Parable of the Sower by Octavia E. Butler.

Given how seminal Parable of the Sower by Octavia E. Butler is as a work of speculative and dystopian fiction, it’s surprising it took me this long to get to it. I think I was put off by how bleak I’d heard it to be. Also, while I’d loved Bloodchild, it had taken me a week to recover; Parable promised to be no cheerier. Misery loves company, so I decided to subject our book club to it. Here are my spoiler-full notes about the book, based on my own thoughts as well as the discussion we had after.

Overall: I enjoyed it, though I really wanted to stop about 25% of the way through because of how casually violent it was. I’m glad I kept going though. There was much to grapple with, so a good book club pick (pats self).

Octavia Butler wrote the book in 1993, but it feels uncomfortably prescient and close to home. The novel is set in a 2024-2027 California torn apart by social inequality and climate change and features an American president whose slogan is Make America Great Again (!). Octavia Butler is a masterful writer. The book is written from the perspective of a 15-year-old, Lauren, living through dystopia and recording her writings in her journal, and she somehow made the writing seem real and true to the conceit while not being extremely annoying. The prose was exactly what I would imagine from a precocious and articulate teenager. As we’ve read and discussed several books in our book club over the last year, I’ve had to think about what kind of writing I like, and I’ve realized that I prize cohesive and believable prose that keeps you immersed in the story above all else. I hate it when a weird turn of phrase or choice of word by the author makes you go “huh?”. The writing in this case was gripping! Despite the violence, I couldn’t put it down, unlike with Game of Thrones.

Speaking of Game of Thrones, this book had so. much. casual. violence. Horrific violence. Especially rape. So much. The casualness of it was shocking. It made sense in the narrative because she’s a prematurely-jaded teenager recording her post-apocalyptic life in her journal, but it was a hard read especially in the first half of the book. It becomes less violent after that, or perhaps you as the reader become inured to it as well. It was interesting that the violence, while there was a lot of it, never felt gratuitous. It was almost never described in graphic detail, just mentioned.

Religion is a big part of the book. Lauren’s father is a Baptist minister, so she grows up Christian. But faced with a world that does not feel like the workings of a just God, she invents her own religion called Earthseed. The fundamental idea of Earthseed is that “God is Change.” She says that the only constant is change, so all beings have to deal with it and hopefully even affect it.

Also, somehow, she says we all need to go to space.

SPAAAAAACE!

This is a bit of a crazy leap in theological logic, so let’s break it down.

The practicality of Lauren’s conclusion – that the only moral truth is capital-C Change – makes a lot of sense. “Turning the other cheek” doesn’t really help if you’re living in a world where you can’t trust anyone and people will happily murder you and steal everything you own if they can. But taking it a step further, what is the central problem facing Lauren and her family? What is making people lose all sense of fraternity, and causing them to pillage and burn their neighbors? A lack of resources. So then the ultimate solution, the only solution, is to leave Earth itself (!) and find new planets to live on. Right?

Supply-side thinking if I’ve ever seen it. Lauren would do well in San Francisco.

I loved how crazy and unintuitive this was! It makes complete sense that a smart teenager in her circumstances would come to these conclusions. It’s also interesting as religion design. The central tenet is so compelling (change is the only constant), and the eschatological belief so crazy (so we need to go to the stars), that she attracts a wide variety of believers. Something for everyone.

It actually reminded me of how when I was a teenager, I also believed that “extend[ing] the light of consciousness to the stars” was the only way to save humanity. I’m less Musk-pilled now, but it’s awesome that Octavia Butler was able to capture that adolescent impulse and psychology so well.

Lauren suffers from a condition called hyperempathy, where she viscerally hallucinates the pain of others around her. This condition in a hyper-violent world would be a huge disability (and it is). But I think it is also what drives her to re-invent the Buddhist idea of “impermanence” (anitya) and “suffering” (dukkha) from first principles, without having to sit under a fig tree for seven days. Speaking of Buddhism (since Earthseed has distinctly Buddhist vibes), Earthseed doesn’t go as far as Buddhism in claiming no-self. Earthseed’s philosophy focuses on change and dealing with it, but Lauren still believes in a Self that is acting upon the world, and is more concerned with survival than liberation from suffering.

Parable reminded me of Lincoln in the Bardo, a previous book club pick for us. To fully understand pain and suffering, you must truly feel it, and real empathy can provoke swift action to end violence even at the cost of more violence.

We also discussed how empathy has become a political punching bag in 2026 discourse. The Economist recently had an article about how all factions of American politics have asinine positions on empathy: either not being fully inclusive or rejecting it outright.

It’s interesting and believable that Butler’s dystopia stops short of total collapse. There’s still a government, police, and fire department functioning, for some definition of “functioning”, just more like what you would expect from a broken country. It feels real! While an outright Wild-West collapse of America is unlikely any time soon, slow-crumbling institutions and infrastructure sound awfully familiar.

It was a cool parallel to the Underground Railroad that everybody in the story wants to head north, to the northern states and Canada. It might be because climate change makes Canada more habitable. Or it might just be a case of the grass being greener (literally) where you are not; we don’t actually see in the book if Canada is better off. It reminded me of the scene in Civil War where there’s a played-up joke about Canadian dollars being more valuable than USD, to much horrified laughter. The American psyche cannot comprehend Canada doing better (financially, no less) than them.

I hope that when the next apocalypse happens we choose each other instead of building walls. I think we will.

Originally published at https://shivankaul.com/blog/parable-of-the-sower.

Mozilla bundled adblock-rust (Brave’s Rust-based adblock engine, the same one my team works on) into Firefox. Pretty exciting! It landed in Firefox 149 via Bugzilla Bug 2013888. It’s clearly still an experiment: disabled by default, no usable UI, no filter lists, and as far as I can tell, no press coverage.

I previously tweeted posted about Waterfox adopting adblock-rust. It looks like Waterfox is piggy-backing off of Firefox’s implementation (great!). Thanks to Moritz for the pointer to Firefox’s bug linked to from Waterfox’s adblock-rust implementation issue.

How to enable Brave’s adblocking engine in Firefox

Open about:config in Firefox 149+ and set:

privacy.trackingprotection.content.protection.enabled = true

Then point it at some filter lists. It currently ships with no filter lists by default; you have to supply them yourself. To add EasyList and EasyPrivacy filter lists:

privacy.trackingprotection.content.protection.test_list_urls = https://easylist.to/easylist/easylist.txt|https://easylist.to/easylist/easyprivacy.txt

Changing the test_list_urls pref triggers a full reload, but the lists were cached when I tested them.

All prefs

Just search for privacy.trackingprotection.content in about:config. I found the following:

• privacy.trackingprotection.content.protection.enabled: Enable blocking

• privacy.trackingprotection.content.annotation.enabled: Enable annotation (tagging without blocking)

• privacy.trackingprotection.content.protection.test_list_urls: Pipe-delimited list URLs for blocking

• privacy.trackingprotection.content.annotation.test_list_urls: Pipe-delimited list URLs for annotation

• privacy.trackingprotection.content.testing: Fire observer notifications when adblock engine is rebuilt

It looks like Firefox’s bundling supports two modes:

• Protection: matches and blocks requests against filter lists.

• Annotation: matches and tags requests for telemetry/UI, but doesn’t block.

There’s been a huge surge of interest recently in adblock-rust from browsers; Firefox joins Waterfox and Perplexity Comet (a positive note in their otherwise disappointing privacy posture). You just can’t ship a serious browser these days without blocking third-party ads and trackers by default; Firefox still doesn’t block tracking query parameters, for instance. I’m curious to see where this experiment goes!

Originally published at https://shivankaul.com/blog/firefox-bundles-adblock-rust.

I gave the opening keynote talk at Global Privacy Leaders Summit @ RSA 2026 about how the role of the Chief Privacy Officer is changing. The thrust of the talk was that because of incoming AI regulation as well as increasing privacy law enforcement, the practice of privacy is increasingly becoming a systems problem, as opposed to a policy problem. I also argued that AI regulation is really just privacy regulation in disguise.

If you’re leading a privacy program, you should be in the room where it happens inside your company. It’s time to go beyond risk-obsessed thinking and to focus on what you could do if you had the right privacy systems. I made the following points:

1. Compliance is not privacy

2. Regulation is inevitable and incoming

3. AI and privacy are frenemies

For more details, see the PDF slides!

Originally published at https://shivankaul.com/blog/privacy-inflection-point.

Good Things by Samin Nosrat.

I’m part of a cookbook club with some friends. We pick a cookbook, everyone picks a recipe from the cookbook to make, and then we have a big potluck dinner. This is the sign-up sheet template we’ve been using (h/t my friend Bell for the original).

We’ve done 2 cookbooks so far. The first one was Dishoom: From Bombay with Love by the Dishoom folks. I made the ruby chicken. It was a little more effort than I normally put into my chicken curries but it was worth it! The nice thing about cookbook clubs is that you can crowd-source trying out a bunch of recipes. If your friends are good cooks (as mine are), you can find some gems. I’ve incorporated Dishoom’s keema into my “easy dinner” rotation, with a few modifications to actually make it easy.

The second cookbook was Samin Nosrat’s Good Things. I made:

• fluffy meatballs + olive oil fried bread

• roasted sweet potatoes with green sauce

Other people made:

• kukukopita (Samin’s kuku sabzi meets spanakopita)

• simple soba salad (with peanut sauce, reminded me of Montreal’s Chez Mein $2 noodles doused in an unctuous peanut sauce that hit hard after a night out on Saint-Laurent)

• steamed kabocha with sesame ginger dressing

• crunchy cabbage slaw

• pane criminale (garlic bread, insanely good)

• creamy one pot pasta with peas

• braised kale w feta (kale ❤️)

• chocolate cake with burnt honey frosting (!!!)

I loved my meatballs, the soba salad, the pane criminale (it really is criminally good) and the cake with burnt honey frosting. All in all, big success. I highly recommend doing a cookbook club with your friends and family.

Some pics:

Spread of dishes from Samin Nosrat’s Good Things cookbook

Kukukopita: kuku sabzi + spanakopita

Chocolate cake with burnt honey frosting

Originally published at https://shivankaul.com/blog/cookbook-club.

The Correspondent by Virginia Evans.

I normally don’t read recently-published novels, firmly believing in the value of natural selection acting over several years to winnow the good from the merely fashionable. I’ll only read a finite number of words in my lifetime, and I want to make them count, etc. This heuristic has served me well, and I have almost-always regretted straying from it (Trust, The Prophet Song, The Hummingbird, more on this latter one below).

