13 ms·
Apple Is Blocking Linux User-Agent on appleid.apple.com
- vinniejames 8y agoSame thing for itunes billing, when clicking the link in your invoice email
- cedivad 8y agoThat doesn't necessarily mean they are willingly blocking linux, I've seen inconspicuous user agent strings triggering 502 errors before. It's just badly written code.
- csmattryder 8y agoYeah, I'd wager the firewall has a rule to check against bot traffic, which tend to come from Linux instances. Probably overzealous, sure. Malicious? Doubtful.
- pandemicsyn 8y agoDon't bots typically fake a windows/chrome user agent though? I guess there might be enough low effort bots that just throw up a default platform/curl user agent.
- ahje 8y agoNarh, it's extremely common to see stuff like Firefox 34 for Linux trying to log into WordPress sites a few hundred times per hour. I guess it's old malware that lives on in hacked web sites that the owners abandoned.
- codetrotter 8y agoSuch a firewall could even have learned to block Linux user agents on its own. Similar to how some spam filters learn what email headers are associated with spammers. So if the firewall is seeing a lot of bad traffic with “X11; Linux” in their UA strings and little normal traffic with that in their UA strings then the firewall will take the presence of that as an indicator of possibly bad traffic.
- amenod 8y agoI'm pretty sure they have integration tests to make sure that it doesn't block iOS devices. Not having those tests for common Linux browsers is... Apple.
- trickstra 8y agoany decent bot spoofs the UA string randomly to one of the top 10 most frequent UA strings. That's like a number 2 feature after the one the bot was built for.
- tyingq 8y agoIt's curious though, that the thread narrows it down to "X11; Linux", with that specific casing (update: nope, not case sensitive). Changing or removing any single char in that string stops the error.
- cedivad 8y agoThey most likely had a reason to threat those people differently and a bug came up under that special case ;) Watch them fix it.
- floatingatoll 8y agoWhat browsers on Linux produce a User-agent containing that exact string _by default_, without user customization? EDIT: Elsewhere in thread confirms Firefox and Chrome affected on lots of Linux.
- lloeki 8y ago
- kalleboo 8y agoA service we use has just started banning logins from the whole country of Japan on their cloudflare, just about to contact them about this. At this point I'm still willing to assume it's an automated filter gone wild and not some odd xenophobia
- rblatz 8y agoLikely the WAF (web application firewall) responding to malicious use that happened to use that user agent.
- MichaelApproved 8y agoI doubt that could that be it. Blocking by user agent would be a terrible idea. Way too broad a net and could easily be abuse to shut down major browsers. Also easily bypassed by changing the agent name. Does anyone have first hand experience with a WAF that did that?
- ahje 8y agoIt's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic. In our case, we block the impossible combos and rate-limit the ones commonly used by botnets. Blocking based on whether the UA has "Linux" in it is just dumb, though.
- crypt1d 8y agoI've seen Cloudflare block based on user-agent alone.
- unethical_ban 8y agoUA is a blocking mechanism in WAFs. Also, (Akamai or <web proxy> fix your shit), re-ordered HTTP headers do the same thing. If you're behind a MITM web proxy at work, try going to Lowes.com - there's a chance you'll get blocked by their Akamai filter for putting headers back in the "wrong" (there is no wrong) way.
- ungzd 8y agoMuch hyped "disruptive deep machine-learning smart AI" used for, i.e. fraud detection work the same way: by finding features commonly used by fraudsters and discriminating everyone having the same features (i.e. user agent, time of purchase, items purchased, even name on card). Old-school non-computerized discrimination (i.e. racism) work exactly the same way.
- jrockway 8y agoIt is probably time for browsers to stop sending a user agent string.
- jandrese 8y agoThat would just start an arms race where they would profile the browser to figure out what type it is. Better to just leave it as a string you can spoof and let them pretend that it is good enough.
- jrockway 8y agoIf intentional yes, but this is probably an accident. You can't accidentally take action on data you don't have.
- ballenf 8y agoSet my user agent to ' ' (single space character) in latest Safari on a new Mac. Get a 403 Forbidden.
- gekkonier 8y agoIt's a feature and you are using it wrong.
- Canada 8y agoThe other day my friend lost his iPhone. He tried to use my Android to find it, but Apple's site just says it's unsupported. Really thoughtful of Apple to make that feature unavailable right when users need it the most.
- swiley 8y agoIt’s kind of insane that they do that considering the majority of phones are androids. It means many people are almost certainly going to need your laptop which really limits how it can be used.
