Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Why not to whitelist operating system user agents

#11

Post by number6 »

tapland wrote: post #7
chaps wrote: post #4

Has this sort of thing been argued in court as an ADA issue? I could understand why using Linux might be considered legally a "choice", but if there's better ADA compliant tooling in Linux over windows, then a legal argument might just exist..

It shouldn't be allowed to ban web access from all free operating systems ;)

This gave me the idea to ban all non-free systems:

"You are using a non-free Operation System and thus signing away you fundamental rightsas a user. Please use a free Operationsystem like GNU/Linux to access this website."

Re: Why not to whitelist operating system user agents

#12

Post by danachow »

Can anyone confirm this?

I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years.

Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

Re: Why not to whitelist operating system user agents

#13

Post by rzzzt »

rocqua wrote: post #10
z3t4 wrote: post #3

The fun part in web dev is to make sure everything works on the 0.5% non mainstream browser/platforms. Only supporting 99.5% is boring.

A popup "your OS browser combination is not supported, some things may not work" is a much less nuclear option.

If you know which parts will not work in advance. What if the "Send $$$" button does not appear due to a CSS misfire?

Re: Why not to whitelist operating system user agents

#14

Post by roobs »

Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.

Re: Why not to whitelist operating system user agents

#15

Post by johnebgd »

jijji wrote: post #5

Dude, all I know is that I was using chase for one of my businesses for 3 years, millions of dollars coming in via Intuit payments -- no problems, then I switched from Intuit for ACH to using Seamlesschex.com, and then after the first batch, they locked up my business bank account, and then after a few months talking to a call center in india, with the bank manager sitting there (there is nothing they can do when the…

I had someone working at Chase telling my vendor how much money was in my account. I was a private client at JP Morgan and had a business account with them.

The vendor was threatening me and using my bank account level (down to the penny) to make the threats.

Chase identified the culprit, told me who it was, then offered me lifelock identity theft protection as a courtesy for my troubles.

I haven’t had $1k in my private client account since.

Re: Why not to whitelist operating system user agents

#16

Post by kafkaIncarnate »

danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I can confirm this is 100% false. Been using Linux to login to Chase for years, never had any problems (other than weird ad-blocker issues which are cross-platform). Just tested again just to confirm that I can log in just fine.

No User-Agent switcher required.

Re: Why not to whitelist operating system user agents

#17

Post by kristopolous »

danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I use it almost every day. I'm thinking The user is using a weird user agent/browser and misdiagnosed the problem.

It looks like Firefox but there's just so many small browsers these days. Honestly I'd need to see the offending code. If it's user agent testing, those strings should still be readable even in a compressed js unless they run it through an obfuscator

Re: Why not to whitelist operating system user agents

#18

Post by kafkaIncarnate »

kristopolous wrote: post #17
danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I use it almost every day. I'm thinking The user is using a weird user agent/browser and misdiagnosed the problem. It looks like Firefox but there's just so many small browsers these days. Honestly I'd need to see the offending code. If it's user agent testing, those strings should still be readable even in a compressed js unless they run it through an obfuscator

The small browsers thing sounds about right. Check the link he posted about the email someone received on Reddit. It's posted like it's a screenshot from Mutt or some other terminal mail editor. Looks more like they are flexing their email terminal usage not just copy/pasting the message (png for text? come'on!).

Probably using qutebrowser or something else like that.

Re: Why not to whitelist operating system user agents

#19

Post by franga2000 »

R0b0t1 wrote: post #9
geocrasher wrote: post #6

Earlier quoted context omitted.

Unless one was to claim that Tux is their emotional support animal, I doubt it. Linux on the desktop has usability issues for able bodied people. I strongly doubt it has any edge on MacOS or Windows when it comes to accessibility.

For an ADA claim it shouldn't matter. You're usually not asked to demonstrate your disability. There are people who only use Linux in textmode.

Sure, but I'd be surprised if any modern web app worked in TUI browsers.

Re: Why not to whitelist operating system user agents

#20

Post by kristopolous »

kafkaIncarnate wrote: post #18
kristopolous wrote: post #17

Earlier quoted context omitted.

I use it almost every day. I'm thinking The user is using a weird user agent/browser and misdiagnosed the problem. It looks like Firefox but there's just so many small browsers these days. Honestly I'd need to see the offending code. If it's user agent testing, those strings should still be readable even in a compressed js unless they run it through an obfuscator

The small browsers thing sounds about right. Check the link he posted about the email someone received on Reddit. It's posted like it's a screenshot from Mutt or some other terminal mail editor. Looks more like they are flexing their email terminal usage not just copy/pasting the message (png for text? come'on!). Probably using qutebrowser or something else like that.

platform.js 1.3.1 is in there (https://github.com/bestiejs/platform.js/)

I see this from the pretty-printed version

    function a() {
            return /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) ? "Device" : "Desktop"
        }
So let's try to just say I'm say, Opera Mini, still no dice. I tried a bunhch of these to no avail. I don't know how the OP got this.
Post reply on HN