The Correspondent by Virginia Evans, thankfully, was an exception.

We chose it as the inaugural read for a book club. The Correspondent came out in 2025 (!), was a debut (!!) work and is an epistolary novel (!!!). Any one of these factors alone should have been enough to make me hate it, and I honestly would have never picked it up for myself. But I loved it! I raced through it in ~a week.

I’ve been turned off of epistolary novels (novels in the form of letters written between characters) since I read and disliked the much-awarded The Hummingbird by Sandro Veronesi a few years ago. The chronology of The Hummingbird was confusing, the dialogue was clunky (though maybe it’s better in the original Italian), but mostly I didn’t enjoy it because the characters had paper-thin depth. They just didn’t feel like real humans. I’ve found that to be a common problem with the epistolary format: it’s very easy to fall into the trap of telling sans showing. Also, it’s confusing to keep track of the plot and characters while still sticking to the letter-writing conceit. People don’t rush to write letters to their friends in the middle of interesting events (at least these days). People journal, but a monologue is even less fun to read in a novel.

The Correspondent didn’t suffer from any of the above. The letters/emails/journal entries in the novel are mostly written by the protagonist, a retired lawyer who writes letters to friends, family and even celebrities (Joan Didion makes an appearance). This feels believable! She grew up when letter-writing was common, practiced law (which honed her way with words), and is now retired, so she has both the time and the inclination for lengthy correspondence. She writes frequently to the same few people in her life, so you get to learn about their lives and start caring about them (including Joan Didion). She’s also looking back on her life and working through lingering trauma through writing. Over the course of the novel, you learn about her grief and how she has (and mostly hasn’t) dealt with it. It’s sad, but in a hopeful, the sadness comes from caring way.

I related to her since I too am a wordcel and make sense of the world primarily through words. I started writing letters to friends over the pandemic and find it therapeutic, similar to journaling, except you’re also (bonus!) talking to a close friend. The speed of doing something affects the doing, and I think there’s something about the slowness of inscribing ink-on-paper that changes what you write: a measuredness, even a striving towards truth.

The epistolary format of The Correspondent lends itself well to the story, since we get regular updates on her life and events as she processes them. It was surprisingly fun to analyze the metadata (like the date, place, writing style) in the letters and emails. There were things that felt a bit too “cute” and neatly-wrapped in the novel (love it when one letter can instantly resolve decades of trauma) but overall I would highly recommend it to anyone who likes life-affirming fiction and an honest portrayal of grief and how it affects us. I gifted it to my mother, who is also a retired lady who likes words, so I’m curious to see what she thinks.

Originally published at https://shivankaul.com/blog/the-correspondent.

We spent a good chunk of 2025 working on memory savings for adblock-rust. This was important and long-overdue work, since while Brave shines in other departments (speed, CPU usage, battery consumption), we’re worse than Chrome for memory because we ship 100,000 adblock filters by default (several times an hour!) that need to get parsed, loaded into memory and used for every single network request (to decide whether or not to block) and for every single piece of content on every single website (to remove ads cosmetically). This happens even on lower-end devices running Brave, like old mobile phones. Brave’s policy of only blocking third-party ads & trackers by default also plays into this, since we need to make perf-heavy decisions in real-time: was this ad div created by a first-party request or a third-party request?

Once they reach the browser, all those 100,000+ adblock rules have traditionally been stored in the usual heap-allocated data structures in Rust, consuming tens of megabytes across every platform. Over the course of last year, we’ve incrementally moved our adblock engine to use FlatBuffers and made a lot of other performance optimizations, resulting in 75% reduced memory consumption and approximately 45 MB saved on Android, iOS, and desktop. For users who enable additional blocking lists, the savings are even greater. These are massive savings when it comes to browsers!

You can learn more in the blog post I wrote on Brave’s official blog.

Originally published at https://shivankaul.com/blog/adblock-memory-reduction.

I’ve been using Claude Code on the CLI recently, and I keep running into annoying bugs. A particularly egregious one was where Claude Code spawned thousands of zombie processes and exhausted my process limit, essentially fork-bombing me.

In the iTerm2 window where I had claude running, I saw the following output being spammed to the console:

EAGAIN: resource temporarily unavailable, posix_spawn '/usr/local/bin/pgrep'
      path: "/usr/local/bin/pgrep",
   syscall: "spawn pgrep",
     errno: -35,
 spawnargs: [ "-P", 635 ],
      code: "EAGAIN"

      at spawn (node:child_process:669:35)
      at spawn (node:child_process:14:39)
      ...

and eventually my machine crawled to a halt. On opening a new iTerm2 window, I saw:

forkpty: Resource temporarily unavailable

Cause

I looked it up and turns out Claude Code has a known bug on macOS where a child-process tracking loop repeatedly spawns pgrep, eventually exhausting the per-user process budget. The stack trace shows posix_spawn failing with EAGAIN while trying to spawn pgrep -P ....

The problem with these kind of bugs that exhaust your machine’s resources is that it’s hard to be ready to debug them when they do happen, since they take down the very thing you’re trying to debug with (i.e. my terminal). I couldn’t even open a new browser tab to a website, since that creates a new process in Chromium (for good, security-related reasons), and I had already hit the limit!

Mitigation: a wrapper script

I added a wrapper that caps the process limit for Claude’s process tree. I also moved my fix for Claude Code breaking paste bracketing to this Claude Code wrapper script.

#!/usr/bin/env bash
# Claude Code wrapper - limits max processes, fixes bracketed paste on exit

# Find the real claude binary
REAL=""
IFS=':' read -r -a dirs <<< "$PATH"
for d in "${dirs[@]}"; do
  cand="${d:-./}/claude"
  if [[ "$cand" != "$0" && -x "$cand" && ! -d "$cand" ]]; then
    REAL="$cand"
    break
  fi
done

[[ -z "$REAL" ]] && { echo "Error: claude not found" >&2; exit 127; }

# Cap max processes (default 1000) to prevent fork bombs
ulimit -u "${CLAUDE_CODE_MAXPROC:-1000}" 2>/dev/null || true

# Disable feedback survey popup.
export CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1

echo "Claude wrapper active (maxproc=$(ulimit -u))" >&2

# Run claude
"$REAL" "$@"
rc=$?

# Fix bracketed paste mode that claude sometimes leaves enabled
printf '\e[?2004l'

exit $rc

Customizing the process limit

Set CLAUDE_CODE_MAXPROC to adjust:

export CLAUDE_CODE_MAXPROC=2000

If Claude goes haywire, it hits the process ceiling instead of taking down your whole session.

This helped a lot next time Claude Code went haywire, since it wasn’t able to completely exhaust my machine. I was able to do some analysis and confirm the issue.

Analysis

Checking the process limit vs. actual count:

# User process limit:
ulimit -u

# Actual process count
ps -U "$USER" | wc -l

Something was creating many, many processes. A histogram of process states showed the problem:

$ ps -u "$USER" -o comm= | sort | uniq -c | sort -nr | head -10
[a large number] <defunct>
... some other ones

This revealed many defunct (zombie) processes. Grouping zombies by parent PID:

$ ps -A -o ppid=,stat= | awk '$2 ~ /Z/ {print $1}' | sort | uniq -c | sort -nr | head -20
[a large number] 16784

Almost all were parented by a single PID, which turned out to be claude -r:

$ ps -p 16784 -o command
COMMAND
/Users/shivan/.local/bin/claude

Killing that process immediately dropped the count back to normal (~542) and iTerm started working again.

The actual fix

In the error output:

EAGAIN: resource temporarily unavailable, posix_spawn '/usr/local/bin/pgrep'
      path: "/usr/local/bin/pgrep",
   syscall: "spawn pgrep",
     errno: -35,
 spawnargs: [ "-P", 635 ],
      code: "EAGAIN"
      ...

It was confusing why Claude Code was using /usr/local/bin/pgrep. It should have been using the system-installed one in /usr/bin/pgrep. which pgrep also gave me the wrong location, so it wasn’t just Claude Code.

On more investigation, it looks like when I migrated from an Intel Mac to Apple Silicon, orphaned Homebrew files remained in /usr/local/ (the old Intel Homebrew location) while the new Apple Silicon Homebrew uses /opt/homebrew/. The orphaned /usr/local/bin/pgrep was a symlink to proctools, a Homebrew package that provided pgrep before macOS included it natively.

Critically: the proctools pgrep has a bug where the -P flag (filter by parent PID) is completely ignored. Instead of returning only child processes, it returns all processes on the system. So when Claude Code runs pgrep -P <pid> to track its child processes, the broken version returns hundreds of PIDs instead. If Claude Code iterates over these results spawning more pgrep calls, the process count explodes exponentially. This is exactly what happened in the PM2 project: “TreeKill fails to work and spawns hundreds of pgrep processes which typically make the system unusable”. Their fix was to always use native pgrep on macOS; exactly like in my case.

I removed all orphaned Intel Homebrew files, made sure I didn’t have proctools installed, and now which pgrep correctly returns /usr/bin/pgrep. I think this actually fixes the issue, since people on the GitHub issue said that brew uninstall proctools and using the system-installed pgrep fixed their problem.

Originally published at https://shivankaul.com/blog/claude-code-process-exhaustion.

We had a suburban holiday season. The final days of 2025 slipped away in quiet, rain and rest. We didn’t travel anywhere, which was (finally) keeping in line with my everlasting resolution to travel less (unlike 2024). I’m slightly worried that I’m turning into my Dad, who loves home with a burning passion, but I just hate the idea of flying and airports and flight delays and cramped seats (having said that, I am actually looking forward to traveling in 2026, more below).

So I spent the past few weeks sheltering from the atmospheric river in San Ramon with family, foraging for eggnog lattes, shopping in Walnut Creek, snapping at Claude Code, inhaling copious amounts of white rice quinoa, and going for long walks afterwards to shake off the brainfog. I gotta say, I love dense cities as much as your average SF YIMBY, but for nighttime walks, nothing beats a nice leafy American suburb. I’m still slightly scarred (only mentally, thankfully, not physically) from my drunk driver scare last month.

We also re-watched some classics like Prisoner of Azkaban and the original Star Wars movie. We had a brief shot at acting young on New Year’s Eve because we had bought tickets for a Swedish House Mafia NYE concert way back in November, but eventually the “show runs till 3 am” part sunk in and we decided to become inadvertent ticket scalpers and settle for a nice evening in with friends, playing Kombio and finally figuring out how the karaoke machine that my uncle gave us as a wedding present works.

