Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

miketaylr.com

Post reply on HN
Print view View original

51–60 of 143 posts

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#51

Post by metadat »

Hizonner wrote: post #48

Stop sending User-Agent. Replace it with nothing. Not client hints. Nothing. If sites start rejecting Firefox clients because of that, then instead change it to send exactly the same User-Agent (and other software identification) that Chrome sends, and commit to exactly faking Chrome's signals in the future. The UA header never had any business existing to begin with. Servers guessing client capabilities from the sof…

At first I was like "Yeah buddy, preach on". Then came the next thought:

Then what. Site providers will still will want to know and this likely results in a browser detection excalation arms race pushed to JavaScript.

I still think servers shouldn't get to know so much about browser clients, certainly not PII-level details (PII-level being the norm as it exists today).

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#52

Post by masswerk »

Bick2 wrote: post #40
masswerk wrote: post #39

Earlier quoted context omitted.

I think, there's still use for it. E.g., I recall when Chrome 32 would fail to play a newly created Web Audio BufferSource, unless the playback call came from inside a decodeAudioData() callback. At the same time, you couldn't use this approach to playback sound from e.g. Safari iOS, since the callback lacked the user interaction blessing, resulting in muted audio. Try-catch wasn't an option either, since, as soon as…

Also this: https://catchjs.com/Blog/SameSiteCookies

> The Chrome team insist that this behavior is a bug, but it is actually in line with this particular version of the spec.

Or, why any other browser is the new IE. /s

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#53

Post by Hizonner »

metadat wrote: post #51
Hizonner wrote: post #48

Stop sending User-Agent. Replace it with nothing. Not client hints. Nothing. If sites start rejecting Firefox clients because of that, then instead change it to send exactly the same User-Agent (and other software identification) that Chrome sends, and commit to exactly faking Chrome's signals in the future. The UA header never had any business existing to begin with. Servers guessing client capabilities from the sof…

At first I was like "Yeah buddy, preach on". Then came the next thought: Then what. Site providers will still will want to know and this likely results in a browser detection excalation arms race pushed to JavaScript. I still think servers shouldn't get to know so much about browser clients, certainly not PII-level details (PII-level being the norm as it exists today).

You can't stop fingerprinting. I wish you could, but you can't.

But you CAN make it enough of a pain to cut down on the number of half-qualified Web monkeys who try to use the information in ham-handed ways. You can stop just handing the information over for free to people who might want to casually exploit you. You might even make it harder for some more sophisticated and/or committed actors to do it; for example, if I'm an ISP running a middlebox and trying to fingerprint all the traffic that runs through me, I can't use JavaScript. And you can save some bandwidth in the process.

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#54

Post by codetrotter »

metadat wrote: post #51
Hizonner wrote: post #48

Stop sending User-Agent. Replace it with nothing. Not client hints. Nothing. If sites start rejecting Firefox clients because of that, then instead change it to send exactly the same User-Agent (and other software identification) that Chrome sends, and commit to exactly faking Chrome's signals in the future. The UA header never had any business existing to begin with. Servers guessing client capabilities from the sof…

At first I was like "Yeah buddy, preach on". Then came the next thought: Then what. Site providers will still will want to know and this likely results in a browser detection excalation arms race pushed to JavaScript. I still think servers shouldn't get to know so much about browser clients, certainly not PII-level details (PII-level being the norm as it exists today).

> Won't this likely result in browser detection to be pushed to JavaScript and create an arms escalation race?

NoScript.

https://noscript.net/

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#55

Post by MBCook »

metadat wrote: post #51
Hizonner wrote: post #48

Stop sending User-Agent. Replace it with nothing. Not client hints. Nothing. If sites start rejecting Firefox clients because of that, then instead change it to send exactly the same User-Agent (and other software identification) that Chrome sends, and commit to exactly faking Chrome's signals in the future. The UA header never had any business existing to begin with. Servers guessing client capabilities from the sof…

At first I was like "Yeah buddy, preach on". Then came the next thought: Then what. Site providers will still will want to know and this likely results in a browser detection excalation arms race pushed to JavaScript. I still think servers shouldn't get to know so much about browser clients, certainly not PII-level details (PII-level being the norm as it exists today).

But that should happen.

Does the user’s browser support WebDoodle2? Why try to parse a weird history of nonsense and combine that with a table of what versions of what browser supports what?

Just check if document.doodle2 is defined. Done. Reliable. Easy.

FF pretends to be Chrome pretends to be Safari pretends to be IE pretends to be Netscape pretends to be Mosaic pretends to be god only knows.

Actually asking via JS instead of guessing is a massive improvement.

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#56

Post by MBCook »

logicallee wrote: post #36
MBCook wrote: post #33

I know it would be a temporary disaster but I think at this point I wish Safari, FF, Chrome and Edge would just decide on a flag day to get rid of user agents. From March 17th, 2023 (or whatever) all user agent strings are now “WebBrowser/1.0” until the end of time. Just force the switch to better methods.

what are better methods?

Just check if the thing you want is defined in JS. Maybe add some supplementary methods to help with that kind of check.

Parsing out the UA header mess is a disaster.

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#57

Post by bobse »

pbhjpbhj wrote: post #44
bobse wrote: post #41

>Teams are broken under Firefox >change useragent to egde/chrome >it works now Thank you Microsoft.

This is just anti-competitive practice, yes? Presumably unlawful.

This is Rajesh and welcome to Microsoft forums. Please install Microsoft Edge TM. Bye.

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#58

Post by oleganza »

323 wrote: post #43
MBCook wrote: post #33

I know it would be a temporary disaster but I think at this point I wish Safari, FF, Chrome and Edge would just decide on a flag day to get rid of user agents. From March 17th, 2023 (or whatever) all user agent strings are now “WebBrowser/1.0” until the end of time. Just force the switch to better methods.

They had an opportunity to do that with HTTP/2, /3, but they kept the User Agent. It's a bit different, but it's still there.

HTTP/2 is more like a transport envelope around HTTP/1, the goal of http/2 was to optimize transmission and avoid breaking http/1 semantics for servers and clients.

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#59

Post by andirk »

User agent sniffing is poor practice anyways. Try to use the feature and react according to the browser's abilities. Analytics and similar can sniff all day though.

To push browsers to get rid of UA string, we should all use a UA string extension that uses the same string like "DOG-SHIT". That way it'll start showing up in analytics.

And if you're trying to date the "data science" girl, spam the app/website with UA string like "hi-amy-will-you-go-out-with-me--sincerely-jack-who-sits-behind-you."

Re: The IE 11 user-agent forced Mozilla to freeze part of its user-agent string

#60

Post by masswerk »

auscompgeek wrote: post #49
tzot wrote: post #46

So rv0110.0 would not work?

I presume that would unfortunately break websites in _other_ ways, if they're UA-sniffing Firefox in unconventional ways. At that point they might as well remove it altogether instead of drastically changing the UA string.

I can well see some non-trivial issues with `parseInt()`…

  if (paseInt(revMajor) === 72) { … } // rev 0110 detected!
;-)
Post reply on HN