5 ms·

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the use

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1 Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) iOS/16.0.7.121031 Mobile/15C153 Safari/9537.53 Mozilla/5.0 (Linux; Android 7.0; LG-H840 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36 A Linux in comparison: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0 While it includes the version number, no patch level (57.0.X) is included.

gruez 9y ago
Firefox on the other hand, discloses very little, even on mobile: Mozilla/5.0 (Android 4.4; Mobile; rv:41.0) Gecko/41.0 Firefox/41.0
sorenjan 9y ago
The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.
- yoodenvranx 9y ago
  > why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know which browser is responsible for this.
  - CaptSpify 9y ago
    As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?
    - gizmo385 9y ago
      Because when management asks you why their site that they paid hundreds of thousands of dollars for doesn't work on <insert major browser here>, your answer can't be "the browser's implementation of the spec is shitty, blame them." Your answer is going to be, "Yeah, sure, let me fix that."
      - nitrogen 9y ago
        Management is not some all-powerful, all-knowing spectre impervious to persuasion. Don't give up so easily.
      - CaptSpify 9y ago
        Well, your answer should be: I'll reimpliment it using known, simple, stable technologies. But for some reason our industry hates those things.
        seandougall 9y ago
        So... not the web, then? :-P
      - matte_black 9y ago
        Don’t forget “Also, it’s going to cost $X more.”
      - chriswarbo 9y ago
        > your answer can't be "the browser's implementation of the spec is shitty, blame them." If it's a major browser which management cares about, then you should be testing with it already. If you're not, then logging user agent strings isn't going to help. Logging user agent strings would help if, for example, an unexpectely-large proportion of users are using a "non-major" browser, in which your site is broken. If the proportion is small, management won't care. If the proportion is expected, then market/demographic research is partly to blame; update the spec. If the browser is "major", you should be testing with it anyway. If the site isn't broken, there's no problem.
- CaptSpify 9y ago
  I've always thought this. Just code to the standard, and if the browser doesn't render it correctly, then tell the user to fuck off and fix their browser. I don't know why we ever thought sending all this data to the server was a good idea
  - fixermark 9y ago
    if 99% of websites you visit work great, and 1 website you visit tells you to fuck off and fix your browser, are you going to do that or are you going to just not use that site? Remember: incentives. The goal of a web developer is to make sites people use.
    - CaptSpify 9y ago
      Yeah, I would just leave that site. But if you implement that feature using known simple and stable, tech, you wont really have that problem. > Remember: incentives. The goal of a web developer is to make sites people use. The goal should be to empower users. Anyone can make a site that people "use"
      - fixermark 9y ago
        Does empowering users get the web developer paid? I mean, in an ideal world, of course it does. But again: incentives. Keep in mind: search engines themselves are extremely empowering, and they are not generally considered to be something a person pays directly for.
        CaptSpify 9y ago
        Yeah, empowering users does get developers paid. I get paid to do that myself, and know a lot of other people who also get paid to do that. Of course it's sometimes easier to get paid by treating users like cattle. But if someone doesn't intuitively understand why screwing their users is a bad idea, I'm not sure I can help them.
- szatkus 9y ago
  Not possible in short term. Many sites freak out when accessed with non-standard useragent.
- goialoq 9y ago
  Feature detection is equivalent to user agent string, from a fingerprinting perspective.
- aglionby 9y ago
  Not exactly related to your point about the user agent giving all kinds of arguably unnecessary information, but there's an interesting write-up about why the core user agent is the mess it is for those who've not seen it already. https://webaim.org/blog/user-agent-string-history/ https://webaim.org/blog/user-agent-string-history/
- whatismybrowser 9y ago
  The user agent string definitely has a place on the web, the problem is that it's been used and abused by web developers in the 90s and 2000s when trying to deal with the utter mess that was "browser compatibility" back then. I run whatismybrowser.com and it's a perfect case of why user agents are useful information. It'll tell you what browser you've got, what OS, and whether you're up to date or not. It's extremely useful to know this info when helping non-tech users - you would not believe how many people still reply "I just click the internet" when you ask them what browser they're using. My site helps answer all those complicated "first" questions. I completely agree that using User Agents for feature detection/brower compatibilty is a terrible idea, but apparently enough websites still do it to warrant having to keep all that useless, contraditory mumbo jumbo in it too - it isn't what they should be used for any more! And also, I don't think there's any problem with including "too much" information in the user agent either - point in case: Firefox used to include the full version number of Firefox in the user agent, but now it only shows the major version number, not the exact revision etc. The problem is I can no longer perfectly warn users if they're actually up to date or not. The reasoning for this is given as a security concern, which I still don't understand - if there's a security problem in a particular point-revision version of Firefox which can be exploited by a malicious web server - odds are they're just going to try that exploit for any version of firefox and it either will or won't work - how does the malicious site knowing the exact version make the situation any worse?!
- NegativeLatency 9y ago
  Google makes the OS, but they also sell ads. Seems pretty advantageous to them to make their devices easy to fingerprint.
saagarjha 9y ago
I believe Safari will be freezing the user agent string soon; Safari Technology Preview is already doing this (it's "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15" if you're curious).