Wedding

That’s right: we got married in 2025! It’s crazy to think of this time last year, when I was in India frantically calling wedding venues in Hyderabad and Bangalore (all of which was ultimately for naught, since we ended up getting married in California). We went from deciding to get married in late December to finalizing our venue in March, and then the wedding soon after in the summer. The first half of the year was entirely spent in wedding craziness.

Now that the wedding planning trauma has worn off a bit, I find myself looking back on our wedding with fondness. There’s probably no other time in your life that you get to gather all your loved ones in a single location and have a huge party. Our sangeet night was probably the happiest night of my life. The wedding itself also felt pretty meaningful: both the religious one, when the priests started chanting very intensely and we had our hands on the crowns of each other’s heads; it felt like we were in a sietch in Dune, participating in an ancient ritual (which I guess we were), and the official signing in front of a representative of the Californian government (which felt very legal and very solemn). I personally also think we both looked gorgeous.

Doing the main wedding in California meant that we got to control the wedding to a very large extent, which I’m grateful for. Our respective parents got to have their own wedding receptions in India when we visited North and South India in June/July. I highly recommend this distribution of wedding planning: minimize conflict by performing an Inverse Conway Maneuver and leaning into Conway’s Law. Weddings are emotional hotboxes anyway.

Proposal

I didn’t initially intend on proposing since we’ve been together for almost a decade and had begun planning the wedding together before the thought of a proposal even occurred to me, but my wife (my wife!) made it very clear that she wanted a ring and that it had to be presented beautifully and memorably. I dutifully planned a nice proposal weekend in Carmel-by-the-Sea. Highlights:

1. Gain: one beautiful diamond ring (check out Frank Darling if you’re in SF or NYC)

2. Gain: one tick bite (turns out you shouldn’t get down on one knee in a park named after the Spanish word for ‘tick’)

3. Loss: one purse, which was left behind after our celebratory dinner (I’m still sure the staff at Anton & Michel restaurant know more than they are letting on about that, but oh well)

I had also arranged it so that she came back to the hotel room to find strewn rose petals, a bottle of champagne and chocolate truffles. This was accomplished with some advance planning and faking a last-minute bathroom emergency right before we headed out from the hotel to the dinner. Big thanks to the hotel staff at La Playa Hotel, and big thanks to Instagram reel-spiration.

Death

I dealt with a lot of age-related things this year. Three grand-uncles passed away. One of them, to whom I was especially close and who was like a grandfather to me, passed away in the spring. I’m glad I decided to travel to India for his funeral, even though it was pretty close to our wedding. I think we all got a chance to remember him together, as a family.

My birthday

Birthdays always make me sad. My feelings about this are complex, but my wife (my wife!) surprised me this year by taking me on a last-minute trip to LA. I didn’t know where we were going until we got to the airport gate, which was pretty crazy. She also chose a couple of amazing restaurants (LA’s food scene remains superior), we stayed at a cute hotel and then at night we went to an Anoushka Shankar concert.

Traveling

I barely traveled this year, compared to previous years. We did a trip to India after our wedding where we traveled to the following places:

1. Hyderabad

2. Barog

3. Kashmir

4. Goa

Domestically, in the US, I traveled to:

1. Roadtrip down the Pacific Coast Highway to Ventura and then back for Thanksgiving

2. Midwest for the first time: Minneapolis and Madison

3. Los Angeles for my birthday

I’m actually looking forward to traveling more next year! I think I’m over my aversion to traveling, finally, after a big break in 2025.

Fitness

I had a couple of health scares right after coming back from India. Nothing too major, just means that I need to be a lot more careful about my diet and cardiovascular health. I also had my first brush with just how utterly broken and annoying the American healthcare system is.

The major change in my fitness routine compared to last year was that The Center shut down :( I’d written about it last year as one of the highlights. Why can’t we have nice things in the city? Our yoga teacher moved to teaching at Love Story Yoga but unfortunately it’s hot yoga, which I despise. I don’t need helping sweating, thank you very much.

I continued playing frisbee, running occasionally, and lifting weights at home. I’ve realized that most of my walking happens while I’m traveling, which meant that I walked less in 2025 than in 2024 since I traveled far less. I did do more Walking Club events though, and finally did the Crosstown Trail.

I plan on walking a lot more in 2026, especially after meals.

Tango

No more tango for me, since it started conflicting with yoga once I started going to Love Story Yoga. I might bring this back in 2026, since the teachers changed.

Concerts

• Tame Impala: great laser show, I’m happy he is still going strong and is popular with the youngs.

• Outside Lands: had a great time this year, especially with the double-set Vampire Weekend bonanza. The trick is not to overpack your agenda and only attend the shows you really care about, even if that means you only attend a couple a day. It’s just so much more fun if you’re not hurrying all the time.

• Arooj Aftab: this was our second time seeing her in concert. She was great as always, and got progressively drunker as the night went on.

• Zayn: tickets were surprisingly cheap, and the crowd was 95% millennial women. Great show though; Zayn’s a fantastic singer.

• Anoushka Shankar: my birthday gift concert in LA!

Kashmiri

I learned a lot of Kashmiri this year primarily due to attending Koshur lessons every Sunday in the Fall. It’s also been nice to spend more time with Kashmiri people, which I’ve been doing a lot of. I am also signed up for Kashmiri Intermediate classes next year and I hope to continue getting better. I try exclusively talking to family in Kashmiri but it’s very hard, since I get frustrated with my lack of expressiveness.

Work

I was effectively acting-CISO for Brave while my manager (our actual CISO) was out on maternity leave. In general, I took on a lot more security work this year, in addition to privacy. One big theme was prompt injections in AI browsers. I wrote about our work here.

Rohan leaving

My good friend Rohan left SF for NYC. I miss him a lot! There’s going to be way less FIFA in 2026.

What I’m curious about next year

1. The big theme in 2026 will be immigration. Let’s see where I end up. I will know more by after the first quarter of the year.

2. I’m also looking forward to traveling more, if everything goes well with immigration. There’s a big Europe family trip coming up in the summer that I really don’t want to miss 🤞

3. I want to be more intentional about getting better at Saturday frisbee. I plan on showing up 30 mins earlier and getting some throwing practice in.

4. More walk club, for sure.

5. Work should be interesting and change a lot this year. Stay tuned.

6. I’m looking forward to training for a half-marathon again, and in general running more.

7. Continue getting better at Kashmiri.

Originally published at https://shivankaul.com/blog/2025-wrapped.

Claude Code sometimes pops a “How is Claude doing this session?” feedback survey mid-flow. There’s a simple way to disable it:

Set CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1 in your environment.

The cleanest option is to put it in Claude Code’s ~/.claude/settings.json under env:

{
  "env": {
    "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1"
  }
}

Source: this GitHub comment.

UPDATE: you can add the following for even more Claude Code tweaking:

export CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
export DISABLE_AUTOUPDATER=1
# Reduce splash screen size.
export IS_DEMO=1

Source: this Hacker News comment.

Originally published at https://shivankaul.com/blog/disable-claude-code-feedback-prompts.

I recently wanted to download a wedding video from a media-hosting platform that had no download button. If my browser could play it, the video data was clearly being streamed somewhere; how hard could it be to capture and save it as an MP4?

Turns out: not very hard. With chrome://media-internals, DevTools and an (AI-generated) ffmpeg command, I went from a streaming HLS video to a local MP4 file in about 15 minutes.

Step 1: Is this thing encrypted?

I wanted to know whether the browser was dealing with encrypted or DRM, which would complicate matters quite a bit. On Chromium-based browsers you get a useful tool for that: chrome://media-internals.

I opened that page, then played the video in another tab. A new media entry appeared. For kVideoTracks, the value was:

[
  {
    ...
    "codec": "h264",
    "coded size": "1920x1080",
    ...
    "encryption scheme": "Unencrypted",
    ...
  }
]

and for kAudioTracks:

[
  {
    "bytes per channel": 2,
    "bytes per frame": 4,
    "channel layout": "STEREO",
    "channels": 2,
    "codec": "aac",
    ...
    "encryption scheme": "Unencrypted",
    ...
  }
]

In other words:

• Video codec: h264 (High profile), 1920×1080.

• Audio codec: AAC stereo.

• Encryption scheme: Unencrypted.

So no encryption! Also, no Content Decryption Modules to worry about.

In contrast, if I play something on netflix.com (which uses Widevine for DRM), the encryption is listed as "encryption scheme": "CBCS" and kIsCdmAttached: true in chrome://media-internals.

Step 2: Find the stream URL in DevTools

Next task was to get the master manifest file. I went to the tab playing the video and opened up DevTools → Network.

I started playing the video and filtered the requests by .m3u8. This was a guess, though a likely one, since most Web video content uses Apple’s HLS protocol for adaptive video streaming. I was looking for a master manifest file: a top-level manifest that lists all available quality options for a video. On playing the video, one URL popped up that looked like a master manifest file:

https://media.website/videos/o.m3u8

Clicking on the master manifest and looking at the response showed:

#EXTM3U
#EXT-X-VERSION:6
#EXT-X-INDEPENDENT-SEGMENTS
#EXT-X-MEDIA:TYPE=AUDIO,GROUP-ID="program_audio_0",LANGUAGE="eng",NAME="Alternate Audio",AUTOSELECT=YES,DEFAULT=YES,CHANNELS="2",URI="o_2ch-160.m3u8"
#EXT-X-STREAM-INF:BANDWIDTH=6599291,AVERAGE-BANDWIDTH=4657683,VIDEO-RANGE=SDR,CODECS="avc1.640028,mp4a.40.2",RESOLUTION=1920x1080,FRAME-RATE=23.976,AUDIO="program_audio_0"
o_1080p.m3u8
#EXT-X-STREAM-INF:BANDWIDTH=1694319,AVERAGE-BANDWIDTH=1347730,VIDEO-RANGE=SDR,CODECS="avc1.640020,mp4a.40.2",RESOLUTION=768x432,FRAME-RATE=23.976,AUDIO="program_audio_0"
o_432p.m3u8

This master manifest essentially says: “Here are two quality options you can choose from: 1080p or 432p. Both use the same audio track. Pick whichever fits your bandwidth.”

It doesn’t contain any media segments itself.

