6 ms·

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

by MiddleEndian 8y ago

baggy_trough 8y ago
Rubbish. They are incredibly useful for debugging.
- justinjlynn 8y ago
  There are better solutions available than hanging functionality on unreliable vestigial bits and pieces that shouldn't be there anyway which, because others abuse the functionality, you can't trust to be correct for debugging purposes.
  - baggy_trough 8y ago
    That might be true, although you don't list the solutions, but it doesn't refute my point in any case.
  - adrr 8y ago
    99% of the traffic has the correct user-agent which is useful in tracking down issues that are browser specific. The other 1% will just get ignored as noise. And it's not like we can't tell what type of browser they are using with browser specific objects that we can pull from javascript. We just can't infer the version of the browser which is critical for debugging issues.
    - kevin_thibedeau 8y ago
      I use a randomized user agent and every once in a while get rejected by a site that has decided my browser can't be supported. Usually when I'm on some Safari version. I doubt much effort is being done to identify fake user agents since there are better fruit to pick in the fingerprinting game.
- pdkl95 8y ago
  edit: sorry, accidentally submitted early So what. Removing one of the largest sources entropy available for fingerprinting users is important. We shouldn't maintain the terrible long-term effects[1] of tracking everything just to help you have an easier time debugging. [1] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and-a-the-age-of-surveillance-capital.html http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...
  - shhehebehdh 8y ago
    Does it really provide that much entropy? Maybe back in the days when browsers didn’t auto-update, but intuitively it should only provide about four bits at most (os: Android iOS macOS windows, browser: chrome safari edge ie ff) except for a few rare users who don’t stay up to date or choose a weird browser (and those folks probably are a little confused about how privacy works).
    - woodrowbarlow 8y ago
      ohhhhh you betcha. https://amiunique.org/ https://amiunique.org/ i ran this on my work laptop (windows 10 / firefox - mostly default settings). the "details" tab shows a full breakdown of each fingerprinting component with a "similarity ratio" (percentage of fingerprints that share the same value). every entry is 20% or greater, most of them around 50% except for timezone (4%), canvas (1%), and user agent (0.12%). so, yeah, user agents are still the largest source of entropy by a wide margin for fingerprinting scripts.
      - shhehebehdh 8y ago
        I suspect this is just stale data. I can’t think why the most recent version of a browser would put me at one in a thousand.
- thayne 8y ago
  They would be a lot more useful if they were more straighforward and honest. Just give me "Chrome 68" instead of "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"
  - fernandotakai 8y ago
    firefox has a sane user agent. mine is: >Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
- olliej 8y ago
  Per https://webkit.org/blog/8042/release-notes-for-safari-technology-preview-46/ https://webkit.org/blog/8042/release-notes-for-safari-techno... the user agent is frozen in webkit now.
- lewisj489 8y ago
  You're writing your websites wrong.
  - fixermark 8y ago
    I've had to debug around a short-lived bug in the Firefox rendering engine that only showed up in the FF rendering engine before. The site itself? Standards-compliant; there was flexibility in the standard (ironically, for flexboxes ;) ) about performance constraints and our site just fell down Gecko's slowness tree and hit every branch on the way. Given the engines are allowed to vary, this experience is inevitable from time to time. The user-agent is really valuable in helping us figure out when that's what we're seeing.
  - baggy_trough 8y ago
    If there’s a way to write them without the occasional browser-specific bug, I’d sure like to know what it is.
mehrdadn 8y ago
They help you figure out if a user agent wants a mobile view of a page without Javascript... which is pretty useful.
- stavros 8y ago
  We don't need user agents for that. There's an easy way to tell whether a visitor wants a cleaner view of a page, without Javascript: Yes.
  - mehrdadn 8y ago
    I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.
    - realusername 8y ago
      the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.
      - mehrdadn 8y ago
        Well at least we acknowledged there's some utility. Now consider that mobile devices are different as well..
        realusername 8y ago
        The current user agent does not give you much insight about what type of mobile device you have anyway, especially on Android.
        rkeene2 8y ago
        I use Firefox for Android on ChromeOS -- it produces interesting results.
      - 8y ago
StavrosK 8y ago
I vote we change all user agents to just "curl".
- koolba 8y ago
  Might as well save 3 bytes and just call use “c”.
- floatingatoll 8y ago
  “Apache” would be ironic.
altmind 8y ago
Considering recent chrome, firefox user agent contains id string of almost every browser in existence, this is so true: Mozilla/5.0 (...) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
- rndgermandude 8y ago
  You just wait for Edge-based-on-Chromium's User-Agent :D
  - xnaas 8y ago
    Per a buddy who is using said Edgium (Chromium-based Edge): https://i.imgur.com/p6ZMoJY.png https://i.imgur.com/p6ZMoJY.png
    - rndgermandude 8y ago
      Oh ffs
    - tbodt 8y ago
      Edg?
      - mappu 8y ago
        I assume real live websites are detecting "Edge/" and applying workarounds for the old rendering engine.
        nkrisc 8y ago
        Like the maybe-not-actually-true reason why "Windows 9" was skipped and we got 10 instead?
      - StavrosK 8y ago
        It was too edgy for them.
anoncake 8y ago
That is not correct. They also serve to exclude users of browsers you dont know or like.
olliej 8y ago
Well, the next best thing is what webkit is doing (https://webkit.org/blog/8042/release-notes-for-safari-technology-preview-46/ https://webkit.org/blog/8042/release-notes-for-safari-techno...) by freezing the user agent. So as time goes by the user agent becomes increasingly homogenous and so, less useful for tracking.
- saagarjha 8y ago
  I believe this change was rolled back, since my User Agent is "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Safari/605.1.15".
inopinatus 8y ago
We sometimes render different HTML to handle browser and device behavioural variations, including FOUT-management variations in how they load assets that therefore can't be handled in JS even if we wanted to. Historically we also redirected to a pure HTML/CSS version of our tools when IE9 or earlier was detected.
kbumsik 8y ago
I'm pretty sure deleting User agents field will introduce another non-standard X-prefixed header.

