Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome phasing out support for User-Agent

infoq.com

Post reply on HN
Print view View original

241–250 of 329 posts

Re: Chrome phasing out support for User-Agent

#241

Post by leppr »

recursive wrote: post #198
tryptophan wrote: post #193

Earlier quoted context omitted.

Its absurd that paying customers get a worse experience than just using the piratebay.

Last time I used piratebay, I saw a lot of porn and malware/scam ads. I had to find and install a torrent client. Then I had to make sure I was downloading a movie that had enough seeders. And then I couldn't watch the movie until (and if) the download finished. When I use netflix, I have a much better experience.

Some torrent clients support sequential downloading, which will be equivalent to streaming with most video formats. And obviously there's uBlock for the ads.

DRM on streaming and BluRays made it so that any usage outside basic consumption on prescribed devices is better served by illegal means.

Re: Chrome phasing out support for User-Agent

#242

Post by kabacha »

magicalhippo wrote: post #225
hartator wrote: post #112

New proposed syntax adds even more noise: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.1.2222.33 Safari/537.36 Sec-CH-UA: "Chrome"; v="74" Sec-CH-UA-Full-Version: "74.0.3424.124" Sec-CH-UA-Platform: "macOS" Sec-CH-UA-Arch: "ARM64" Why not getting rid of the `User-Agent` completely? It's already bad infrastructure design to have the server do different renderin…

Why the hell does a regular website need to know what OS and CPU architecture I got?

I can already see the permission pop ups for those:

> for best performance this website would like to know what type of device you are using?

While requesting every single "hint" and there is "ok" button and greyed out "read more or declide this request" tiny line.

Re: Chrome phasing out support for User-Agent

#243

Post by kabacha »

userbinator wrote: post #231
hartator wrote: post #112

New proposed syntax adds even more noise: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.1.2222.33 Safari/537.36 Sec-CH-UA: "Chrome"; v="74" Sec-CH-UA-Full-Version: "74.0.3424.124" Sec-CH-UA-Platform: "macOS" Sec-CH-UA-Arch: "ARM64" Why not getting rid of the `User-Agent` completely? It's already bad infrastructure design to have the server do different renderin…

Why not getting rid of the `User-Agent` completely? Try browsing the web without any UA header for a week or two, and you'll understand. You get blank pages, strange server errors, and other weird behaviour --- almost always on very old sites, but then again, those also tend to be the sites with the content you want. Using a UA header, even if it's a dummy one, will at least not have that problem. (I did the above ex…

I mean at first this change will cause all of these errors too until the servers migrate from user agent string to device hints. Getting rid of UAs would actually force meaningful update rather than migration.

Re: Chrome phasing out support for User-Agent

#244

Post by superkuh »

recursive wrote: post #238
superkuh wrote: post #93

User-agent is super useful to human people. But corporate people don't have a use for it. They will get that information via running arbitrary code on your insecure browser anyway. So, because mega-corps now define the web (instead of the w3c) this is life. But it doesn't have to be. We don't have to follow Google/Apple-Web standards. Anyone that makes and runs websites has a choice. And every person can simply choic…

> User-agent is super useful to human people. For what? Honest question. You have to be like a 5th-level user agent wizard to make any sense of user agent strings, since every browser now names every other browser. How do you do anything useful with this in a way that's forward-compatible?

I look at the logs of my websites with my eyeballs manually after a perl script to winnow them down (ie, remove hits form me, hits from tor, etc).

Re: Chrome phasing out support for User-Agent

#245

Post by Craighead »

rplnt wrote: post #156
surround wrote: post #138

Good. User-agent strings are a mess. Here is an example of a user-agent string. Can you tell what browser this is? Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 How did they get so confusing? See: History of the browser user-agent string https://webaim.org/blog/user-agent-string-history/ Also, last year, Vivaldi switched to using a user-agent st…

If companies like Google wouldn't abuse the user agent string to block functionality, serve ads, force their users to specific browser then companies like Google wouldn't have to use fake UA strings and then maybe companies like Google wouldn't have to drop their support.

You should read the link to know the history of why what you said is wrong.

Re: Chrome phasing out support for User-Agent

#246

Post by _8j50 »

This is insane. You know, no HN post to a google blogspot site works for me because these jerks are the only ones that discrinate on UA?

Google engoneering is Sooooooo disconnected from the rest of the world, I think we need legal regulation to stop them from doing stuipd things like this. Do they have any idea how many things need it?