Step 3: Piping the master manifest into ffmpeg and downloading

Amazingly, the URL for the master manifest is all that ffmpeg needs! It can figure out the rest (downloading the manifest, reading it, picking a video quality variant, fetching the relevant playlists, downloading the media segments, remuxing) once it has the master manifest file 🤯

An initial naive effort was just taking the request URL for the master playlist and passing that to ffmpeg.

ffmpeg -i "https://media.website/videos/o.m3u8" -c copy video.mp4

Note: The -c copy tells ffmpeg to not re-encode the audio/video samples and instead simply remux the H.264 + AAC streams into MP4, so it saves us a lot of time and processing. I’m actually not sure why it’s not the default; it might be because ffmpeg is primarily a transcoder, though I’m not well-versed enough with ffmpeg to say more here. Update: this quickstart guide is useful if you’re looking to getting into video editing.

Unfortunately, the ffmpeg command above didn’t actually work; the server blocked it as “403 Forbidden”. That makes sense since I had to login on my browser to play the video file. Fortunately, pretending to be the browser is pretty easy. DevTools has a handy Copy as cURL option for network requests (just right-click the request and go to Copy >). This gives you all the cookies and headers sent by the browser for the network request.

I could have spent some time massaging the cURL command into what is accepted by ffmpeg but I was too lazy so I just asked ChatGPT to do it for me and it one-shotted converting cURL HTTP cookies into ffmpeg’s headers format:

ffmpeg 
  -headers "Cookie: CloudFront-Key-Pair-Id=abc; CloudFront-Policy=def; CloudFront-Signature=xyz" 
  -i "https://media.website/videos/o.m3u8" 
  -c copy test.mp4

And that’s it. ffmpeg got to work and figured it all out for me.

End result: a portable MP4 video file that plays everywhere! This was ~simple because:

1. ffmpeg as a tool is super useful (if a bit ornery) if you’re doing anything related to audio/video.

2. Browser developer tooling is extremely good and worth familiarizing yourself with.

3. No DRM or encryption or complicated authentication; this wouldn’t work for Netflix/Disney+ etc.

Originally published at https://shivankaul.com/blog/hls-to-mp4.

Perplexity Comet leaks your entire browsing history to their servers, and there’s no way to turn it off.

Update: as of June 27, 2026 on version 149.0.7827.197 this still reproduces.

Comet’s security and privacy posture is terrible. Much electronic ink has been spilled over Comet’s security holes, including a lot by me, so I won’t go into that too much here except to repeat that prompt injection attacks are essentially trivial to do. Until recently, you could ask Comet to summarize a Reddit post for you, and it could lead to a complete account take over. Maybe one day we’ll come up with better sandboxing for agentic browsing, but until then, you SHOULD NOT be using agentic browsing in any browser where you are logged into your banking or other sensitive accounts. If you’re using the ChatGPT Atlas browser, use logged out mode (and kudos to them for offering that UX affordance).

Leaking URLs to the backend

I dug through and turned off every single toggle in Comet browser’s Privacy and Security settings and found that Comet still leaks every URL you visit to their backend. I even turned off Comet Assistant, with no luck.

This is me simply navigating to my website in Comet: no prompting via AI, no asking questions, simply opening a URL.

Screen recording

I made a screen recording to show how Comet leaks the URL on navigation to their backend. To be comprehensive, I did the following steps as setup:

Test setup

1. Check that the tool I’m using for inspecting HTTPS traffic (Proxyman) doesn’t have any existing recordings for my website (shivankaul.com) in Comet.

2. Ensure that comet://settings/privacy and comet://settings/security have reporting toggles turned off. This includes Improve search suggestions and Improve search results with external search engines.

3. Clear all browsing data, to not bias results.

4. Check that the Comet version from comet://version is latest (at time of initial writing, 141.0.7390.55 on macOS arm64. Also reproduced on 149.0.7827.197).

Test results

Then for my actual test, I did:

1. Open a new tab and manually type in shivankaul.com in Comet and press Enter.

2. Go to Proxyman

3. See network calls to https://www.perplexity.ai/rest/autosuggest/list-autosuggest?version=2.18&source=default with a request body that contains "source_tab_url": "https://shivankaul.com/".

A positive note: Comet does adblocking!

It was cool to see that Comet uses Brave’s open-source adblock-rust engine and Brave’s filter lists to power their adblocking (though it took a few rounds of back-and-forth with their legal counsel to convince them to attribute the project correctly as required under MPL-2.0).

I can think of two reasons for Comet shipping adblocking:

1. Adblocking is a table-stakes feature for all browsers, especially newbie ones trying to gain any market share at all.

2. Agentic browsing benefits from blocking unhelpful cruft on websites. Fewer “subscribe to my newsletter!!!” popups means fewer tokens used by your agent trying to dismiss them, and less likely it’ll get confused trying to find Thanksgiving recipes.

I’m guessing it’s a combination of both.

Sounds like ChatGPT Atlas also plans to ship opt-in adblocking soon. Third-party adblocking is great for security and privacy, so I’m excited to see more browsers offering it.

Originally published at https://shivankaul.com/blog/comet-privacy.

Here because of Claude Code?

If you’re here because of Claude Code messing up paste bracketing in your terminal, try putting in the following in your .bashrc or .bash_profile:

claude() {
    command claude "$@"
    printf '\e[?2004l'
}

(credit: this GitHub issue comment)

I actually ended up writing a wrapper script for Claude Code where I deal with this and other annoying bugs, and I folded this fix into that wrapper.

Paste bracketing

If pasting in iTerm2 or similar terminal emulator prints 00~ before your text, your terminal is leaking bracketed-paste markers because the shell can’t handle them. This typically happens on iTerm2 if an SSH session ended weirdly or your editor crashed or if your Bash is very old (or you exited Claude Code). See iTerm2’s help article about paste bracketing.

My terminal was wrapping a paste with ESC [ 200 ~ … ESC [ 201 ~, but my old macOS Bash (3.2 with old Readline) didn’t recognize that, so part of the marker showed up as literal 00~. The fix: using a shell/readline that supports bracketed paste, or disable the feature in the terminal emulator.

Symptom

• Pasting at a plain Bash prompt prints 00~ before the pasted text.

• You can check this by doing:

cat -v

Paste anything. If you see ^[[200~ ... ^[[201~, bracketed paste is active. Ctrl+C to exit.

Cause

• iTerm2 only sends those markers when an app or shell enables bracketed paste.

• Bash <= 3.2 doesn’t parse them so some of the sequence (often 00~) prints.

• It can appear “random” because a tab can be left in that mode after a program exits or a session dies; new tabs are clean.

Fixes

1) Just upgrade Bash

Using brew and on macOS:

brew install bash
echo "/opt/homebrew/bin/bash" | sudo tee -a /etc/shells
chsh -s /opt/homebrew/bin/bash

Open a new terminal window.

Verify:

echo $SHELL        # /opt/homebrew/bin/bash
bash --version     # 5.x

Note: Intel Macs may use /usr/local/bin/bash instead of /opt/homebrew/bin/bash.

2) Turn it off in iTerm2

iTerm2 might even prompt you:

You can change preferences for iTerm2: Preferences → Advanced → search “bracketed” → tweak paste bracketing.

Verify it’s gone

cat -v

Paste again. You should not see ^[[200~ ... ^[[201~.

Originally published at https://shivankaul.com/blog/paste-bracketing-iterm2.

Before Sunrise and In the Mood for Love.

I recently watched Before Sunrise and In the Mood for Love in quick succession, the latter for the first time. Having seen In the Mood for Love just the night before and finding Mrs. Chan’s character fascinating, I was thinking a lot about Celine while rewatching Before Sunrise.

Celine and Mrs. Chan seemed to be caught between playing a societal script and a desire to romanticize their lives and exert control. Mrs. Chan wears beautiful dresses just to step outside for noodles; self-assertion in the face of neighborly (and broadly, societal) surveillance. She feels powerless to do anything about her husband cheating on her, so she walks (aesthetically, in slow-motion), dressed in armor-like cheongsams, through confining corridors. Celine decides she likes Jesse the moment she sees him and requires little convincing to go on a Viennese mini-adventure. She jokes that she would have done the same with any man who asked. She’s trying to get off the train, both literally and metaphorically; to inject agency and romance into her comfortable-but-boring life (a frustration she brings up repeatedly), while still rejecting the “French girl summer fling” trope. When parting with Jesse, even though she is distraught at the prospect of never seeing him again, she initially proposes meeting only after 5 (!) years, resisting the role of a besotted young woman to the very last second. The most overt way she expresses her attraction to Jesse is a pretend phone conversation, which is mirrored in the husband-wife role-play between Mrs. Chan and Mr. Chow in In The Mood for Love. Both Celine and Mrs. Chan are self-mythologizing, managing scripts, in rebellion against their roles through acts small and big: Mrs. Chan against a culture that says that she shouldn’t be out too late and should be able to keep her husband around and should willingly bow down to fated unhappiness, and Celine against male fantasies and an upbringing that stresses the overriding importance of self-reliance and independence for women. This recurrent, conflicting desire for narrative control is what makes both women (and by extension, both movies) interesting.

The men, on the other hand, are slightly boring and serve largely as foils. Jesse in Before Sunrise especially just seems like an annoying 23-year-old American kid. I suspect he will be more annoying on every subsequent rewatch, as I drift further and further away from being a 23-year-old. Nobody likes you when you’re 23 (except maybe other 23-year-olds). I liked his character a lot more in the sequels, in which he’s significantly older.

Overall, both films are beautiful and deserve watching (and rewatching; I’ve seen the Before trilogy thrice now, once for every decade of my life). Watch them if you’re into character-heavy studies of men and women winding into and out of vulnerability through lots and lots of conversation.

Originally published at https://shivankaul.com/blog/in-the-mood-before-sunrise.

This is part two of a blog post summarizing the state of browser fingerprinting in 2025. You can read part one here), where I went over the what, who, why, and how of browser fingerprinting. In this post, we’ll discuss how browsers protect against fingerprinting, and how you can protect yourself.

Protecting against fingerprinting

Trackers doing browser fingerprinting are essentially trying to divide users into buckets that are:

1. diverse. If every user is in the same bucket (“uses an iPhone”), you haven’t learned much about the user.

2. stable. If the user changes their fingerprint every time they visit your site, it’s not much of a fingerprint.

Browsers apply fingerprinting protections that are aimed at defeating this bucketing.

Consider the butterfly

Let’s imagine you’re a beautiful and unique butterfly, trying to avoid capture and identification by malicious lepidopterists who are looking for you (apologies in advance to worthy lepidopterists). You have two main strategies to avoid a future that involves being pinned up on a wall:

1. hide in a crowd

2. fly randomly

This is much like being a user on the Web, where you’re trying to avoid being fingerprinted by trackers.