- deleted 8y ago[deleted]
- trickstra 8y ago> considering the majority of phones are androids. This is one of the ways they are trying to change that.
- goda90 8y agoIt doesn't make sense that making it harder to use a feature of an iPhone would make more people want to use an iPhone. It seems unlikely that someone sees someone struggle to find their lost iPhone via an Android device and think "This makes me want an iPhone more"
- isostatic 8y ago"I'm glad I have an iphone, this android is rubbish"
- ChrisSD 8y agoI doubt it. Apple don't care about having a high percent of the market. They're happy so long as they have the high end in their pocket. That's where the big margins are. They're happy to leave the high volume lower end to the likes of Samsung.
- windexh8er 8y agoThis has been going on for a while: https://mobile.twitter.com/xdaroj/status/1090319095134867459 https://mobile.twitter.com/xdaroj/status/1090319095134867459
- floatingatoll 8y agoThis has been going on for a while for a SaaS called “Browserling” that appears, from the thread, to emulate or host a browser of some sort in the cloud somehow. Does this issue affect normal Linux desktop-hosted locally-operated “the standard way” browsers?
- jplayer01 8y agoJust tried it on my locally hosted Arch Linux desktop. It doesn't work. Firefox, Chromium. Doesn't matter. Doesn't work.
- windexh8er 8y agoThat was the point of the Twitter interaction. A way for Apple to repro easily, but they ignored. I can't believe this has gone on so long quite honestly. Then again it really shows the ecosystem lock-in. This is a great example though... Eventually why not lock out everything non-Apple? Hasn't seemed to have mattered much over a month.
- jplayer01 8y agoI don't think the person who brought it up was aware the issue was associated with the Linux/X11 user agent, unfortunately, so couldn't provide support with the right information to actually reproduce the issue in a useful way. Still, it shouldn't have been an issue for this long, and who knows when they'll actually get around to fixing it. I don't think they're in a hurry to help Linux or Android users.
- windexh8er 8y ago
- deleted 8y ago[deleted]
- npmaile 8y agoJust yesterday I came across this issue trying to set up my podcast with iTunes. I probably would have gone crazy if I hadn’t seen this post.
- majewsky 8y agoWhen I wanted to submit my podcast to the iTunes directory, I had to install iTunes in Wine because iTunes for Windows is the only way to create an Apple ID that does not involve giving Apple a boatload of money. And of course, iTunes in Wine did not allow me to paste passwords, so I had to type in the autogenerated password. And the autogenerated answers for the "security" questions. Fun.
- solarkraft 8y agoI sent them a support tweet and think you all should too.
- Someone1234 8y agoIn case anyone, like me, doesn't know what appleid.apple.com is: It is Apple's single-sign-on portal for Apple IDs. Meaning if it errors out you cannot get an authentication token and use any Apple property (e.g. Apple Store, iCloud, developer portal, etc).
- isostatic 8y agoI just logged into https://www.icloud.com/ https://www.icloud.com/ on my firefox/linux desktop -- had a popup on my iphone for the security number, but I'm logged in, can access find-my-iphone, etc.
- crtasm 8y agoCan you get the security number another way if you have lost the phone?
- isostatic 8y agoI have enough options set up in my iCloud account to cope with most failures
- neurobashing 8y agoSame. I've been using a plain-jane Fedora box w/ Firefox and have had no problems accessing iCloud or creating app passwords.
- snailmailman 8y agoSame. not sure where the blocking is occuring, but its not affecting me in any way. icloud.com works fine and thats just about all i need to do on a PC.
- eridius 8y agoThe SSO domain is idmsa.apple.com. appleid.apple.com is specifically the site for managing your AppleID (e.g. changing your name, password, trusted phone number, etc).
- svnpenn 8y agouser agent blocking is the most pointless kind - as you can set your string to whatever you want Services.prefs.setCharPref('general.useragent.override', 'apple spoof');
- vkhn 8y agoExactly. Of all the groups that might know how to spoof UA, the linux community is the most likely. Clearly they didn't think this through.
- Wowfunhappy 8y ago> Clearly they didn't think this through. You're assuming this was a malicious move on Apple's part, as opposed to negligence or apathy.
- kirion25 8y agoMore information on reddit: https://www.reddit.com/r/linux/comments/atc0av/apples_apple_id_management_site_blocks_linux/ https://www.reddit.com/r/linux/comments/atc0av/apples_apple_...
