How Unweb Was Tested to Prove Nothing Carries Over Between Strangers
Unweb makes one promise above the rest: nothing carries over. Not between two strangers open at once, not from a closed stranger to a new one, not into your everyday browser, and nothing stays on disk once a stranger closes. A promise like that is easy to state and easy to break by accident, so the tests don’t take Unweb’s word for anything.
The self-test runs the real app, on the system’s own web engine, against small web servers on the same machine. One plays a site at 127.0.0.1, another plays a third party at localhost, which counts as a different site. Every request they receive is logged with its cookies, and with any cached ID the browser sends back. Those logs decide each check.
It runs on Windows, macOS and Linux on every change, and again with each installer before a release is published.
The servers’ logs, not Unweb, decide whether a check passes.
A Stranger Leaves Everything It Can
Stranger A opens a page built to leave every trace a site can: a cookie scripts can’t see, a cookie a script writes, local storage, IndexedDB, a Cache API entry, a service worker, a file in the browser cache, a file whose cache label works as an ID, a cookie and storage from a frame on another site, and a graphics shader nobody had compiled before.
Then A looks for all of it, and must find it. This is the control. A check that something is gone means nothing unless the same check, run where the thing is, finds it. On Linux, A’s own folder held 26 files by then.
Two Strangers Look for It
Stranger B, open at the same time as A, runs the same search and must find none of it. It must not send A’s cookies, must fetch the cached file afresh, and must not send back A’s cached ID. Then A closes. Its folder must be deleted and still be gone ten seconds later, because the Linux engine likes to write a few cache records after a page closes. A’s service worker, which was calling home twice a second, must go quiet.
Stranger C, opened after A is gone, runs the search again. Nothing.
Side by Side, Locations and the Rest
Three strangers side by side each get their own ID cookie from the site, and when one address is typed in the bar, each must send back exactly its own. A cookie counter must count exactly what each was given.
For locations, two small proxies run on the same machine, one HTTP and one SOCKS5, and log every connection they make onward. The site logs which port each request came from, so it can tell exactly which requests came through which proxy. One stranger goes through each, to a name only the proxies can look up, and every request it makes must have come through its own proxy. A stranger whose proxy is down must send the site nothing at all. WebRTC must not reach a test server around the proxy.
The self-test also checks that a page can’t call any of the app’s commands, can’t trap Back, and can’t load itself in the bar. Saved setups must hold nothing a stranger saw, and Compare must save the right screenshot in the right order. At the end, every folder Unweb or its engine could use must be gone, not even empty. Your everyday browser’s folders must not have changed.
What the Tests Found
The tests earned their keep, and so did the independent reviews that probed each version. On Linux the tests caught the engine’s network process writing into a closed stranger’s folder seconds after it was deleted, which is why Unweb now watches the folder after deleting it. A review caught a shared graphics shader cache that let one stranger recognise another by timing, and a self-test check now proves it’s off. On macOS the tests caught a crash when a page had no address yet, and the system sending a stranger direct when its proxy was down. Unweb couldn’t fix that last one, so the reference says it plainly.
The latest recording on Linux passed 30 checks, with one more (HTTPS memory, HSTS) that only runs where a test certificate can be trusted, which CI does. The results are on GitHub, next to the code that produced them.