Hiding in a crowd (avoid diverse buckets)

As a butterfly, you can evade capture by hiding your unique beauty in a crowd of other butterflies. The goal of “hiding in a crowd” (or herd immunity) is to make every browser look the same. This is the strategy used by Tor Browser and Mullvad. The way this works is that you remove APIs and capabilities that reveal a lot of information about the browser. Unfortunately, this often means that powerful APIs end up getting removed from the Tor Browser, which limits its widespread use. This might be fine for Tor Browser, which targets users with a higher-than-usual risk profile who typically care more about privacy than usability. But mainstream browsers with hundreds of millions of (mostly non-technical) users cannot afford to remove useful Web APIs. Having said that, major browsers frequently do remove APIs that are low-utility and high-fingerprintability such as the Topics API being removed by Brave, Safari and Firefox.

It’s worth noting that browsers that always run on similar hardware and software, like Apple’s Safari, benefit from the lack of diversity because individual users stand out less.

Fly randomly (avoid stable buckets)

As a butterfly, instead of trying to be the same as everyone else, you can zig-zag across the sky, evading capture. You can try to be as different as possible, every time.

This is Brave browser’s approach for many Web APIs: randomize the fingerprint per-session and per-site. This effectively means that your fingerprint will be unique for a website but different across every website (which defeats cross-site tracking), and will reset after every browsing session (which defeats cross-session tracking), similar to how cookies and state is cleared after a Private browsing session.

Safari 17 introduced advanced fingerprinting protection (though only in Private Browsing mode) largely modeled on Brave’s fingerprinting approach of adding random noise to API output. Encouragingly, Safari 26 will enable advanced fingerprinting protection by default.

When this strategy of randomizing Web APIs works, you get both powerful Web APIs and privacy. In practice, this is very tricky to get right and can lead to web dev frustration and website breakage, when the injected randomness interferes with website functionality. Brave had to change their screen fingerprinting protection to report “one-of-few” outputs so as to place users in large buckets instead of purely randomizing.

Bonus: block known trackers

As a butterfly, you can also start a list containing photographs of lepidopterists so that you can distinguish them from harmless human friends, and you can share that with your butterfly friends, so you all know to stay away from the bad guys. This “crowdsourced blocklist of known bad actors” approach is surprisingly effective in Web privacy. You might (as a concerned butterfly) ask: What if a blocked lepidopterist just puts on a disguise? What if a new lepidopterist appears? And why are we still continuing with this butterfly analogy when it has clearly broken down several paragraphs ago and was probably broken to begin with? These are all valid questions.

A blocklist to block advertisers and trackers might not seem like a robust approach. But the truth is that most tracking on the Web is done by a few well-known companies, and if you block them, you protect yourself against most of the harms. Also, community lists are surprisingly well-maintained, with new rules being added (to counter new tracking scripts and requests) and removed (to counter website breakage) on the order of minutes.

Every browser uses blocklists in some way to block content: Firefox’s Enhanced Tracking Protection based on Disconnect and Brave’s ad & tracker blocking based on various community-maintained lists are good examples of this. Safari blocks known trackers in Private Browsing mode using a combination of EasyPrivacy and DuckDuckGo’s Tracker Radar. Chrome interestingly also uses this strategy to block “bad ads” using a modified form of EasyList.

How do I protect myself?

Turn fingerprinting protections on!

In practice, browsers apply a mix of the above strategies, depending on the Web API or source of variance they’re trying to minimize. However, not every browser applies fingerprinting protection by default:

Safari

Enable Settings → Advanced → “Use advanced tracking and fingerprinting protection.” → “in all browsing”.
The current default is “in Private Browsing”, though this will change in Safari 26.

Firefox

Turn on Resist Fingerprinting in about:config. See instructions.

Brave

Fingerprinting protections applied automatically and by default.

Chrome

Chrome doesn’t currently do much against fingerprinters. They’re exploring blocking known third-party fingerprinting scripts in Incognito Mode.

Block trackers

If you don’t use a browser with an in-built ad and tracker blocker like Brave, use a good adblocking extension like uBlock Origin. On Chromium-based browsers, unfortunately, the use of adblocking extensions is becoming increasingly harder given Google’s move to phase out Manifest V2 extensions.

Hide your IP address

IP addresses are stable network-level identifiers that browsers need to actually connect to websites. This is unfortunate, because it means that trackers can simply fingerprint your IP address and there’s not much browsers can do about it. IP address hiding operates on the principle of not connecting directly to the website and instead routing your connection through an intermediary server. The website then sees the intermediary’s IP address, not yours. On the other hand, the intermediary server now knows both your IP address and the website you’re visiting. So what do you do? You add more intermediaries! All of this raises sticky questions about who you trust on the Internet, and you can read more about this topic in an essay I wrote (available here) for the book “Eaten by the Internet”.

The more the number of intermediaries or hops between you and the website, the better the privacy, but worse the network speed. You have some options to hide your IP address:

1. A trustworthy VPN (1 hop): most VPNs are privacy nightmares. The Open Technology Fund (OTF) has sponsored great research into shady VPN practices (disclosure: I’m on the Advisory Council for OTF). Some good ones are bundled into the browser such as Mozilla VPN, Brave VPN or Mullvad. Since it’s just one hop, the VPN knows your IP address and which websites you’re visiting, so you better trust them to not sell your browsing history to advertisers. Given that it’s also expensive to operate a VPN, you should never trust free VPNs.

2. Private Relay (2 hops): Apple’s 2-hop iCloud Private Relay hides your IP address from both Apple and the website, but requires an iCloud+ subscription and an Apple device.

3. Tor (3 or more hops): for the highest privacy guarantees (but worst performance), use the Tor network to hide your IP address and network metadata, either via Tor Browser or another browser’s implementation such as Brave’s Tor mode. Always prefer Tor Browser if your safety depends on it.

Lastly, test!

You can check your browser’s vulnerability to fingerprinters by using a good fingerprinting testing website like EFF’s CoverYourTracks.

I put together a simple demo website to give a visual example of how browsers apply anti-fingerprinting measures. The demo website writes and reads data using Canvas API, a widely-used Web API that is also sadly commonly used by fingerprinters. Canvas fingerprinting draws hidden graphics using the Canvas API and re-reads the raw pixels. These pixels encode subtle details about your GPU, driver, fonts and sub-pixel rendering which can then be hashed by a tracker into a stable identifier which survives anything you can do (short of getting a new computer). To combat this, many browsers inject noise into the pixels when they are read back. The demo website helps visualize that noise. To not break website functionality, the noise injected by the browser (if it does) is ordinarily invisible to the human eye; the demo deliberately amplifies the distortion to show how different browsers use different noise-injection strategies.

Brave in default mode. Random noise throughout the canvas. As tested on https://shivankaul.com/brave/canvas-noise at time of publication

Safari in Private Browsing. Notice the subtle random noise at the four corners of the image. As tested on https://shivankaul.com/brave/canvas-noise at time of publication

For a fun exercise, try out the demo website on Mozilla Firefox with Resist Fingerprinting turned on and see what you get!

Acknowledgements

Thanks to Juliana Guerra, Rohan Dandavati, Aakash Japi and Gurshabad Grover for proofreading my ramblings and giving fantastic feedback.

Relevant reading

1. Fingerprinting, web.dev

2. Firefox’s protection against fingerprinting

3. Brave’s fingerprinting philosophy: https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections

4. Apple’s one-pager on their tracking prevention mechanisms: Tracking Prevention in WebKit

5. [Private Browsing 2.0 WebKit](https://webkit.org/blog/15697/private-browsing-2-0/)

6. Open source privacy tests for browsers by Arthur Edelstein: PrivacyTests.org

7. DuckDuckGo’s tracker radar, used by Safari: https://github.com/duckduckgo/tracker-radar

8. Test your browser to see how well you are protected from tracking and fingerprinting: EFF’s Cover Your Tracks

9. Fraud, Abuse, Fingerprinting, Privacy, and Openness by Martin Thomson

10. Old but comprehensive writeup by Chromium on client identification mechanisms: Technical analysis of client identification mechanisms

11. Study examining trackers across the Web: Online tracking: A 1-million-site measurement and analysis

12. Mullvad, IVPN, and Mozilla Top Consumer Reports’ VPN Privacy

Originally published at https://shivankaul.com/blog/beyond-cookies-browser-fingerprinting-in-2025-2.

Earlier this year, I was asked to give a talk on the state of browser fingerprinting by the Public Interest Technology Group (PITG). I wrote a blog post based on the talk that was published on the PITG blog. I decided to reproduce it in full on my own blog because I made some edits post-publication, and I think it reads better as a two-part blog post. So here’s part one. You can find part two here.

Beyond cookies: browser fingerprinting in 2025

Cookies are optional. Fingerprinting isn’t. In 2025, the easiest way for trackers and third-party advertisers to follow you across the Web is to read the traits your browser can’t help revealing (screen, fonts, GPU quirks) and stitch them into a stable ID. The third-party advertising and tracking ecosystem has metastasized to a point that even US intelligence agencies use ad blockers internally for security reasons. The connection between real-time bidding and personal data leaks is well-established. This personal data often ends up with data brokers and eventually leads to users experiencing financial fraud.

This blog post gives an overview of how browser fingerprinting is used for tracking, how browsers protect users, and how users can protect themselves. This latter part is important, because most browsers leave anti-fingerprinting off by default. Web privacy is a fast-evolving and complicated field, so the goal of this writeup is to give a clear mental model and links for diving deeper.

What is a browser fingerprint?

A browser fingerprint is much like a human fingerprint: a unique identifier that is hard to change. The more ways in which you’re different from other users, the more identifiable your browser fingerprint, and the easier you are to track across the Web. If all a website comes to know is that you’re on an iPhone 16, that’s not particularly identifying, since you are far (far, far) from the only iPhone 16 user. But websites also need to know things like your screen size (to properly display the website for your screen), your timezone (to show you your calendar), whether or not you have dark mode enabled (for accessibility as well as general hacker vibes), etc. In combination, all of these small differences contribute to making your browser look unique.

For a browser, this presents a dilemma: break the ability for websites to detect dark mode and you incur the wrath of your most vocal users whose hacker aesthetics you just committed photocide against (ask me how I know). Don’t, and that’s yet another bit of information exposed to malicious tracking scripts. It gets even more complicated with more advanced fingerprinting techniques that rely on subtle differences between how different computers render pixels, or how sound cards process sound. We’ll come back to this point when discussing anti-fingerprinting strategies, but generally, the more modded and customized your computer setup, the more identifiable it is.