- Severian 8y agoApple ID is garbage, and I've been unable to reset my security questions due to Apple "not having sufficient information". Even calling Apple and having the agent try to reset the questions using a PIN did not work. They escalated the ticket to some user department, where it promptly went nowhere. This was in October. When first dealing with this, I spent an hour on the phone with Apple. Clicking on my support ticket URL gives me the option to call them, but no way to email them back to inquire. It's a giant waste of time since Tier 1 agents go by script and cannot deviate without contacting a supervisor (whom I spoke to before). So I guess I'm locked out of the system forever using my email address.
- wila 8y agoIf you can login to your device then you should be able to reset by enabling 2FA in iCloud. See my reply above.
- fishywang 8y agoApple ID 2FA uses one of your already logged in Apple hardware. For people using iPhone and didn't lose it that's fine. But for people don't carry an Apple hardware anywhere (for example I have an iMac at home), that's a lot of trouble.
- wila 8y agoThat description is the issue I had, I do not have an iPhone.
- Severian 8y agoI don't have any Apple devices.
- mirages 8y agoI spoofed my UA to "Linux", got page loading normally and my login worked
- aembleton 8y agoTry "X11; Linux"
- oarsinsync 8y agoPer the actual thread, they're not blocking "Linux", they're blocking "X11; Linux" (case-insensitive). Remove any character from that string and it succeeds. dang: are you able to update the title to reflect that it's not just 'linux' being blocked?
- zovin 8y agoIf that was true, then "Invoke-WebRequest -Uri https://appleid.apple.com https://appleid.apple.com -UserAgent '(Linux)'" would return a 200 status, but it returns a 502 Bad Gateway
- bordplate 8y agoYou're right, that's blocked. User-agent "(Linux)" is blocked, however User-agent "Linux" is not, while "X11; Linux" is blocked.
- Jyaif 8y agoApple is also sniffing UA (and doing some crazy heuristics with it) when delivering webpages to its apsptore. I think it's because they want to try to serve you a different webpage that opens up the appstore application when you are clicking on a link, but it just doesn't work reliably. It's a pain for me, my users, and an other instance of Apple just failing at the web.
- mishurov 8y agoIt's because people using Linux don't go onto malware websites for consumerist monkeys.
- ctime 8y agoNever attribute to malice that which is adequately explained by stupidity. Apple isn't exactly known for their ability to provide reliable internet services. This is IMHO a badly misconfigured WAF or possibly application config bug and not some kind of grand conspiracy to exclude certain Linux users.
- ld00d 8y agoRight. Time and attention costs money, and why would Apple spend that time and attention on being jerks to 2.14% of the desktop market?
- ear7h 8y agoWhen the whole battery debacle was happening, I could only reach the battery replacement page on Safari. On Chrome and Firefox, the pages would give and error (I wanna say the same gateway errror)
- jniedrauer 8y agoWell this explains it. I was getting an HTTP 502 on appleid.apple.com while trying to add Apple Pay support to a product I am working on. I called apple support to tell them the site was down. The support agent told me, and I quote, "Our internet is Safari. We don't support Firefox." I guess Apple doesn't want developers to support their products.
- gargravarr 8y agoThis doesn't surprise me at all. business.apple.com refuses me on Firefox. Tweak the UA to be Chrome and it works 100%.
- czr 8y agoNot sure why people are claiming this as malicious. If Apple thought making life inconvenient for linux users was a good idea, this is about the least effective possible way to do that. And it's unclear why Apple would want to do that in the first place. Seems far more likely that Apple was facing some sort of automated attacks on this particular subdomain (with linux UAs), and a beleaguered admin used this as a quick fix. Or, even more probably, it's a misconfiguration.
- addicted 8y agoRemember when the only way to watch an Apple event live on their site was if you were using an Apple device? It’s likely not malicious in the sense that they want to punish Linux users. And blocking Linux for this particular site may not have been something they even wanted to do. But in general Apple has been unnecessarily hostile towards non Apple devices, and it’s not hard to believe this is a consequence of that.
- dstola 8y agoApple has a wall'ed-in garden Google has a wall'ed-in garden Facebook is trying to make a wall'ed-in garden Does anyone else ever want to take out a flamethrower and just start from scratch... Its so tiring
- askvictor 8y ago*Facebook is a walled garden
- RileyJames 8y agoWow, yes I ran into this issue the other day. Had to use my phone to access. I assumed it was the network and moved on. Can’t believe it was due to running Ubuntu. WTF!
- austinshea 8y agoMaybe they were getting attacked, and blocked a particular user agent. I’ve had to do that before.