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

baggy_trough 8y ago

Rubbish. They are incredibly useful for debugging.

justinjlynn 8y ago
There are better solutions available than hanging functionality on unreliable vestigial bits and pieces that shouldn't be there anyway which, because others abuse the functionality, you can't trust to be correct for debugging purposes.
- baggy_trough 8y ago
  That might be true, although you don't list the solutions, but it doesn't refute my point in any case.
- adrr 8y ago
  99% of the traffic has the correct user-agent which is useful in tracking down issues that are browser specific. The other 1% will just get ignored as noise. And it's not like we can't tell what type of browser they are using with browser specific objects that we can pull from javascript. We just can't infer the version of the browser which is critical for debugging issues.
  - kevin_thibedeau 8y ago
    I use a randomized user agent and every once in a while get rejected by a site that has decided my browser can't be supported. Usually when I'm on some Safari version. I doubt much effort is being done to identify fake user agents since there are better fruit to pick in the fingerprinting game.
pdkl95 8y ago
edit: sorry, accidentally submitted early So what. Removing one of the largest sources entropy available for fingerprinting users is important. We shouldn't maintain the terrible long-term effects[1] of tracking everything just to help you have an easier time debugging. [1] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and-a-the-age-of-surveillance-capital.html http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...
- shhehebehdh 8y ago
  Does it really provide that much entropy? Maybe back in the days when browsers didn’t auto-update, but intuitively it should only provide about four bits at most (os: Android iOS macOS windows, browser: chrome safari edge ie ff) except for a few rare users who don’t stay up to date or choose a weird browser (and those folks probably are a little confused about how privacy works).
  - woodrowbarlow 8y ago
    ohhhhh you betcha. https://amiunique.org/ https://amiunique.org/ i ran this on my work laptop (windows 10 / firefox - mostly default settings). the "details" tab shows a full breakdown of each fingerprinting component with a "similarity ratio" (percentage of fingerprints that share the same value). every entry is 20% or greater, most of them around 50% except for timezone (4%), canvas (1%), and user agent (0.12%). so, yeah, user agents are still the largest source of entropy by a wide margin for fingerprinting scripts.
    - shhehebehdh 8y ago
      I suspect this is just stale data. I can’t think why the most recent version of a browser would put me at one in a thousand.
thayne 8y ago
They would be a lot more useful if they were more straighforward and honest. Just give me "Chrome 68" instead of "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"
- fernandotakai 8y ago
  firefox has a sane user agent. mine is: >Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
olliej 8y ago
Per https://webkit.org/blog/8042/release-notes-for-safari-technology-preview-46/ https://webkit.org/blog/8042/release-notes-for-safari-techno... the user agent is frozen in webkit now.
lewisj489 8y ago
You're writing your websites wrong.
- fixermark 8y ago
  I've had to debug around a short-lived bug in the Firefox rendering engine that only showed up in the FF rendering engine before. The site itself? Standards-compliant; there was flexibility in the standard (ironically, for flexboxes ;) ) about performance constraints and our site just fell down Gecko's slowness tree and hit every branch on the way. Given the engines are allowed to vary, this experience is inevitable from time to time. The user-agent is really valuable in helping us figure out when that's what we're seeing.
- baggy_trough 8y ago
  If there’s a way to write them without the occasional browser-specific bug, I’d sure like to know what it is.

