6 ms·

Browsers should start submitting a random 10 character string for the User-Agent header.

by chei0aiV 11y ago

toomuchtodo 11y ago
Could this be done with an extension?
- chei0aiV 11y ago
  With an extension to this extension, yes: http://chrispederick.com/work/user-agent-switcher/ http://chrispederick.com/work/user-agent-switcher/
- gizmo686 11y ago
  Yes. https://github.com/muzuiget/user_agent_overrider https://github.com/muzuiget/user_agent_overrider As far as I am aware, no extension currently offers the option of a random user agent, but many (including the one linked) allows user supplied use agents, and there is no reason you could not make one support random user agents.
  - Survey_Sez 11y ago
    There is in fact already an extension which will randomly change the browser user agent. https://github.com/dillbyrne/random-agent-spoofer https://github.com/dillbyrne/random-agent-spoofer
    - danieldk 11y ago
      Also, uMatrix can randomly switch user agent strings (among many other things).
darkmighty 11y ago
Wouldn't that result in even-uglier hacks for finding user agent becoming standard?
cornstalks 11y ago
That would break more than it would fix. Video is hard (not all devices or browsers support the same codecs, bitrates, frame rates, etc), and YouTube has to use the User Agent to try to serve videos that the client can actually play. A random User Agent would mean that all those browsers that need a special video format wouldn't get the type of video they need, which sounds like a crappy world to live in (compared to the crappy world we already live in with meaningful User Agents).
- kuschku 11y ago
  > (compared to the crappy world we already live in with meaningful User Agents). > Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36 Google Chrome tells us it is: a Mozilla, it is AppleWebkit, it is KHTML, it is Gecko, it is Safari, and it is Chrome. "Meaningful" is something different.
  - geofft 11y ago
    It's meaningful. It communicates exactly what the browser is to anyone who is capable of receiving the intended communication. (It also communicates other things to people who are not, but "Google Chrome 41.0.2228.0" would be absolutely meaningless to these listeners, so that doesn't seem like an objection with merit.) You might object to the form of the communication, but that doesn't render the communication inexact. Just think of it as browser slang.
    - pdkl95 11y ago
      > It communicates exactly what the browser is This is true, which is not particularly useful when deciding if a feature is available. Using the user agent to make this decision incorrectly assumes that all user agents of a particular browser+version all support exactly the same set of features. This is obviously not true. The user agent may be meaningful[1], but the meaning that it communicates isn't feature data. [1] If you take the header at it's word; as the bug being discussed demonstrates, user ages may be lying.
amalcon 11y ago
If this is your goal, wouldn't it make more sense to just stop sending the User-Agent header?
- g1n016399 11y ago
  Various websites break if you don't send the User-Agent header. So, in the short term, no, in the long term, yes.
  - lmm 11y ago
    Are there really a substantial number of sites that break if you don't send the header but work if you send a random 10-character string?
    - x0 11y ago
      Many sites behind Cloudflare. If I don't have this line in my .wgetrc, I get 403's sometimes from sites using Cloudflare. user_agent=Mozilla/5.0 (compatible; CloudFlare-AlwaysOnline/1.0; +https://www.cloudflare.com/always-online https://www.cloudflare.com/always-online)
      - x0 11y ago
        Note: the specific user-agent doesn't matter, I just think it's funny to steal Cloudflare's one.
        kuschku 11y ago
        I do the same whenever a site requests personal info from me and I don't want to give it. Find the corresponding info from the company or their CEO, use that. And whenever some site wants me to register for a newsletter, I enter their own "critical support" mail address. I hope at some point these sites learn that mandatory anything just hives you useless data.
        11y ago
cinquemb 11y ago
Or cycle through all those lists of the top n used, and put some conditionals in /mozilla-central/netwerk/protocol/http/nsHttpHandler.cpp to avoid all those breaking effects (to some degree). Added benefit of getting alot of "not recognized computers" or whatever emails from google lol
ketralnis 11y ago
Because the days of browsers having bugs that need workarounds are over?
- lazyjones 11y ago
  Hopefully the days of websites having (or being able) to work around all browser bugs of the past 20 years are over.
junto 11y ago
Why send one at all?