This majorly sucks, because the power of the Web is in its dynamism and diversity. JavaScript and other Web technologies let developers design immersive experiences and power the Web economy. Also, the same Wikipedia.org website can work across different operating systems, device manufacturers, form factors and hardware capabilities, ranging from my Apple device to my colleague’s bespoke Sailfish-flashed handset, and I think that’s beautiful. Powerful browsers and adaptive websites are a good thing!

Who does browser fingerprinting?

Advertisers

Advertisers want to know very legal and very cool things like whether that Nike ad you saw on Instagram ended up being responsible for a purchase you made on Nike’s website later that week. Without this kind of tracking data, they have no idea if the billions of dollars they pay advertising platforms like Meta is paying off. Advertising networks also want to know who you are in order to increase the chances you click on an ad. There is an overwhelming financial incentive to get any kind of user tracking they can. Interestingly, browser fingerprinting is controversial even within the advertising industry, though it happens anyway.

Anti-fraud and anti-bot vendors

Anti-fraud and bot-mitigation companies aim to identify unwanted clients by fingerprinting their browsers. “Unwanted” typically means “could be a security threat” or “is a bot”. Identifying non-human traffic is a growing concern, especially as LLMs get better at solving CAPTCHAs. NYTimes and other news websites were caught harvesting local IP addresses as an anti-bot strategy a few years ago.

Law enforcement and nation states

Government agencies frequently use whatever data collection mechanism they can get their hands on. NSA’s XKEYSCORE program hoovered up Internet traffic directly from fiber optic cables around the world, and extracted browser fingerprints to assess exploitability of their targets. The UK tax revenue agency (HMRC) recently asked around for fingerprinting solutions to detect tax fraud.

Why fingerprint (when you can cookie)?

After much vacillation, Google Chrome announced in April 2025 that they will be rolling back their latest already-watered-down proposal to bring third-party cookie blocking to users, and will now be doing (checks notes) absolutely nothing. The working title of this blog post was “tracking in a post-cookie world”, but it looks like that world is still far away, given Chrome’s reluctance to touch third-party cookies and their dominant browser market share. More than half the Web’s traffic comes from Chrome (exact numbers vary depending on who you ask for interesting reasons that deserve their own blog post).

Other major browsers, thankfully, do block and partition third-party cookies. Even so, browser fingerprinting is still widely used by trackers and third-party advertisers to overcome the limitations of cookie-based tracking.

Cookies can be isolated (e.g. Private Browsing)

Users can use dedicated browsing sessions, isolating cookies and other storage. The classic example is Private (aka Incognito) windows which also clear storage when users exit them, but Firefox’s Containers or Chromium’s Profiles serve the same purpose of making sure that cookies are isolated to a particular storage area. If I visit a website in my normal profile and then re-visit in a Private window, and the website is able to tell that I’m the same user across both visits, that’s a major privacy leak.

Browser fingerprinters try to pierce session isolation in order to re-identify users. The NSA used Evercookie to unmask Tor users by recreating cookies even after they were deleted.

Cookies can be cleared

Cookies and other kinds of storage can be proactively cleared by the user even within the same session. Brave and DuckDuckGo offer ways to automatically clear storage when a tab/site/app is closed. Several browsers use heuristics to figure out when it’s safe to automatically clear a website’s storage so as to prevent tracking while still preserving functionality; it would be pretty annoying if I had to re-login to my favorite website every time I visited it. Bounce tracking mitigation is one category of this work that is implemented by most browsers, with varying degrees of aggressiveness. Again, Chrome lags behind other browsers by not applying bounce tracking mitigations by default.

Compared to cookies, a browser fingerprint is a lot more pernicious and hard to clear, since it relies on inherent characteristics of your machine.

Fingerprinting is invisible

Browser fingerprinting is often passive: the malicious website or script doesn’t need to do anything observable in order to fingerprint you. This is unlike cookies, where the tracking script actually has to leave data on your browser which can be cleared as mentioned above. If a website is using your User-Agent string to create a fingerprint for your browser, there’s not much you can do about it since you won’t even know that the website is doing it on their backend. Brave has a way for users to see if a website invoked a Web API that has fingerprinting protections applied, but fundamentally there’s no way for the browser to know if the information requested by the website is going to be used for nefarious or benign purposes.

Harder for regulators to enforce

Regulators have mostly enforced laws against storage-based tracking, since violations are much easier to detect. Cookie consent notices are a very visible example of this: you’re inundated with them as websites try to comply with laws that require explicit consent for storage on the user’s device. This leaves fingerprint-related profiling under-enforced since it happens by websites and trackers on their backend.

Google announced in 2024 that they will no longer prohibit their advertising customers from fingerprinting users, which was (thankfully) sharply rebuked by the UK ICO.

Conclusion

Browser fingerprinting thrives because it exploits the Web’s necessary, high-entropy surfaces (screen, fonts, device quirks) quietly and across sites. Part two turns from diagnosis to defenses: how browsers approach this problem, what trade-offs they face, and concrete steps you can take to raise your anonymity set without breaking the modern Web.

That’s it for part 1! You can read part 2 here, where I’ll talk about how browsers defend against browser fingerprinting and what you can do to protect yourself.

Originally published at https://shivankaul.com/blog/beyond-cookies-browser-fingerprinting-in-2025-1.

In August 2025 we found, responsibly disclosed and wrote about an indirect prompt injection attack in Perplexity’s Comet browser. The attack exploited agent-controlled browsing in Comet. We followed this up with several new disclosures which proved that this wasn’t a one-off case of bad security practices and that the entire industry is at severe security risk when it comes to prompt injections.

Our work shaped the conversation in 2025 about the risks of agentic AI browsers and influenced browser vendors in their rollout of safer agentic browsing. OpenAI implemented several of our security recommendations in their release of ChatGPT Atlas.

You can read more on the Brave blog.

Our security work generated a lot of discussion and press:

• TechCrunch - “The glaring security risks with AI browser agents”

• NBC News - “AI browsers are here, and they’re already being hacked”

• TechCrunch - “Anthropic launches a Claude AI agent that lives in Chrome”

• Ars Technica - “Anthropic’s auto-clicking AI Chrome extension raises browser-hijacking concerns”

• The Register - “Perplexity’s Comet browser naively processed pages with evil instructions”

• Search Engine Journal - “Brave Reveals Systemic Security Issues In AI Browsers”

• CNET - “Perplexity’s Comet AI Web Browser Had a Major Security Vulnerability”

• Malwarebytes Labs - “AI browsers could leave users penniless: A prompt injection warning”

• Simon Willison’s blog post about our follow-up attacks - “Unseeable prompt injections in screenshots: more vulnerabilities in Comet and other AI browsers.”

• Simon Willison’s blog post about our initial attack - “Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet.”

More press

• Initial post on X that went viral

• Tom’s Hardware

• PCWorld

• Windows Central

• Decrypt

• Search Engine Journal

• Indian Express

• India Today Tech

• Computing (UK)

• GIGAZINE

• THE DECODER

• WebProNews

• WebProNews - follow-up

Originally published at https://shivankaul.com/blog/prompt-injections-in-agentic-browsers.

I’m writing this on the flight back to SF from Delhi. Sleep is elusive and there’s no Wi-Fi on Air India to guilt me with its siren song of Slack notifications.

Here are some 2024 highlights:

Making SF a home

We moved to San Francisco last year, but spent about a year settling in properly. I’m a double-immigrant at this point (h/t to Past Lives), and I’ve moved cities multiple times in my life; it takes about that much time for a place to slip under my skin and feel like second nature—like a home does. Given that we’re thinking of living in the Bay Area long-term, it felt important to see if this was a place I could belong to.

SF responded to my loving. It’s nice living in a Real City, an important place with a strong gravitational pull. SF still has that relevance, social media discourse notwithstanding. I was deliberate about establishing routines centered around people; people are 75% of what fuels attachment to geography anyway. SF feels like home now.

Sometimes I wonder if I had made more of an effort to love Ottawa, if I would have felt similarly. Does every city respond to loving?

Commons and Center

We live around Hayes Valley in SF, a great spot in hindsight, because we’re so close to SF Commons and The Center—two uniquely San Franciscan establishments. SF Commons is a membership-based social club that functions as a third space, while the The Center is a yoga studio-meets-teahouse. The crowd at The Commons skews tech and AI but with a wordcel twist (think journaling and sci-fi book clubs), and The Center attracts a more woo-woo New Age kind of person (sample events: ecstatic dance, sound healing). Like I said, very SF.

I love both vibes obviously, so I’m often at one or the other. Some friends and I go to a weekly yoga class at The Center (brutal but fulfilling) with Kirin Power and I attend book clubs and Writing Club events at The Commons.

Frisbee

I’ve been wanting to expand my physical recreation horizons beyond running. I’ve started going for frisbee in Golden Gate Park on Saturdays. I’ve never played Ultimate before so it’s been fun picking it up and improving slowly and (only sometimes) painfully. Best part though are the big social lunches afterwards, especially when they’re at Marnee Thai.

Football

I’ve spent countless hours of my childhood being obsessed with football (or “soccer” depending on your persuasion) and FIFA (or FC as the game is now called), but gave both up once I moved to North America. This year I’ve been getting back into football. A friend and I have been playing Manager Mode on FC 24 together, which has been a lot of fun. We play Rangers FC. I got to play a lot of football with my cousin during my India trip, who is very good at both game and IRL football. It’s also just been fun catching up on player lore and sharing Instagram reels and edits.

Tango

I’ve wanted to learn a dance form for a while, and given that we were going to Buenos Aires in March, I started learning tango in January. I met a lot of great people, and stuck with it for a while, but I don’t know if I enjoy tango in particular. Maybe I just didn’t like the pedagogical style at this particular studio: instructions change from instructor to instructor and between lessons, which is confusing for a beginner. I keep vacillating about whether I want to give it more time or to just call it quits and try something new.

Traveling

I started out 2024 resolving not to travel at all. I’ve long thought that the millennial dream of finding meaning through travel is a fallacy; a layer of icing disguised as the cake. True belonging and community comes from putting in the work to form IRL ties and memories with people you see over and over again, and that won’t happen if you’re always away from the city you live in.

