Fortress: A Modified Chromium Browser for Stealth Browser Automation

Fortress is a modified version of Chromium designed to prevent browser automation agents from being blocked by bot detection systems. By modifying the browser's internal C++ code, Fortress alters the browser fingerprint to make automated agents appear as legitimate, ordinary Chrome installations to the websites they visit.

How Fortress Bypasses Bot Detection

Fortress operates by correcting the browser fingerprint inside Chromium's C++ source code. Most bot detectors identify automation by reading the browser fingerprint; Fortress removes the indicators that typically flag automation tools, ensuring the browser presents itself as a standard Chrome install. This approach targets the fingerprinting techniques used by bot detection services to distinguish between human users and automated scripts.

Technical Challenges in Browser Automation

While fingerprinting is a primary hurdle, browser automation faces additional technical complexities beyond simply avoiding detection. As noted by community members, bypassing the initial block is only one part of the problem: agents must also be able to determine if the page returned is the actual content, a degraded version of the site, or a silent challenge page designed to trap bots.

Community Debate on Scraping Ethics and Impact

The release of Fortress has been met with significant ethical debate among developers and site administrators. The discussion centers on the conflict between the desire for data extraction and the burden placed on website owners.

Impact on Small Website Owners

Several contributors argue that stealth scraping tools increase the costs and complexity of maintaining websites.

"There are those of us that have to keep these sites up, and it's seriously been a few years of nightmare scrapers and botnets... Not every website is backed by a billion/trillion dollar company with the resources to absorb things."

Critics suggest that these tools enable bots to relentlessly hammer sites, driving up hosting costs for small operators who may be forced to close their sites due to the bot traffic.

The Arms Race of Device Attestation

Some developers warn that the proliferation of stealth browsers leads to a technical arms race. The concern is that as bot detection becomes more sophisticated, the industry may move toward mandatory device attestation—a system where a device must be cryptographically proven to be a legitimate hardware device—to maintain access to the web.

"The eventual outcome here isn't going to be freedom for you to scrape sites that are trying to avoid being DDoSed by bots, but instead that we all end up in a world where device attestation is required to do practically anything online."

Alternative Approaches to Data Access

In contrast to the stealth approach, some suggest that websites should provide standardized, low-impact ways to access data to reduce the overall traffic generated by scraping. One proposal includes providing monthly updated torrents of site data on standardized subpages (e.g., example.com/scrape) to minimize the impact on live servers.