gruez 9y ago

Firefox on the other hand, discloses very little, even on mobile: Mozilla/5.0 (Android 4.4; Mobile; rv:41.0) Gecko/41.0 Firefox/41.0

sorenjan 9y ago

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

yoodenvranx 9y ago
> why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know which browser is responsible for this.
- CaptSpify 9y ago
  As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?
  - gizmo385 9y ago
    Because when management asks you why their site that they paid hundreds of thousands of dollars for doesn't work on <insert major browser here>, your answer can't be "the browser's implementation of the spec is shitty, blame them." Your answer is going to be, "Yeah, sure, let me fix that."
    - nitrogen 9y ago
      Management is not some all-powerful, all-knowing spectre impervious to persuasion. Don't give up so easily.
    - CaptSpify 9y ago
      Well, your answer should be: I'll reimpliment it using known, simple, stable technologies. But for some reason our industry hates those things.
      - seandougall 9y ago
        So... not the web, then? :-P
    - matte_black 9y ago
      Don’t forget “Also, it’s going to cost $X more.”
    - chriswarbo 9y ago
      > your answer can't be "the browser's implementation of the spec is shitty, blame them." If it's a major browser which management cares about, then you should be testing with it already. If you're not, then logging user agent strings isn't going to help. Logging user agent strings would help if, for example, an unexpectely-large proportion of users are using a "non-major" browser, in which your site is broken. If the proportion is small, management won't care. If the proportion is expected, then market/demographic research is partly to blame; update the spec. If the browser is "major", you should be testing with it anyway. If the site isn't broken, there's no problem.
CaptSpify 9y ago
I've always thought this. Just code to the standard, and if the browser doesn't render it correctly, then tell the user to fuck off and fix their browser. I don't know why we ever thought sending all this data to the server was a good idea
- fixermark 9y ago
  if 99% of websites you visit work great, and 1 website you visit tells you to fuck off and fix your browser, are you going to do that or are you going to just not use that site? Remember: incentives. The goal of a web developer is to make sites people use.
  - CaptSpify 9y ago
    Yeah, I would just leave that site. But if you implement that feature using known simple and stable, tech, you wont really have that problem. > Remember: incentives. The goal of a web developer is to make sites people use. The goal should be to empower users. Anyone can make a site that people "use"
    - fixermark 9y ago
      Does empowering users get the web developer paid? I mean, in an ideal world, of course it does. But again: incentives. Keep in mind: search engines themselves are extremely empowering, and they are not generally considered to be something a person pays directly for.
      - CaptSpify 9y ago
        Yeah, empowering users does get developers paid. I get paid to do that myself, and know a lot of other people who also get paid to do that. Of course it's sometimes easier to get paid by treating users like cattle. But if someone doesn't intuitively understand why screwing their users is a bad idea, I'm not sure I can help them.
szatkus 9y ago
Not possible in short term. Many sites freak out when accessed with non-standard useragent.
goialoq 9y ago
Feature detection is equivalent to user agent string, from a fingerprinting perspective.
aglionby 9y ago
Not exactly related to your point about the user agent giving all kinds of arguably unnecessary information, but there's an interesting write-up about why the core user agent is the mess it is for those who've not seen it already. https://webaim.org/blog/user-agent-string-history/ https://webaim.org/blog/user-agent-string-history/
whatismybrowser 9y ago
The user agent string definitely has a place on the web, the problem is that it's been used and abused by web developers in the 90s and 2000s when trying to deal with the utter mess that was "browser compatibility" back then. I run whatismybrowser.com and it's a perfect case of why user agents are useful information. It'll tell you what browser you've got, what OS, and whether you're up to date or not. It's extremely useful to know this info when helping non-tech users - you would not believe how many people still reply "I just click the internet" when you ask them what browser they're using. My site helps answer all those complicated "first" questions. I completely agree that using User Agents for feature detection/brower compatibilty is a terrible idea, but apparently enough websites still do it to warrant having to keep all that useless, contraditory mumbo jumbo in it too - it isn't what they should be used for any more! And also, I don't think there's any problem with including "too much" information in the user agent either - point in case: Firefox used to include the full version number of Firefox in the user agent, but now it only shows the major version number, not the exact revision etc. The problem is I can no longer perfectly warn users if they're actually up to date or not. The reasoning for this is given as a security concern, which I still don't understand - if there's a security problem in a particular point-revision version of Firefox which can be exploited by a malicious web server - odds are they're just going to try that exploit for any version of firefox and it either will or won't work - how does the malicious site knowing the exact version make the situation any worse?!
NegativeLatency 9y ago
Google makes the OS, but they also sell ads. Seems pretty advantageous to them to make their devices easy to fingerprint.

saagarjha 9y ago

I believe Safari will be freezing the user agent string soon; Safari Technology Preview is already doing this (it's "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15" if you're curious).