Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome phasing out support for User-Agent

infoq.com

Post reply on HN
Print view View original

41–50 of 329 posts

Re: Chrome phasing out support for User-Agent

#41

Post by blitmap »

eh78ssxv2f wrote: post #39
jorams wrote: post #36

The weird thing about this is that the only company I've seen doing problematic user-agent handling in recent years is Google themselves. They have released several products as Chrome-only, which then turned out to work fine in every other browser if they just pretended to be Chrome through the user agent. Same with their search pages, which on mobile were very bad in every non-Chrome browser purely based on user age…

Google is probably so big that we might as well consider Chrome and rest of the Google as separate entities.

I hear what you're saying, but they pay people enough to follow a potential company-wide policy: Don't f-ck with user agents!

Re: Chrome phasing out support for User-Agent

#42

Post by eric_b »

This feels very ivory tower. It reminds me of the "You should never need to check user agent in JavaScript because you should just feature detect!!". Well in the real world that doesn't work every time.

The same is true for server side applications of user-agent. There are plenty of non-privacy-invading reasons to need an accurate picture of what user agent is visiting.

And a lot of those applications that need it are legacy. Updating them to support these 6 new headers will be a pain.

Re: Chrome phasing out support for User-Agent

#43

Post by jaywalk »

derefr wrote: post #40

These days, it feels like the sole use of User-Agent is as a weak defence against web scraping. I've written a couple of scrapers (legitimate ones, for site owners that requested machine-readable versions of their own data!) where the site would reject me if I did a plain `curl`, but as soon as I hit it with -H "User-Agent: [my chrome browser's UA string]", it'd work fine. Kind of silly, when it's such a small deterr…

Preventing scraping is an entirely futile effort. I've lost count of the number of times I've had to tell a project manager that if a user can see it in their browser, there is a way to scrape it.

Best I've ever been able to do is implement server-side throttling to force the scrapers to slow down. But I manage some public web applications with data that is very valuable to certain other players in the industry, so they will invest the time and effort to bypass any measures I throw at them.

Re: Chrome phasing out support for User-Agent

#44

Post by vxNsr »

> https://github.com/WICG/ua-client-hints

I don't really understand how this will result in any real difference in privacy or homogeneity of the web. Realistically every browser that implements this is gonna offer up all the info the server asks for because asking the user each time is terrible UX.

Additionally this will allow google to further segment out any browser that doesn't implement this because they'll ask for it, get `null` back and respond with sorry we don't support your browser, only now you can't just change your UAS and keep going, now you actually need to change your browser.

And if other browsers do decide to implement it, they'll just lie and claim to be chrome to make sure sites give the best exp... so we're back to where we started.

Re: Chrome phasing out support for User-Agent

#45

Post by ryandrake »

ldoughty wrote: post #31
ravenstine wrote: post #27

This is a good idea, and is something I've thought of for a while; the user agent header was a mistake from both a privacy and a UX perspective. Ideally, web browsers should attempt to treat the content the same no matter what device you are on. There shouldn't be an iOS-web, and a Chrome-web, and a Firefox-web, and an Edge-web; there should just be the web. In which case, a user-agent string that contains the browse…

I agree, but this also is incredibly dependent on the major players (e.g. Google) not going off on their own making changes without agreement from other browsers... There are still issues today where chrome, edge, and Firefox render slightly differently. I certainly agree user agent isn't terribly necessary, but it's literally the only hook to identify when css or JavaScript needs to change... Or to support people on…

Maybe web publishers need to let go of this idea of pixel-perfect rendering and identical JavaScript behavior across browsers, and instead just worry about publishing good content. The web is not Adobe InDesign or Photoshop. At its essence it is a system for publishing text and hyperlinks that point to other content. Get the content right and don't worry so much about whether the scrollbar is 2 pixels thick or 3.

Re: Chrome phasing out support for User-Agent

#46

Post by anthonyrstevens »

olsonjeffery wrote: post #33

At my employer we are using UserAgent to detect the browser so that we can drive SameSite cookie policy for our various sites (e.g. IE11 and Edge, which we still support, doesn't support SameSite: None). There are a variety of scenarios where this comes up (e.g. we ship a site that is rendered, by another vendor, within an iframe; so we have to set SameSite: None on our application's session cookie so that it's valid…

We are in the same boat. Certain browser/OS combinations don't handle Same-Site correctly, so we are using UA sniffing to work around their limitations by altering Same-Site cookie directives for those browsers. We will likely have to look at some other mechanism for dealing with nonconforming Same-Site behavior.

Re: Chrome phasing out support for User-Agent

#47

Post by jaywalk »

_bxg1 wrote: post #34
ldoughty wrote: post #31

Earlier quoted context omitted.

I agree, but this also is incredibly dependent on the major players (e.g. Google) not going off on their own making changes without agreement from other browsers... There are still issues today where chrome, edge, and Firefox render slightly differently. I certainly agree user agent isn't terribly necessary, but it's literally the only hook to identify when css or JavaScript needs to change... Or to support people on…

Thinking cynically, it could be a power-move by Google to strengthen their hold on the ecosystem. Right now when they go out and make their own API changes without consensus (which already happens), it's possible to distinguish the "for Chrome" case and still support the standard. But if there were no User-Agent, and Google wanted to strongarm the whole group into something, and 90% of browsers are Chromium-based, de…

I think it's perfectly fair to lean towards cynicism whenever Google goes out on their own making changes to Chrome.

Re: Chrome phasing out support for User-Agent

#48

Post by anthonyrstevens »

jt2190 wrote: post #38
olsonjeffery wrote: post #33

At my employer we are using UserAgent to detect the browser so that we can drive SameSite cookie policy for our various sites (e.g. IE11 and Edge, which we still support, doesn't support SameSite: None). There are a variety of scenarios where this comes up (e.g. we ship a site that is rendered, by another vendor, within an iframe; so we have to set SameSite: None on our application's session cookie so that it's valid…

The proposed User Agent Client Hints API would replace this: https://wicg.github.io/ua-client-hints/

The User Agent Client Hints API looks like a very early draft. I could not see any proposed timeline for implementation or estimate of when this might become a supported standard.

I would not personally rely on this as a substitute or replacement for User Agent by September (Google Chrome 85).

Re: Chrome phasing out support for User-Agent

#49

Post by Izkata »

oefrha wrote: post #29
snazz wrote: post #26

Earlier quoted context omitted.

UA strings have never been an accurate indication. If you're not using JS, then you probably have no reason to be sniffing the UA string to detect browser features, since most of those features are JS-related anyway. It's an upgrade for the people who actually need to get an indication of the supported features and APIs of the user's browser. Otherwise, you should be using media queries.

One exception: you might want to user sniff IE and serve a completely different version due to all the CSS problems. (I know you can use IE-only comments too, but I’ve been in the situation where making a modern version simultaneously IE9-compatible was just too frigging maddening.)

A bigger, site-breaking one from further up in this thread: https://news.ycombinator.com/item?id=22685632

Re: Chrome phasing out support for User-Agent

#50

Post by recursive »

eric_b wrote: post #42

This feels very ivory tower. It reminds me of the "You should never need to check user agent in JavaScript because you should just feature detect!!". Well in the real world that doesn't work every time. The same is true for server side applications of user-agent. There are plenty of non-privacy-invading reasons to need an accurate picture of what user agent is visiting. And a lot of those applications that need it ar…

Most of the time when people use user agent for a purpose they think is appropriate, it doesn't even work correctly. YMMV
Post reply on HN