Unfortunately, I’m a hypocrite. Despite the above opinion, I somehow always end up traveling, either for work or for fun. 2024 was no different. I visited the following countries this year:

1. Chile/Patagonia (W trek)

2. Argentina (Buenos Aires to recover after Patagonia)

3. Canada (trip to Newfoundland with family)

4. UK (London for a work offsite)

5. Portugal (Estoril for the Global Gathering conference)

6. Italy (Rome and Naples with a friend)

7. South of Spain (annual friend trip)

8. Ireland (Dublin for IETF 121)

9. India (family)

This was the first year I spent a significant amount of time in Europe (mid-September to early November, apart from a couple of weeks in the middle). It was overall pretty good except for Rome, which was breathtaking from start to finish. I’m still not over Rome. I loved Dublin too but I already knew I would given my Irish Christian Brother schooling; it felt familiar.

We didn’t do much traveling within India this December, which was fine given how many financial and domestic chores kept popping up. I didn’t get to spend a lot of time in Delhi meeting friends either, which probably extended my lifespan by a few months. The winter smoke has expanded well beyond Delhi to all of North India, even up to Shimla. Everything is covered in a haze: returning to SF felt like someone had turned on the high-definition setting. It was lovely spending an extended amount of time with family, like always. But every year working late-nights and early-mornings from India gets harder and harder.

Walking

I did a fair bit of backpacking this year. We did the W trek in Patagonia (Chile) in March, and then the Rae Lakes Loop in Sequoia/Kings Canyon. The latter was a lot harder than the former. Highly recommend Patagonia for anyone who likes hiking because you can really choose-your-own-adventure. I’ll never forget having fancily-plated poached salmon for dinner when the nearest hospital was 200 kilometers away. You can get away with not carrying anything on the hike except clothes, as long as you book things far enough in advance. It was also the right amount of crowded, and the views were spectacular. I do NOT recommend Rae Lakes for anyone who doesn’t like mosquitoes (literal CLOUDS), altitude sickness (my ancestors are embarrassed for me), controlled forest burning which meant we were breathing in smoke basically the entire way up (turned our snot all sorts of interesting colors) or bears (a baby bear smashed our car window and broke in). The views were beautiful though, probably even more so than Patagonia. If you live in California you never need to travel much for world-class nature.

I spent a fortune at REI this year. Totally worth it.

In general, I walked a lot this year. I wish Apple Health did a Spotify Wrapped-style post, but looking through my data, my biggest non-backpacking walk was a day in Rome where we did 32,000 steps in a day. I did about 38,000 steps on Day 3 of backpacking in Patagonia, which is approximately 30 kilometers at my average step length.

I joined a Walk Club in SF, which I haven’t gotten a chance to attend a whole lot because it clashes with yoga, but I’ve loved the walks I’ve been on because you also get to talk to new people while walking. I also did an impromptu “Stairs of San Francisco” walk on Juneteenth where I zig-zagged across the city, that was pretty fun. I want to do the SF Crosstown Trail in 2025.

Becoming a manager

This was my first year managing people as the lead for privacy, adblocking and webcompat teams at Brave browser. A lot happened quickly: my team grew by 50% and I had to lay someone off. As my team has grown larger I’ve found it harder to find the mental space to write big chunks of code. But I enjoy getting to set the technical direction and be deeply involved in technical privacy and webcompat things.

It’s been interesting seeing the politics behind how the sausage is made; the experience feels valuable. I just wish I had more slack time to think about how to deeply solve problems as opposed to ~all my time being Slack time.

Started hosting people more at home

I’ve always wanted an open-door home where friends feel welcome to just drop by without needing to provide notice. I love the aesthetic of easy familiarity. This requires a fairly high baseline level of tidiness in the home, and that requires constant work. Overall I feel we did a good job this year having our apartment be a default place to hang out.

We’ve had people drop by for movie nights, FIFA games, themed potlucks, Kashmiri dinners and friends’ engagement announcements. I especially loved all the dinner parties we hosted. We also did a couple of iterations of Dishoom potluck, where everyone makes a dish from the Dishoom cookbook. I made the chicken ruby and lamb keema, which were both delicious and educational. I got to actually try out those dishes IRL when I took my team to Dishoom Kensington for a work dinner in London, though their House Black Daal is the best item on the menu.

Food, books, movies, music

Top meals: We visited Aramburu in Buenos Aires for my birthday, in the aftermath of our Patagonia trip. Best meal I’ve ever had, hands down. Also the most expensive, but not by much. I’ve framed the menu in our apartment. The attention to detail, the flavors, the service and overall experience is everything I’ve looked for in Michelin-starred restaurants but never gotten until now. We did House of Prime Rib for a friend’s birthday again this year and it was fantastic yet again. I honestly like the steak better at HoPR than the one we had at La Cabrera (though HoPR did NOT throw in an entire bottle of champagne for free) in Buenos Aires after a 3 hour wait. HoPR is peak America: unfussy, friendly, high-quality and good-value spectacle.

I had a number of great meals in Ahmedabad this time, which was surprising because I’ve never really thought of Gujarat as a culinary destination. My current hottest food take is that Ahmedabad has better chana bhatura than Chandigarh; Chandigarh was pretty meh this time when it came to restaurants (though the bean-to-bar chocolate scene is popping). I wanted to try Naar (elevated Kashmiri food!) after hearing a lot about it but unfortunately the timing didn’t work out. On the topic of Kashmiri food, I made rogan josh for the first time this year after promising a friend that I’d make it for him if he didn’t order a generic version at a Goan (GOAN!) restaurant. I ended up making the dish twice more in a span of a month. Getting good goat meat in SF can be tricky but the frozen bag from Costco works in a pinch.

Top books: I finally got around to actually reading Chomsky this year instead of just summaries and excerpts. Understanding Power led me to the rest of his work. His books have been illuminating and I agree with his reasoning and conclusions except for the excessive moral judgment.

Annie Ernaux and Han Kang are other great authors I read for the first time this year, and want to read more of next year. I also enjoyed Victory City by Salman Rushdie which I reviewed here. I mostly spent a lot of time re-reading Elena Ferrante to keep pace while we were watching the HBO show, and can confidently say that the Neapolitan Novels are my all-time favourite books. I’ve been aggressively gifting the book at every opportunity, like a reverse and Italian Grinch.

Top movies: probably No Country For Old Men, that a friend made us watch for a movie club. To be honest, I didn’t like it right after watching it, but the more I reflected upon the themes the more it grew on me. I tried reading some Cormac McCarthy recently (Blood Meridian) and did not like the writing, but I see why that opinion is heresy amongst American literati. His obsessions are articulate and uniquely American.

I also adored Dune 2 obviously. Denis Villeneuve is a genius.

Top music: Definitely Hermanos Gutiérrez. I still remember hearing them for the first time: we were taking shelter from a downpour in Buenos Aires and then Cerca De Ti came on. I had to stop everything to ask what it was; the steel guitar was a revelation. It was great to see them live at The Greek just a few months after hearing them for the first time!

Things that didn’t go so well

I still didn’t write or publish as much as I would’ve liked; I’m beginning to suspect I never will. I also didn’t play as much guitar as I would like, but I laid a lot of groundwork for this towards the latter end of the year by buying a new acoustic guitar and finally getting around to fixing my electric.

I also didn’t spend much time learning how to be more comfortable in the water, though this wasn’t a problem because we didn’t really do that many tropical or beach things this year. Perhaps 2025 will be the year of conquering water.

Originally published at https://shivankaul.com/blog/2024-wrapped.

Victory City by Salman Rushdie.

Salman Rushdie’s latest novel Victory City includes a public blinding. It is horrifically ironic that the author himself lost an eye and barely escaped with his life in an assassination attempt while promoting the novel at a public lecture in New York (incredibly, the lecture was on how the U.S. is a safe haven for exiled writers). Rushdie has lived under threat of murder by Iranian leadership for more than three decades, and the attack on him is reminiscent of a major theme in Victory City: the dangers of religious intolerance.

The novel reads like an Indian fable; the latest incarnation of Rushdie’s fondness for magical realism. It tells a fictionalized account of the 14th-century South Indian Vijaynagara empire. Vijaynagara translates to “Victory City” in English and is renamed Bisnaga in the book. Today, the capital city of Hampi rests on top of the substantial ruins of the Vijaynagara empire. I visited Hampi right before the pandemic. It reminded me of pictures I’ve seen of Athens: miles of rubble in varying degrees of preservation that serve as gravestones for a dead civilization. But unlike ancient Greece, with its millennia-spanning cultural impact, the Vijaynagara empire is relatively obscure even within India. Rushdie’s stylized take on it makes for interesting reading. The story is told by an anonymous narrator - a “humble historian” - translating an epic Sanskrit poem written by the protagonist Pampa Kampana about the rise and fall of the Bisnaga empire. Many of the characters in the story are based on real people, including Pampa (inspired by 14th-century princess-poet Gangadevi). She stars as the main character in her tale. Her life is bound up in the life of the empire, and she lives for 247 years, responsible for its birth and present at its death.

The perils of bigotry and the power of words, Rushdie’s favorite themes, recur throughout Victory City. The Bisnaga empire thrives when under secular and tolerant rule (a “feminist utopia”), and suffers when bound by strict dogma. The idea of the founding myth is dealt with several times. Kings and empires born and die and create origin stories along the way to legitimize their divine right to glory. The narrator points out that we don’t know if Pampa is being accurate in her recounting of events, but, also, that it doesn’t really matter: kings vanish eventually, their deeds largely immaterial in the court of history. All that remains are stories.

Rushdie is a superb writer, in the style of Nabokov or Woolf, and his prose is always clever and fluid. But the story itself felt meandering, and could easily have been shortened a fair bit without diluting its message or impact or charm. The Indian epic format is done pretty well: there’s even the classic exiled-to-magical-forest-for-years-before-claiming-throne trope.

Rushdie survived the assassination attempt, though it left him with life-altering injuries. He’s still going strong: he published yet another book last month that details the attack and his subsequent recovery. The man is non-stop.

Originally published at https://shivankaul.com/blog/victory-city.

Valley of Saints, directed by Musa Syeed.

The Kashmiri reading group I’m a part of recently saw Valley of Saints, a 2012 Sundance-winning docudrama indie film made by Musa Syeed set in Srinagar, Kashmir which is where my family is from. We’ve been trying to consume more Kashmiri art and literature in the group; we previously read Suhas Munshi’s excellent travelogue This World Below Zero Fahrenheit and Agha Shahid Ali’s The Country Without A Post Office.

