221–230 of 316 posts
Earlier quoted context omitted.
Microsoft is very heavily lobbying organizations to use edge as a standard browser right now. They're doing the same to us. It's really annoying. They're hell-bent on increasing marketshare no matter what.
It would be interesting if Google tweaked their Chromium licensing so that Edge couldn't use it. Then Microsoft wouldn't have a browser at all.
Earlier quoted context omitted.
Microsoft is very heavily lobbying organizations to use edge as a standard browser right now. They're doing the same to us. It's really annoying. They're hell-bent on increasing marketshare no matter what.
In the last months I have heard everything from MS including "Firefox is the #1 source of security bugs in enterprise" and the like.
Earlier quoted context omitted.
It would be interesting if Google tweaked their Chromium licensing so that Edge couldn't use it. Then Microsoft wouldn't have a browser at all.
That's the weird thing about Microsoft expanding marketshare. If they'd actually succeed in capturing the majority of the market, there's a big chance Google would throw in the towel and then what??
My organization (which uses Teams) forcibly migrated all Firefox users to Edge a couple of weeks ago and uninstalled FF. They were citing incompatibility with some software and I assumed that meant the new ERP system being adopted by one of the larger departments.
At least Edge is now Chrome...
My organization (which uses Teams) forcibly migrated all Firefox users to Edge a couple of weeks ago and uninstalled FF. They were citing incompatibility with some software and I assumed that meant the new ERP system being adopted by one of the larger departments.
It's 2023. Why are we still doing user agent detection? We're supposed to do feature detection. userAgent is deprecated. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/u...
Because you’ll be surprised how many developers aren’t familiar with these things and how many of them think that they are more clever than the herd and do not validate their assumptions. It wouldn’t surprise me if some junior dev picked it up and then went to ask a senior dev how can they detect the browser version and they got a half assed reply hmm check the user agent and went on with that. 95% of the major bugs…
Earlier quoted context omitted.
There are also Firefox extensions that let you set a custom user agent. It might make you easier to fingerprint (unusual combination of user agent and browser features means very very high uniqueness), but it will allow you to bypass buggy user agent checks if needed.
Although of course an even better solution is to complain and get MS to fix their shit. This was almost certainly someone not realizing they should feature test instead of checking a UA.
Earlier quoted context omitted.
Because you’ll be surprised how many developers aren’t familiar with these things and how many of them think that they are more clever than the herd and do not validate their assumptions. It wouldn’t surprise me if some junior dev picked it up and then went to ask a senior dev how can they detect the browser version and they got a half assed reply hmm check the user agent and went on with that. 95% of the major bugs…
I'm genuinely interested: How does UA sniffing for, e.g. a device class, introduce security issues that wouldn't exist w/o it?
But in a more general view reliance on an unreliable and user controlled data for decision making is a pretty common pitfall in the security world.
Earlier quoted context omitted.
Changing the UA only changes the behavior of the web server, so unless that's some block of untouchable code owned by some other team made to 'optimize' page loads for different clients, you're not doing yourself any favors by changing it in your browser; you should be loading up the client itself since you can't simulate the actual engine loading your web app differently. > If you'd rely on feature detection, your c…
1) If clients spoof their UA, they just get what they asked for. Couldn't care less. 2) With SSR you're actually making a case for sniffing the UA for the client's device class. Web apps might need to ship vastly different but overlapping code across different device classes. I'm not even talking about things that can be lazily loaded subsequently, I'm talking about the initial screen for given URL. 3) I'm _not_ goin…
I thought you were specifically talking about testing the behavior of your website on different client by changing your browser's UA. The only legitimate use would be if you have a mobile-only stylesheet like older wordpress themes (because you said "I've never come across a better way to get a sneak peek into the (first) Initial Page Request of a customer to your web app")
> 2) With SSR you're actually making a case for sniffing the UA for the client's device class. Web apps might need to ship vastly different but overlapping code across different device classes. I'm not even talking about things that can be lazily loaded subsequently, I'm talking about the initial screen for given URL.
I'm not sure why this would be the case. For Teams, they can just load a purple top bar with the words "Microsoft Teams: Loading", right? That's a single responsive stylesheet.
> 3) I'm _not_ going to show the customer any loading spinner or just show a white page for 2s. We had that with Java Applets, remember?
What else are you going to show while the page loads? A fake UI with fake data? As soon as the JS starts executing and loading data, that data can start to populate the screen.