Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downgrade User Agent Client Hints to 'harmful'

github.com

Post reply on HN
Print view View original

91–100 of 116 posts

Re: Downgrade User Agent Client Hints to 'harmful'

#91

Post by dmitriid »

oefrha wrote: post #34
dmitriid wrote: post #17

> I'm not sure why you used such an old Chrome version to test this. That quote from the first comment on the issue is just a cherry on top. Chrome 88 was released in December 2020. 7 months ago.

Because when you’re implementing a new spec that is still in “draft” status and constantly being updated, things could have changed drastically in 7 months and 4 major versions?

Chrome releases a new major version once every two months. It's not the job of Mozilla to reverse engineer Google's internal processes and figure out which version is "extremely old one". And no, 6-7 months do not a "very old version" make.

It's also a very good thing that Mozilla picked version 88. It had all the described problems and Chrome still shipped this draft spec with known issues enabled by default in the very next version.

v88 was the last version that had this behind a feature flag. Now that it's enabled by default, devs will rely on it and Chrome will refuse to change it because "once it's out we can't change it".

Good on Mozilla to call bullshit on Google (and not for the first time).

Re: Downgrade User Agent Client Hints to 'harmful'

#92

Post by M2Ys4U »

lupire wrote: post #36
Analemma_ wrote: post #28

Earlier quoted context omitted.

It was meaningless from the beginning: DNT was always nothing but an Evil Bit. You’re getting mad at Microsoft for pointing out that the emperor had no clothes.

It was an Evil Bit becaut it didn't have the force of law behind it. Now we have cookie laws.

We had "cookie laws" when DNT was created, too.

Re: Downgrade User Agent Client Hints to 'harmful'

#93

Post by benibela »

ipaddr wrote: post #74
ajsnigrutin wrote: post #67

Earlier quoted context omitted.

But browsers could disable third party cookies, and autodelete first party cookies on page/tab close by default. There would be a "keep cookies for this site" button somewhere near the address bar, and at each login, the browser would also ask you if you want to save your password and/or save cookies for that domain. 99% of websites don't require persistant storage, and those who do, 99% of them are sites you're logg…

That's private browsing currently. Why not use a private window?

I often do that, but now I have to click on cookie confirmation banners all the time. It is very annoying. Might just take seconds, but it sums, eventually I have been clicking on these banners for hours

Sometimes these banners do not even work because of my NoScript

Re: Downgrade User Agent Client Hints to 'harmful'

#94

Post by ajsnigrutin »

benibela wrote: post #93
ipaddr wrote: post #74

Earlier quoted context omitted.

That's private browsing currently. Why not use a private window?

I often do that, but now I have to click on cookie confirmation banners all the time. It is very annoying. Might just take seconds, but it sums, eventually I have been clicking on these banners for hours Sometimes these banners do not even work because of my NoScript

https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...

:)

Re: Downgrade User Agent Client Hints to 'harmful'

#95

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #82
marcosdumay wrote: post #80

Earlier quoted context omitted.

I don't think you can ever determine that a site doesn't need SNI using HTTP alone. All you can have is that it doesn't or you don't know.

I do not use "HTTP alone", I use DNS, more specifically IP address. I generate lists. The lists are largely based on the hosting provider and created automatically, but I also edit them manually when necessary, which is the exception not the rule. Most sites requiring SNI that are submitted to HN all use the same CDNs: AWS and Cloudflare. The SNI list is dominated by sites hosted on AWS. The ESNI list is all sites ho…

s/phenomena/phenomenon/

Re: Downgrade User Agent Client Hints to 'harmful'

#96

Post by daveoc64 »

I hope they avoid situations like the SameSite=None debacle[0] if they are going to freeze the User Agent header and not provide an alternative.

The assertion of Mozilla seems to be:

>At the time sites deploy a workaround, they can’t necessarily know what future browser version won’t have the need for the workaround. Can we guarantee only retrospective use? Do Web developers care enough about retrospective workarounds for evergreen browsers?

When there are significant numbers of users on devices like iPads that don't get updated any more, you can't rely on "evergreen browsers".

[0] - https://www.chromium.org/updates/same-site/incompatible-clie...

Re: Downgrade User Agent Client Hints to 'harmful'

#97

Post by daveoc64 »

theandrewbailey wrote: post #9

I would rather have all this information (along with whatever is being inferred from them) be exposed through a Javascript API instead of having browsers indiscriminately flood global networks with potential PII. Chrome came up with this? Figures. Stay evil, Google.

A JavaScript API has been considered as a replacement for the user agent string, but it has two big downsides:

1) JavaScript must be enabled. If it's not, then the server can't get any of the user agent data - at all.

2) The server won't get the user agent data until after it has already responded to the first request it receives from a client. That makes it a lot less useful overall. Having to load a page, then perhaps redirect the user using JS based on what the JS API says is a bit untidy.

Re: Downgrade User Agent Client Hints to 'harmful'

#98

Post by WorldMaker »

Dylan16807 wrote: post #51
Analemma_ wrote: post #28

Earlier quoted context omitted.

It was meaningless from the beginning: DNT was always nothing but an Evil Bit. You’re getting mad at Microsoft for pointing out that the emperor had no clothes.

There were people promising to implement it. That's a lot better than nothing.

Is it? The whole point to this thread is that none of the big players stood by their "promises" for longer than a few months. Especially Google's hypocrisy of promoting DNT in Chrome and knowing full well their adtech teams would ignore it as soon as they had an excuse. (Microsoft and Mozilla enabling it by default sure was a "good" excuse, despite that obviously being the best interest of the users.)

Re: Downgrade User Agent Client Hints to 'harmful'

#99

Post by WorldMaker »

grishka wrote: post #75
hypertele-Xii wrote: post #47

Earlier quoted context omitted.

Why would you need different templates for mobile/desktop? CSS is quite capable responding to any screen orientation.

Yes it is. Except you can't use the same markup for both because the input devices, and thus interaction paradigms, are so radically different. Mice are precise and capable of hovering over things, so it makes sense to pack everything densely and add various tooltips and popup menus. Touchscreens are imprecise and don't have anything resembling hovering, so UI elements must be large, with enough padding around them,…

Between CSS Flexbox and CSS Grid there shouldn't any reasons today that you can't handle 100% of those differences with the same markup and media stylesheets. (There's also obviously JS if you really must contort the HTML DOM to get what you want.)

Re: Downgrade User Agent Client Hints to 'harmful'

#100

Post by admax88q »

billyhoffman wrote: post #64
hypertele-Xii wrote: post #48

Earlier quoted context omitted.

No it doesn't? Ever heard of Accept or Lang headers? Or cookies for that matter? Dynamic content?

Agreed, and thanks for bring up the Accept header. The author seems uninformed about HTTP's built in Content Negotiation. They write about servers using the User-Agent header, specifically talking about WebP. Accept: "image/webp" works just fine for the major CDNs regardless of the UA.

Accept and content negotiation has a long established history, and content negotiation is different than the server making decisions based upon metadata.

It's one thing for the client to say "give me this resource in this format" its another for the server to say "oh you're coming from version X.Y of OS Z, I know what you really want."

Post reply on HN