91–100 of 322 posts
User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.
Rubbish. They are incredibly useful for debugging.
User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.
So as time goes by the user agent becomes increasingly homogenous and so, less useful for tracking.
I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack. A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. ( https://www.ietf.org/rfc/rfc3514.txt ) Extending this protection to IPv6 is left as an exercise for the reader.
Earlier quoted context omitted.
Well at least we acknowledged there's some utility. Now consider that mobile devices are different as well..
The current user agent does not give you much insight about what type of mobile device you have anyway, especially on Android.
I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
Exactly. Hacking your client to use another user-agent or another IP address is illegal under CFAA. See Craigslist Inc. v. 3Taps Inc. etc...
Earlier quoted context omitted.
Bob is either a brown-noser or a complete turncoat. Don't be like Bob.
Bob is probably an engineer with twenty years experience, who's been thoroughly ground down by management and peer power-plays and has realised that the best solution is to keep your head below the parapets!
Earlier quoted context omitted.
There are better solutions available than hanging functionality on unreliable vestigial bits and pieces that shouldn't be there anyway which, because others abuse the functionality, you can't trust to be correct for debugging purposes.
99% of the traffic has the correct user-agent which is useful in tracking down issues that are browser specific. The other 1% will just get ignored as noise. And it's not like we can't tell what type of browser they are using with browser specific objects that we can pull from javascript. We just can't infer the version of the browser which is critical for debugging issues.
Earlier quoted context omitted.
I will never stoop so low as to telegraph my own joke.
I couldn't agree more. The joke construction was a bit weak though, when you miss a good part of the audience. Add something like, "I mean, could you imagine the chaos it would cause if IE told websites it was really Mozilla?" and you demonstrate mastery of the subject matter, which should be enough to let other experts know you were facetious rather than ignorant. Unless you have timing issues... or need the comedia…
Earlier quoted context omitted.
Rubbish. They are incredibly useful for debugging.
edit: sorry, accidentally submitted early So what. Removing one of the largest sources entropy available for fingerprinting users is important. We shouldn't maintain the terrible long-term effects[1] of tracking everything just to help you have an easier time debugging. [1] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...