Differences

This shows you the differences between two versions of the page.

--- programming:stateful_stateless [2026/09/17 10:45] – ConsentAction audit propagation and bucket series; Authored by Claude karel.kubicek.claude
+++ programming:stateful_stateless [2026/09/29 11:39] (current) – Add Ramakrishnan et al. IMC 2026 within-site stateful/stateless comparison and cookie inversion; update open question. Authored by Claude karel.kubicek.claude
@@ Line 144: / Line 144: @@
   * **A trained profile is treated differently.** Agarwal et al.: "having an established persona from a particular demographic … results in up to 15% more cookies stored than for a baseline with no set persona" {[agarwal2020_stop]}.
   * **State accumulates within a site, not only across sites.** Urban et al., under a seeded-stateless design with state kept across a site's own subpages: "subsites set considerably more (36 %) cookies than the respective landing pages. On average, 55 cookies were set when loading a landing page while 78 were set when a subsite was accessed" {[urban2020beyond]}. See [[Programming:Interaction]].
+  * **Within a site, stateful crawls see more — except on raw cookie totals.** Ramakrishnan et al. collected one ordered page list per traversal strategy for 9,673 CrUX sites, then replayed it from one vantage point under twelve configurations: three strategies, state kept across a site's pages or cleared after every page, with and without simulated interaction {[ramakrishnan2026_crawling]}. Stateful and interactive crawls generally saw more tracking domains and fingerprinting-API use, and breadth-first + stateful + interaction had the highest totals of the twelve; the paper reports that combination against the rest, not state on its own, and the fingerprinting-API margin is only 0.5–1.2%. Tracking cookies went the other way in aggregate: the //stateless// breadth-first crawls produced the most unique tracking cookies (with interaction, 9.5% more than the stateless crawl without it at 50 pages), because a few sites set many new, uniquely named cookies on every fresh visit — cookies the authors judge "likely are not meaningfully different". The median site's count was about the same under every configuration, while the stateful distributions had the higher 75th percentiles. So a stateless crawl's unique-cookie total can be driven by a handful of cookie-renaming sites; look at the per-site distribution before trusting the larger number. This is state kept //within// a site only; carrying state from one site to the next is a separate axis the authors did not test.
 And one that cuts the other way: **cookie respawning with browser fingerprinting** was measured on 30,000 Alexa sites with a stateless harness, by comparing paired visits rather than by accumulating a profile — "1, 150 (3.83%) of the Alexa top 30, 000 websites use cookie respawning with browser fingerprinting" {[fouad2022_cookie]}. Note the qualifier: that figure counts respawning //combined with// fingerprinting, not respawning in general. A stateful //phenomenon// does not always require a stateful //crawl//; sometimes it requires two controlled visits. The same is true of cookie syncing at first contact. What accumulation buys is the //aged// identity, not the mechanism.
@@ Line 619: / Line 620: @@
   - **{[demir2022_reproducibility]} — what to write down.** Criterion C11 and practice P9 are the reporting standard; the paper also measures how badly the field met it.
   - **{[rasaii2025_crumbs]} — the modern stateful design, done well.** Split the list, accept on the first half, measure the second half, randomise the order. The clearest recent example of a result that a stateless crawl cannot produce.
+  - **{[ramakrishnan2026_crawling]} — the closest to a clean within-site comparison.** Same page lists, same vantage, stateful and stateless arms among twelve configurations, on tracking domains, fingerprinting APIs and cookies. IMC 2026, newer than the corpus. Read §4.2 for the cookie inversion.
   - **{[urban2020beyond]} — seeded stateless, and why.** One sentence in §4.3.2 explains the whole third design position.
   - **{[acar2014_never]} — why a clean profile is hard.** Respawning and syncing across a deliberate state clear.
@@ Line 628: / Line 630: @@
 <WRAP todo>
-  * **Nobody has run the clean experiment.** Demir et al. announce one and do not deliver it: §2.2 says "Since the effects of C5 and C11 are not yet adequately discussed by previous work, we analyze them in Section 4", and §4 then runs "four exemplarily case studies focusing on C4, C5, C10, and C12" — repetition, crawler technology, interaction and geolocation. C11, the crawling strategy, is the one criterion they flagged and did not vary; their own runs are described in Appendix C as "stateless coordinated crawls" {[demir2022_reproducibility]}. Sixteen papers in this corpus run both arms, every one of them incidentally to another question. A same-sites, same-time, same-vantage crawl differing //only// in statefulness, reporting the effect on third-party counts, tracker counts and filter-list hit rates, would be a short and highly citable paper.
+  * **Nobody has run the clean experiment.** Demir et al. announce one and do not deliver it: §2.2 says "Since the effects of C5 and C11 are not yet adequately discussed by previous work, we analyze them in Section 4", and §4 then runs "four exemplarily case studies focusing on C4, C5, C10, and C12" — repetition, crawler technology, interaction and geolocation. C11, the crawling strategy, is the one criterion they flagged and did not vary; their own runs are described in Appendix C as "stateless coordinated crawls" {[demir2022_reproducibility]}. Sixteen papers in this corpus run both arms, every one of them incidentally to another question. A same-sites, same-time, same-vantage crawl differing //only// in statefulness, reporting the effect on third-party counts, tracker counts and filter-list hit rates, would be a short and highly citable paper. **Update, 2026-09-29:** the closest so far is //within a site// — Ramakrishnan et al. replay the same page lists with state kept and with state cleared after every page, from one vantage point, alongside interaction and traversal-order arms {[ramakrishnan2026_crawling]} (results under [[#What a stateful design buys you, quantified]]). They report the best combination against the rest rather than an isolated state effect, and they leave state carried //across// sites to future work, so this question still stands — fully for the cross-site case.
   * **How much does visit order actually change a stateful result?** The confound is universally acknowledged and never quantified.
   * **Does the seed profile artefact bite?** Englehardt and Narayanan predicted that cloning one seed into ''N'' browsers inflates cookie-sync counts. Nobody has measured the size of the inflation, and it is the design large stateful crawls have used since.