Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

Post reply on HN
Print view View original

51–60 of 122 posts

Re: Why not to whitelist operating system user agents

#51

Post by Freak_NL »

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use.

After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string:

    X11; Ubuntu; Linux
Only when that string was in there verbatim would it fail all requests with a 403 Forbidden.

After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this.

I posted my search for the cause of this issue on StackOverflow¹, and even got a reply from (presumably) someone who works for the company that hosts these websites, but alas, the websites remain broken to this day. They suspected a hack to prevent some WordPress exploit…

It's frustrating, because a general practitioner's website should not fail like this (it is a point of contact that sits just below emergency services), but the people that work there don't understand the problem, and the company that hosts is can't be arsed to fix the issue.

1: https://stackoverflow.com/questions/66185885/some-websites-r...

Re: Why not to whitelist operating system user agents

#52

Post by lmilcin »

Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

> After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this.

Haha! Never attribute malice when a simple incompetence would explain it!

Re: Why not to whitelist operating system user agents

#53

Post by A4ET8a8uTh0 »

Interesting. I just tried logging in from PopOS. No issues. Does it only affect FreeBSD?

I mean worst case scenario I can always open dedicated Windows VM, but I will admit that the trend is troubling.. especially with Win11 push towards 'trusted computing'.

Re: Why not to whitelist operating system user agents

#54

Post by michaelt »

franga2000 wrote: post #23
z3t4 wrote: post #3

The fun part in web dev is to make sure everything works on the 0.5% non mainstream browser/platforms. Only supporting 99.5% is boring.

It is to a point, but then it just becomes painful. If you want to keep a good user experience for modern browsers while supporting ancient ones, you'll probably be writing at least all your layouts twice.

You guys are getting a good user experience from your banks?

Re: Why not to whitelist operating system user agents

#55

Post by indymike »

rocqua wrote: post #10
z3t4 wrote: post #3

The fun part in web dev is to make sure everything works on the 0.5% non mainstream browser/platforms. Only supporting 99.5% is boring.

A popup "your OS browser combination is not supported, some things may not work" is a much less nuclear option.

How about assuming it works until users report it does not?

Re: Why not to whitelist operating system user agents

#58

Post by op00to »

jakub_g wrote: post #56

For anyone who works at the company who does that: why you do it? Is it to reduce amount of testing, and only have a few "blessed" browsers with guaranteed happy experience? Any other reasons?

It’s not so much for happy experiences, as it is to place bounds on what the development team is asked to do.

Re: Why not to whitelist operating system user agents

#59

Post by op00to »

rocqua wrote: post #10
z3t4 wrote: post #3

The fun part in web dev is to make sure everything works on the 0.5% non mainstream browser/platforms. Only supporting 99.5% is boring.

A popup "your OS browser combination is not supported, some things may not work" is a much less nuclear option.

I would not want a money transfer to “not work” and end up moving $500,000 rather than $500.

Re: Why not to whitelist operating system user agents

#60

Post by theodric »

My employer for currently blacklists Firefox from being used to launch a session in their 3rd-party remote desktop portal. I use a UA switcher. It works fine. This behavior, while brain-dead, is at least trivial to circumvent. I'm happy to let them continue to check a box on their audit preparation form saying they have control over this, and to continue to have a URL rule to change my UA for the portal, rather than having to hack my client further or keep a separate browser around to launch my daily session.
Post reply on HN