4 ms·

Really? I can see a good use case for the ones that are described at Panopticlick. Things like http_accept, plugin details and fonts are necessary if you want

by omh 16y ago

Really? I can see a good use case for the ones that are described at Panopticlick. Things like http_accept, plugin details and fonts are necessary if you want to use the capabilities of the client - you need to know what they have. The time zone, screen size and (to a certain extent) user-agent let you customise the content you serve in an appropriate way. Providing it "optionally" doesn't seem like a solution. If you were prompted every time then most people would turn it on anyway, and any ad network site would obviously ask for everything that it could possible get.

Silhouette 16y ago
Things like http_accept, plugin details and fonts are necessary if you want to use the capabilities of the client - you need to know what they have. I disagree rather strongly with sending things like user agent strings, plugins and fonts by default. There should be no need for a web site to know anything about either. Indeed, customising content to that degree based on specifics of the client's software identity rather than providing adaptive content seems somewhat anti-WWW to me. Moreover, given the number of plugins with security issues widely available for some browsers, sending a list of installed plugins and versions with every HTTP request is practically begging to get malware back if you're not 100% patched up (and even if you are, if you're unlucky with a 0-day exploit). Let me put it this way: most web sites that I've encountered actively modifying their content based on specific user agents have been places like banks, and usually the reason I know that they were doing this is because they got it wrong and consequently refused to serve perfectly good content to a browser perfectly capable of rendering it as intended because of concerns about some security flaws in browsers from another era. I'm not sure I have ever come across a web site that actively modifies the content it provides based on the browser plugins or fonts on the client system. Providing it "optionally" doesn't seem like a solution. If you were prompted every time then most people would turn it on anyway, and any ad network site would obviously ask for everything that it could possible get. On the contrary. I think people would very quickly tire of visiting sites whose ad networks caused such problems, and the ad networks would have to give up doing it or quality sites would drop them. Indeed, the only common uses for this kind of information today seem to be supporting user tracking or deployment of targeted malware from compromised sites. Providing the detailed information only to sites that explicitly request it and possibly only if the user's security settings permit would make life more difficult for both groups, and I have no problem with this outcome.

by omh 16y ago

Silhouette 16y ago

Things like http_accept, plugin details and fonts are necessary if you want to use the capabilities of the client - you need to know what they have. I disagree rather strongly with sending things like user agent strings, plugins and fonts by default. There should be no need for a web site to know anything about either. Indeed, customising content to that degree based on specifics of the client's software identity rather than providing adaptive content seems somewhat anti-WWW to me. Moreover, given the number of plugins with security issues widely available for some browsers, sending a list of installed plugins and versions with every HTTP request is practically begging to get malware back if you're not 100% patched up (and even if you are, if you're unlucky with a 0-day exploit). Let me put it this way: most web sites that I've encountered actively modifying their content based on specific user agents have been places like banks, and usually the reason I know that they were doing this is because they got it wrong and consequently refused to serve perfectly good content to a browser perfectly capable of rendering it as intended because of concerns about some security flaws in browsers from another era. I'm not sure I have ever come across a web site that actively modifies the content it provides based on the browser plugins or fonts on the client system. Providing it "optionally" doesn't seem like a solution. If you were prompted every time then most people would turn it on anyway, and any ad network site would obviously ask for everything that it could possible get. On the contrary. I think people would very quickly tire of visiting sites whose ad networks caused such problems, and the ad networks would have to give up doing it or quality sites would drop them. Indeed, the only common uses for this kind of information today seem to be supporting user tracking or deployment of targeted malware from compromised sites. Providing the detailed information only to sites that explicitly request it and possibly only if the user's security settings permit would make life more difficult for both groups, and I have no problem with this outcome.