Browsers should start submitting a random 10 character string for the User-Agent header.

toomuchtodo 11y ago

Could this be done with an extension?

chei0aiV 11y ago
With an extension to this extension, yes: http://chrispederick.com/work/user-agent-switcher/ http://chrispederick.com/work/user-agent-switcher/
gizmo686 11y ago
Yes. https://github.com/muzuiget/user_agent_overrider https://github.com/muzuiget/user_agent_overrider As far as I am aware, no extension currently offers the option of a random user agent, but many (including the one linked) allows user supplied use agents, and there is no reason you could not make one support random user agents.
- Survey_Sez 11y ago
  There is in fact already an extension which will randomly change the browser user agent. https://github.com/dillbyrne/random-agent-spoofer https://github.com/dillbyrne/random-agent-spoofer
  - danieldk 11y ago
    Also, uMatrix can randomly switch user agent strings (among many other things).

darkmighty 11y ago

Wouldn't that result in even-uglier hacks for finding user agent becoming standard?

cornstalks 11y ago

That would break more than it would fix. Video is hard (not all devices or browsers support the same codecs, bitrates, frame rates, etc), and YouTube has to use the User Agent to try to serve videos that the client can actually play. A random User Agent would mean that all those browsers that need a special video format wouldn't get the type of video they need, which sounds like a crappy world to live in (compared to the crappy world we already live in with meaningful User Agents).

kuschku 11y ago
> (compared to the crappy world we already live in with meaningful User Agents). > Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36 Google Chrome tells us it is: a Mozilla, it is AppleWebkit, it is KHTML, it is Gecko, it is Safari, and it is Chrome. "Meaningful" is something different.
- geofft 11y ago
  It's meaningful. It communicates exactly what the browser is to anyone who is capable of receiving the intended communication. (It also communicates other things to people who are not, but "Google Chrome 41.0.2228.0" would be absolutely meaningless to these listeners, so that doesn't seem like an objection with merit.) You might object to the form of the communication, but that doesn't render the communication inexact. Just think of it as browser slang.
  - pdkl95 11y ago
    > It communicates exactly what the browser is This is true, which is not particularly useful when deciding if a feature is available. Using the user agent to make this decision incorrectly assumes that all user agents of a particular browser+version all support exactly the same set of features. This is obviously not true. The user agent may be meaningful[1], but the meaning that it communicates isn't feature data. [1] If you take the header at it's word; as the bug being discussed demonstrates, user ages may be lying.

amalcon 11y ago

If this is your goal, wouldn't it make more sense to just stop sending the User-Agent header?

g1n016399 11y ago
Various websites break if you don't send the User-Agent header. So, in the short term, no, in the long term, yes.
- lmm 11y ago
  Are there really a substantial number of sites that break if you don't send the header but work if you send a random 10-character string?
  - x0 11y ago
    Many sites behind Cloudflare. If I don't have this line in my .wgetrc, I get 403's sometimes from sites using Cloudflare. user_agent=Mozilla/5.0 (compatible; CloudFlare-AlwaysOnline/1.0; +https://www.cloudflare.com/always-online https://www.cloudflare.com/always-online)
    - x0 11y ago
      Note: the specific user-agent doesn't matter, I just think it's funny to steal Cloudflare's one.
      - kuschku 11y ago
        I do the same whenever a site requests personal info from me and I don't want to give it. Find the corresponding info from the company or their CEO, use that. And whenever some site wants me to register for a newsletter, I enter their own "critical support" mail address. I hope at some point these sites learn that mandatory anything just hives you useless data.
        11y ago

cinquemb 11y ago

Or cycle through all those lists of the top n used, and put some conditionals in /mozilla-central/netwerk/protocol/http/nsHttpHandler.cpp to avoid all those breaking effects (to some degree). Added benefit of getting alot of "not recognized computers" or whatever emails from google lol

ketralnis 11y ago

Because the days of browsers having bugs that need workarounds are over?

lazyjones 11y ago
Hopefully the days of websites having (or being able) to work around all browser bugs of the past 20 years are over.

junto 11y ago

Why send one at all?