It was nice watching a film on Kashmir that didn’t scream about Trauma and Violence in your face (though given that it’s Kashmir, both pulse in the background like a bassline). It was sweet-sad, gentle as a lake, rarely overflowing in its emotion. The movie is driven by the friendship between two childhood friends, Gulzar and Afzal, who make their living off of Srinagar’s beautiful but dying Dal Lake. The two men plot to leave Kashmir in search of better opportunities, but a military curfew forces them to delay their plans. The arrival of an enigmatic Kashmiri-American woman named Asifa who is researching Dal Lake’s ongoing environmental collapse causes tension and rivalry to develop between the two men, leading Gulzar to make tough choices.

Gulzar and Afzal’s friendship has an almost homoerotic tone, as close childhood friendships often do. I’ve noticed that Elena Ferrante frequently and brilliantly portrays that in her female friendships; it was refreshing to see that done for male friendship. The film’s cinematography does an excellent job contrasting the beauty of the Kashmir Valley, with its neck-crick-inducing Greater Himalayan peaks and flower-speckled meadows, against a city slowly being swallowed by its own filth. The environmental catastrophe facing Dal Lake is sensitively presented with all its moral complexity: Asifa is frustrated with how the local people treat the lake, while Gulzar argues that its exploitation is crucial for people’s livelihoods. I could identify with Asifa’s anger: I remembered the disgust I felt seeing the open drainage and muddy water that plagues Srinagar. Yet, like her and the audience of the film, I have the privilege of being a tourist in a land gripped in humanitarian crisis. Asifa argues that the lake’s impending death will be fatal for those living off it, while Gulzar responds philosophically that all things die. A strain of nihilism is recurrent in the film: why preserve that which is doomed? The friendship between the two men, complicated by the arrival of a foreigner, seemed to me to metaphorically reflect the asundered love between Kashmiri Pandits and Muslims. But this interpretation might be influenced by my own identity, which could be inserting itself into a story where it is not necessary. One cannot help but symbolize everything in Kashmir as being about the larger conflict, which is indicative of how hard it is to make a film that is just about being Kashmiri.

Overall, I loved Valley of Saints, and would recommend it if you’re into slow and poignant dramas set in a conflict zone.

Originally published at https://shivankaul.com/blog/movie-review-valley-of-saints.

As a self-proclaimed privacy engineer, I build privacy-centric products for users and review features across the company to prevent privacy flaws from shipping. At a previous company, I worked on infrastructure, making sure that the company’s DNS was not leaking sensitive customer data in transit. Prior to that, I worked on creating privacy compliance tools for enterprise customers. Much like software engineers, these are all valid things a privacy engineer can work on! Privacy as an engineering function, as opposed to a purely legal and policy one, is a fairly new concept. Some big companies like Google had internal privacy teams, but it was only under threat of the incoming storm of privacy regulation led by GDPR and FTC consent decrees in the US that everyone panicked about building privacy into products and engineering processes. Now, there’s high demand for privacy engineers, but every tech company interprets the role of a privacy engineer differently.

I’ll go over what motivates companies to hire privacy engineers, and what privacy engineer archetypes arise because of those needs.

Why hire privacy engineers?

Privacy engineering addresses the following business needs, arranged in roughly descending order of importance for most companies:

Need #1: Comply with privacy laws

GDPR can allow levying of up to 4% of annual global revenue. CCPA penalty in California is more interesting: it’s capped at $7500 per violation, where every single customer whose privacy rights were violated would count as one violation. So if you have millions of users, good luck!

Need #2: Stay out of the news

A classic adage in the field of privacy engineering, a common cudgel used by privacy review teams: even if we’re not explicitly breaking the law with this feature, are we okay being on the front page of New York Times for this? The answer is typically no.

Need #3: Build trust with users

Customers like to use products they trust. If they believe the company will use their data responsibly, they spend more money, which is behaviour companies like to encourage. Nothing ruins that trust like a data breach or evidence of sale of data to a third-party.

Need #4: Build new privacy-preserving products

People want privacy-preserving tools. Many brands have built their product strategy around privacy. Examples: Apple, Signal, Brave, your favourite VPN du jour. I also include privacy products that address enterprise needs here, such as a data redaction product marketed at companies looking to fufill Needs 1 through 3.

Not all companies have the same needs, and some companies have multiple needs. Now, on to the archetypes.

Archetypes

Archetype #1: The Product Privacy Engineer

Product privacy engineers are typically regular software engineers who work on features that explicitly enhance user privacy such as VPNs, encrypted messaging apps and user-facing privacy controls such as privacy dashboards.

Sadly, there aren’t that many companies which sell privacy as a product. The best product privacy work happens when privacy dovetails with functionality. Biased example, given that I work at Brave: ad-blocking not only enhances browsing experience by speeding up page loads and conserving battery but also blocks real security and privacy threats. Another example is Apple’s Hide My Email feature: email addresses are pernicious tracking vectors, so being able to have a unique one per-website is extremely good for protecting online privacy. Plus, it lets you manage the emails you’ve used across websites and apps and easily deactivate them, which is pretty useful in itself. Web browsers often do a lot of interesting product privacy work, probably because the Web is a tracking cesspool. Building new privacy products fulfills Need #4.

Privacy dashboards empower users to manage privacy preferences (should your activity be public on Strava?) and consent around things like data sharing (should Twitter use your data to show you personalized ads?). They also let users do things like request their data and ask for it to be deleted or exported. Software engineers who work on these dashboards may be members of a dedicated privacy engineering team or engaged on an as-needed basis by the Privacy Compliance or Legal teams. Giving users privacy controls goes towards being compliant with privacy laws such as GDPR and CCPA, so fulfills Need #1. It also makes users feel that their privacy rights are being protected and lets them exercise those rights, so I’d argue it also goes towards Need #3.

Archetype #2: The Privacy Infrastructure Engineer

Privacy infrastructure work often takes the form of figuring out how data flows internally and externally and building shared privacy tooling for feature teams. These engineers are also sometimes called Privacy Architects.

To comply with data subject access requests, it’s crucial to know where user data lives across the backend. User data tends to be like a fungus that quickly spreads its tendrils throughout the host database. Mapping data and its flows is complicated and never-ending work. Also, you need to figure out how to surface data to your feature teams without violating privacy laws. How long can feature teams keep data around? They could write their own cron jobs to delete data after the promised duration, but this quickly gets messy. At some point, you want to build a centralized way of handling data retention policies that teams can hook into.

Privacy infrastructure engineers also work on making sure data is encrypted, both at rest and in-transit. Check out Meta’s blog posts on how they deployed TLS in their datacenters. Sometimes, this kind of work needs your vendors and partners to be compliant with your technical privacy requirements. This can mean having to standardize your privacy-enhancing protocol, and contribute to open source implementations.

This archetype helps with privacy compliance (Need #1) and reduces the PR fallout from a breach (Need #2).

Archetype #3: The Privacy Reviewer

I’d say the vast majority of privacy engineers, especially at companies like Google and Meta, are hired to do technical privacy review. These engineers review specs and features for privacy issues and identify risks. They work across legal, product and engineering teams to make sure the company’s privacy stance is upheld. They think about things like data minimization (is this feature collecting more data then it needs?), retention (when is the data collected by this feature deleted?) and consent (is the user being given a meaningful choice about their data?). They advocate on behalf of the user. Sometimes privacy reviewers act as consultants for a larger organization, and sometimes they’re deeply embedded into one product line. Either way, the job is all about understanding features quickly by asking the right questions, developing long-term relationships, clearly outlining risk and suggesting improvements.

Privacy reviewers may end up setting privacy principles in order to ensure consistency in reviews across different reviewers. These principles are either officially encoded in a document or unofficially exist in their heads and/or Slack threads. These principles guide concrete technical decisions in product development, distinct from legal privacy policies. For example, a privacy principle could be “we drop all IP addresses at the WAF layer for HTTP requests containing user data but not otherwise”; the privacy policy corollary for this could be something generic like “We do not store any user-identifying information”.

Privacy reviewers inevitably see common patterns cropping up in the specs they review. For example, they might realize that a lot of product teams are needing to build their own bespoke way of deleting data. This insight leads to generalized privacy infrastructure (see previous section) being built. Roles can be fluid!

Privacy review helps product teams comply with privacy laws (Need #1), identify if a feature might “feel” sketchy to users (Need #2), and reduce risk of privacy exposure that might ruin user trust (Need #3). This is important work!

Archetype #4: The Privacy Red Teamer

This is related to privacy review, but with a more adversarial mindset and done after the product is deployed. Similar to security red teams, privacy red teams take an existing product or feature and try to “break” it by finding privacy vulnerabilities. For example, if a user presses the “Delete My Data” button on their privacy dashboard, is that data actually scrubbed from all database tables on the backend? If a company claims that telemetry data is “anonymized” (whatever that means), can a particular user’s identity be reconstructed using telemetry data points? Even if one particular feature is working as intended, things can go wrong in the interaction between systems. This is where privacy red teams shine: it’s hard to grasp all possible interactions before code hits production and data hits servers. For example, did the Marketing team accidentally start using data that was collected for product improvement purposes? Can we automatically detect when that happens? Privacy red teams report their findings to folks working on privacy infrastructure to prevent bad stuff from happening again, and to privacy reviewers so that future bad stuff is caught in the review stage.

AFAIK, only Meta, Google and TikTok have privacy red teams. It’s definitely a bigger company problem that happens when there is a Cambrian explosion in the surfaces where user data is ingested and it starts becoming hard to prima facie identify all privacy risks.

This role helps to fulfill the same needs as privacy review (Needs #1, #2 and #3).

Archetype #5: The Privacy Incident Responder

Review and red-teaming notwithstanding, privacy incidents happen! Privacy incident response teams get involved when there’s a risk or occurence of user data leakage. They then work with other privacy teams to make sure the incident doesn’t happen again.

Privacy incident response is classically a legal problem: there are regulations around disclosure of exposure of user data. Privacy incident response teams make sure those legal obligations are fulfilled, so this job role helps with Need #1. It also helps to retain trust (well, mitigate loss) by informing users quickly and clearly of privacy incidents (Need #3).

Conclusion

The field of privacy engineering is rapidly evolving, and it’s a fun time to be a privacy engineer. Privacy engineers often wear multiple hats and work across the roles I outlined: I’ve particularly enjoyed doing a combination of engineering, policy and review. Plus, it just feels good when your work is aligned with users’ interests. Other privacy engineers I know feel similarly.

Do you work on something else as a privacy engineer? Let me know!

…

Big thanks to Nandita Rao Narla and Jay Averitt for proofreading and suggestions.

Originally published at https://shivankaul.com/blog/privacy-engineering-archetypes.