Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

Post reply on HN
Print view View original

41–50 of 122 posts

Re: Why not to whitelist operating system user agents

#41

Post by joppy »

rocqua wrote: post #10
z3t4 wrote: post #3

The fun part in web dev is to make sure everything works on the 0.5% non mainstream browser/platforms. Only supporting 99.5% is boring.

A popup "your OS browser combination is not supported, some things may not work" is a much less nuclear option.

Things fail in the weirdest ways in unsupported environments though, it’s not like the “make transfer” button doesn’t work, it’s more like it might not even show up in the first place. Having 99% of your website work and the last 1% not work is a dealbreaker in many cases, and these “the site may not work for you based on your OS” banners lead the user into thinking it does work 100% if it works in 99% of the cases.

Not saying this is the way it should be, just saying that “doing your best” to allow unsupported platforms often leads to a terrible and confusing user experience.

Re: Why not to whitelist operating system user agents

#42

Post by viraptor »

encryptluks2 wrote: post #34
GoblinSlayer wrote: post #26

Earlier quoted context omitted.

Biggest banks routinely do such things simply because they can.

And like most things if you're not wealthy enough to afford a good attorney, and they usually can just draw out a case until you run out of money, the only people capable of protecting you are legislators who have failed time and time again to adequately take on big business abusing their positions.

This is what small claims courts are for, if you have an equivalent in your country. No/minimal lawyer involvement, as long as the amount is relatively low. If you have hundreds of thousands or more stuck in an account though, you likely have access to a lawyer. (+ obviously winnable cases will be sometimes taken without cost since the lawyers will negotiate that in the damages)

Re: Why not to whitelist operating system user agents

#43

Post by chessmango »

kafkaIncarnate wrote: post #18
kristopolous wrote: post #17

Earlier quoted context omitted.

I use it almost every day. I'm thinking The user is using a weird user agent/browser and misdiagnosed the problem. It looks like Firefox but there's just so many small browsers these days. Honestly I'd need to see the offending code. If it's user agent testing, those strings should still be readable even in a compressed js unless they run it through an obfuscator

The small browsers thing sounds about right. Check the link he posted about the email someone received on Reddit. It's posted like it's a screenshot from Mutt or some other terminal mail editor. Looks more like they are flexing their email terminal usage not just copy/pasting the message (png for text? come'on!). Probably using qutebrowser or something else like that.

Just from the Reddit post as well - doesn't feel overly user-hostile or deserving of the 'JP Morgan Chase Bank admitting to me they hate Linux and BSD desktops and actively block them' title anyway.

If there's active blocking based on OS (from replies in this thread, evidence seems to be slim) then that's not great, but this seems to be pretty one-sided so far.

Re: Why not to whitelist operating system user agents

#44

Post by hericium »

kristopolous wrote: post #17
danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I use it almost every day. I'm thinking The user is using a weird user agent/browser and misdiagnosed the problem. It looks like Firefox but there's just so many small browsers these days. Honestly I'd need to see the offending code. If it's user agent testing, those strings should still be readable even in a compressed js unless they run it through an obfuscator

> should be readable even in a compressed js unless they run it through an obfuscator

User-Agent may be determined on a webserver/proxy level and request redirected silently to a page with JS just showing the banner. It does not have to be based on JS checking anything.

Re: Why not to whitelist operating system user agents

#45

Post by hericium »

kafkaIncarnate wrote: post #16
danachow wrote: post #12

Can anyone confirm this? I don’t have a FreeBSD machine handy right now but I just switched user agent to FreeBSD amd64 on a Linux machine with Chromium 95 and have no issue with the front page or logging into chase.com. I have rarely encountered issues using this Linux/X11 setup on chase.com for years. Is it possible they are using an ancient browser and incorrectly assuming it’s the OS part of the user agent?

I can confirm this is 100% false. Been using Linux to login to Chase for years, never had any problems (other than weird ad-blocker issues which are cross-platform). Just tested again just to confirm that I can log in just fine. No User-Agent switcher required.

May be OS with small userbase and less popular browser combo.

Re: Why not to whitelist operating system user agents

#46

Post by nix23 »

spicybright wrote: post #30

Can confirm it works fine for me under linux firefox. OP, just adjust your user agent string if you're using a weird browser and proceed at your own risk. (I say this because you're dealing with actual money, so incompatibilities from your browser might cause major problems if you're not careful)

Can confirm it works NOT under FreeBSD and Firefox, with useragent Win/Chrome it works.

Re: Why not to whitelist operating system user agents

#47

Post by lmm »

geocrasher wrote: post #6
chaps wrote: post #4

Has this sort of thing been argued in court as an ADA issue? I could understand why using Linux might be considered legally a "choice", but if there's better ADA compliant tooling in Linux over windows, then a legal argument might just exist..

Unless one was to claim that Tux is their emotional support animal, I doubt it. Linux on the desktop has usability issues for able bodied people. I strongly doubt it has any edge on MacOS or Windows when it comes to accessibility.

A greater focus on scriptability and customizability might make it a better OS for people with some disabilities. Certainly I've heard that at one point Linux was the only OS you could use in Welsh, for example (not that that's a disability, but it's similar in terms of being a minority need).

Re: Why not to whitelist operating system user agents

#48

Post by neilalexander »

alias_neo wrote: post #40
hmrr wrote: post #22

All the UK banks used to do this about 12 ish years ago. No longer. What they do try and do is shove Rapport down your throat instead.

Ugh, I remember when HSBC pushed Rapport. Is it still a thing? I run Linux exclusively and haven't seen them try to push it for a long time so not sure if it's still a thing. They still prevent you from running their app on a rooted Android, which is nice considering I can do much more dangerous things with my money from the web site.

I haven't seen or heard of anything related to Rapport with HSBC UK for probably a decade now.

Re: Why not to whitelist operating system user agents

#49

Post by alvarlagerlof »

joppy wrote: post #41
rocqua wrote: post #10

Earlier quoted context omitted.

A popup "your OS browser combination is not supported, some things may not work" is a much less nuclear option.

Things fail in the weirdest ways in unsupported environments though, it’s not like the “make transfer” button doesn’t work, it’s more like it might not even show up in the first place. Having 99% of your website work and the last 1% not work is a dealbreaker in many cases, and these “the site may not work for you based on your OS” banners lead the user into thinking it does work 100% if it works in 99% of the cases.…

Unlikely. This is a browser. If it's going to fail, it won't be some js somewhere. It's going to be the whole thing.
Post reply on HN