accurate DOM-to-screen mapping is difficult. There is a need for precise alignment of screen dimensions, DPI settings, and mouse control.
• Use Cases: Advanced bot operations, scenarios requiring maximum stealth, long-term automation.

🖥️ 2. Challenges with Virtualized Graphics

Running the browser in a virtualized environment introduces several unique issues that we need to address:

• Browser/Screen Proportions: How to maintain the correct aspect ratio and screen dimensions to avoid detection.
• Measurement Units: Dealing with differences in units between the browser’s viewport (CSS pixels) and the virtual screen (device pixels).
• FFI Integration: Using FFI (Foreign Function Interface) to call native libraries for accurate mouse and keyboard control.

Let’s discuss potential solutions and improvements for handling these challenges.

🛠️ 3. Improving Chrome Startup Arguments

We need to refine the default startup arguments and switches for launching Chrome. While we already use common stealth options (--disable-web-security, --no-sandbox, --disable-extensions), there is room for improvement:

• Enhanced Spoofing: Additional flags for spoofing device characteristics (--user-agent, --disable-blink-features).
• Performance Optimization: Arguments that can help reduce CPU and memory usage during automation.
• Environment-Specific Flags: Tailoring the launch arguments based on the detected environment (e.g., Docker, Xvfb, standard OS).

Feel free to share any suggestions or configurations that have worked well for you.

💡 Other Topics for Discussion

Here are some additional topics that could be interesting to explore as a community:

• Improving Input Interactions: Ideas for enhancing input fidelity, potentially moving away from synthetic events entirely.
• Shadow DOM Handling: Better support for interacting with shadow DOM elements, as many websites are increasingly using shadow DOM for critical UI components.
• Monitoring and Debugging: Best practices for logging, debugging, and tracking stealth capabilities during automation.

---

We’re looking forward to collaborating with you all and making Chromate the go-to solution for Ruby browser automation! Join the conversation, open issues, and submit PRs. Let’s build something great together! 💎🚀