HNers with a position of power at work, I plead with you: please advocate banning of Chrome at work and replacing it with any one of the webkit based alternatives or firefox. These people are insane. Every month I hear of some ridiculous thing. They took out navbar url parameters, add links to in page words, now this!

For those who think this is good for privacy...it is not! This is the same old sneaky ass evil thing they do. UA can be used to finger print you but it's very easy to set a generic user agent. Actually, if you look at user agents most of them have the latest string for Chrome, IE or firefox so it isn't useful without a whole lot of other details correlated with it. You know what the exception is? Android and iPhone browsers that incluse your device make and model in the UA and apps that includes whole lot more like facebook's apps.

Do you know what a "flexible" api like the one they're talking about allows? More fingerprintable data points! The fact that you even use that api is a privacy issue. Let's sat clienthints allows for 10 different variations of responses from clients,your specific client details might have just 3 things different from the mean and bam, now they can track your specific device. With UA,all versions of a client have the same exact detail and most people need an extension to change it, so it makes it much less easy to finger print.

This is the same ol sneaky bait and switch Google pulls. The content of your UA is not the privacy concern (although it contains too much at times) , it is the fact that it can be correlated with timing info,IP (especially v6),and if they already know your UA they will also use client default http header options to identify and track you without consent.

Re: Chrome phasing out support for User-Agent

#247

Post by whoisthemachine »

ksec wrote: post #215
asveikau wrote: post #136

Earlier quoted context omitted.

A fair number of websites will still block perfectly working features based on what OS you use. Some examples I've seen using the latest Firefox on *BSD: Facebook won't let you publish or edit a Note (not a normal post, the builtin Notes app). I think earlier they wouldn't play videos but they might have fixed that. Chase Bank won't let you log in. Gives you a mobile-looking UI which tells you to upgrade to the lates…

I am guessing Banks only test their site against popular OS and Browser for security reasons.

It's usually just that the company doesn't want to have to deal with potential support calls that come in about their website not working on x os in x browser, so they do the bare minimum to disable it - then if a user complains about it not working, they can plausibly deny supporting the os/browser configuration.

Re: Chrome phasing out support for User-Agent

#248

Post by Polylactic_acid »

jgunsch wrote: post #184
ShamelessC wrote: post #129

Earlier quoted context omitted.

This is off topic but do you know why Edge is the only browser to support DRM for streaming? Or is that incorrect? I see lots of people who have to use edge on order to get 4k content from Netflix; presumably because of the DRM issues.

Other browsers support DRM too, but with different tradeoffs. Chrome uses Widevine, but one of Chrome's philosophies is that you should be able to wipe a Chrome install, reinstall Chrome, and have no trace that before/after are the same person. That means no leveraging machine-specific hardware details that would persist across installs. "Software-only DRM", essentially. Edge on Windows (and Safari on OSX) are able t…

So any user on Edge can be hardware fingerprinted easily? I can see why other browsers stay far away.

Re: Chrome phasing out support for User-Agent

#249

Post by asveikau »

whoisthemachine wrote: post #247
ksec wrote: post #215

Earlier quoted context omitted.

I am guessing Banks only test their site against popular OS and Browser for security reasons.

It's usually just that the company doesn't want to have to deal with potential support calls that come in about their website not working on x os in x browser, so they do the bare minimum to disable it - then if a user complains about it not working, they can plausibly deny supporting the os/browser configuration.

This takes more effort than letting it just work. People running an OS more obscure than Linux are not the type that are going to call asking for support. We are used to supporting ourselves.

Did I mention it's the same code as a working configuration?

I think it's more likely somebody did not know how to properly parse user-agent and they blocked more than they intended to.

Re: Chrome phasing out support for User-Agent

#250

Post by Polylactic_acid »

colde wrote: post #145
ShamelessC wrote: post #129

Earlier quoted context omitted.

This is off topic but do you know why Edge is the only browser to support DRM for streaming? Or is that incorrect? I see lots of people who have to use edge on order to get 4k content from Netflix; presumably because of the DRM issues.

Not the only browser to support DRM. But the only browser to support PlayReady on Windows, which brings added security compared to what Widevine offers on Windows. Another popular choice for high quality is Safari on macOS because it implements Apple's FairPlay.

*Added security for the remote server but massively reduced security for the end users computer.
Post reply on HN