mehrdadn 8y ago

They help you figure out if a user agent wants a mobile view of a page without Javascript... which is pretty useful.

stavros 8y ago
We don't need user agents for that. There's an easy way to tell whether a visitor wants a cleaner view of a page, without Javascript: Yes.
- mehrdadn 8y ago
  I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.
  - realusername 8y ago
    the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.
    - mehrdadn 8y ago
      Well at least we acknowledged there's some utility. Now consider that mobile devices are different as well..
      - realusername 8y ago
        The current user agent does not give you much insight about what type of mobile device you have anyway, especially on Android.
        rkeene2 8y ago
        I use Firefox for Android on ChromeOS -- it produces interesting results.
    - 8y ago

StavrosK 8y ago

I vote we change all user agents to just "curl".

koolba 8y ago
Might as well save 3 bytes and just call use “c”.
floatingatoll 8y ago
“Apache” would be ironic.

altmind 8y ago

Considering recent chrome, firefox user agent contains id string of almost every browser in existence, this is so true: Mozilla/5.0 (...) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

rndgermandude 8y ago
You just wait for Edge-based-on-Chromium's User-Agent :D
- xnaas 8y ago
  Per a buddy who is using said Edgium (Chromium-based Edge): https://i.imgur.com/p6ZMoJY.png https://i.imgur.com/p6ZMoJY.png
  - rndgermandude 8y ago
    Oh ffs
  - tbodt 8y ago
    Edg?
    - mappu 8y ago
      I assume real live websites are detecting "Edge/" and applying workarounds for the old rendering engine.
      - nkrisc 8y ago
        Like the maybe-not-actually-true reason why "Windows 9" was skipped and we got 10 instead?
    - StavrosK 8y ago
      It was too edgy for them.

anoncake 8y ago

That is not correct. They also serve to exclude users of browsers you dont know or like.

olliej 8y ago

Well, the next best thing is what webkit is doing (https://webkit.org/blog/8042/release-notes-for-safari-technology-preview-46/ https://webkit.org/blog/8042/release-notes-for-safari-techno...) by freezing the user agent. So as time goes by the user agent becomes increasingly homogenous and so, less useful for tracking.

saagarjha 8y ago
I believe this change was rolled back, since my User Agent is "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.2 Safari/605.1.15".

inopinatus 8y ago

We sometimes render different HTML to handle browser and device behavioural variations, including FOUT-management variations in how they load assets that therefore can't be handled in JS even if we wanted to. Historically we also redirected to a pure HTML/CSS version of our tools when IE9 or earlier was detected.

kbumsik 8y ago

I'm pretty sure deleting User agents field will introduce another non-standard X-prefixed header.