6 ms·

We should just remove the reporting of User-Agent in browsers. All they do is encourage user tracking a building half-baked heuristics.

• andrewguenther 11y ago
  How do they encourage user tracking? The user agent string only tells you information about the browser, not the user.
  • drdaeman 11y ago
    They add extra bits of identifying information to the pool. You know, https://panopticlick.eff.org/ https://panopticlick.eff.org/
    • Survey_Sez 11y ago
      https://www.browserleaks.com/ https://www.browserleaks.com/ is another useful resource to help understand browser fingerprinting and how to combat it.
  • pdkl95 11y ago
    It's not the only data that is available for deriving a tracking key. https://panopticlick.eff.org/ https://panopticlick.eff.org/ Why are you pretending that there is some sort of difference between "tracking a user" and "tracking the user's browser", which is close enough for most tracking purposes? Tracking the browser is tracking a user for a vast majority of people. For browsers on a phone, it is even more likely to be a 1:1 mapping.
    • andrewguenther 11y ago
      The user agent (by itself) provides you none of those things.... > Why are you pretending that there is some sort of difference between "tracking a user" and "tracking the user's browser" I'm not? That isn't what I said.
• jsprogrammer 11y ago
  Or, make the information in the string useful. Like, maybe, just list the features the particular user-agent supports.
  • joosters 11y ago
    User-Agent: entire browser source code (uuencoded) ? Hmm... might be a bit big... how about, since the source code is publicly available, we could just put the browser name and version in there?
    • drdaeman 11y ago
      No, seriously. Can we just get all browser vendors cooperate and clean up the mess at the same time, so everyone wins? User-Agent: Chromium/47.0 (Windows 10) User-Agent: Firefox/43.0 (GNU/Linux; X11) User-Agent: Wget/1.15.4 (GNU/Linux) etc. Given that current UA strings are abysmal (and sent on every request), this would probably save a few kilobytes worth of headers (images, scripts, stylesheets), so would probably improve performance by some nanoseconds. They managed to do this with SHA-1 deprecation and a lot of other stuff. So they could just announce that "on February 1st, 2017 we all clean up the clusterfuck User-Agent headers are", bake in the timer and spread the word.
      • lmm 11y ago
        What's the cost/benefit on that? Older sites would not update. Newer sites are using better forms of detection, except for the tiny number of sites that put engineering effort into supporting an insane long tail of old browsers. (SHA-1 deprecation only worked because certificates have to be renewed, so any site with working HTTPS is being actively maintained at some level)
        • drdaeman 11y ago
          Benefit's obvious - getting rid of legacy cruft. It has to be done someday, or by 2030 we'll end up with few kilobyte-long UA strings. Cost: bajillion man-hours of CEOs, companies and committees trying to negotiate that they all do this at once, then about 10 minutes of developer time to actually code this into reality. Then some sites would be broken, but old stuff eventually rotting and dying is nothing new on the web. Unfortunately, no idea about the numbers, but I suppose it would be low. If someone has the actual statistics on how much sites become practically unusable without a legacy User-Agent header, that'd be great.
• pdkl95 11y ago
  The user agent header should have been dropped a long time ago, as it is one of the largest[1] sources of browser identification data. Even ignoring the tracking problem, using the user agent string instead of feature detection has always been terrible engineering, as it assumes all browsers within a version have the same features. Browsers have always been configurable - often in extreme ways. I don't understand how anybody can simply6 pretend the preferences dialog (and extensions, etc) doesn't exist. [1] Out of the 15.91 bits of data that Panopticlick was able to collect from my browser, 9.0 bits (56%) were from the user agent. The 2nd largest source is HTTP_ACCEPT at 4.25 bits.
  • thedufer 11y ago
    > using the user agent string instead of feature detection has always been terrible engineering Is there a better solution for server-side feature detection?
    • davb 11y ago
      Something like the Accept header, listing capabilities. Or something like how Android handles capabilities in manifests.
  • v413 11y ago
    Feature detection is not always enough. E.g. if a browser reports it has a required feature but that feature is buggy rendering it effectively unusable, then browser detection is necessary.
  • immibis 11y ago
    BTW, feature detection can be even more identifying (although you need it anyway). IIRC my browser was completely unique at Panopticlick, most likely because I have a rare plugin installed (a handler for byond:// URLs)
• awqrre 11y ago
  some stores even charge you a different amount based on user-agent string...