5 ms·

Congratulations Google, you did it! You killed the User-Agent header. The HTML spec already requires all browsers to report themselves as Netscape in the Netsc

by pornel 7y ago

Congratulations Google, you did it! You killed the User-Agent header. The HTML spec already requires all browsers to report themselves as Netscape in the Netscape-era `navigator` object: appCodeName - Must return the string "Mozilla". appName - Must return the string "Netscape". product - Must return the string "Gecko". So a few more "oopses" from Google products and the next spec will end up saying: User-Agent - Must be equal to the string "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79"

chrismorgan 7y ago
For reference, https://html.spec.whatwg.org/multipage/system-state.html#client-identification https://html.spec.whatwg.org/multipage/system-state.html#cli.... Browsers are essentially required to pretend to be Firefox from 2010, or Chrome from 2003 (!), or Safari from 2003—all while pretending to be Firefox or its predecessor in a couple of other ways. I find it very amusing.
- naniwaduni 7y ago
  Some context: 20030107 is Safari's first public release date.
- kccqzy 7y ago
  Chrome didn't exist in 2003. The year 2003 is because Safari existed then, but Google forked WebKit later on.
- bryanrasmussen 7y ago
  this reads like an April 1st spec, "The taintEnabled() method must return false" - hur hur hur.
bowmessage 7y ago
Interesting perspective; one could argue that the creators of non-web-standards-compliant browsers are really to blame here, forcing webdevs to branch / gate so often on the UA header. Agreed that it is really becoming dead, though.
- gbear605 7y ago
  The whole point of the article is that a number of sites (Google, Facebook, Netflix) are returning invalid sites because the browser is Vivaldi, not to make the site work with Vivaldi, but to make Vivaldi not work. It’s entirely the developer’s fault, not the browser’s.
  - bowmessage 7y ago
    Sure, but developers were forced down this path due to IE6 et. al. not respecting an open-standards-compliant grammar for HTML, JS, etc.
    - GoblinSlayer 7y ago
      What you can't do on IE6 without user agent sniffing?
TylerE 7y ago
As soon as you trust the client, it's game over. Period.
- eru 7y ago
  There's more than one kind of trust. You should totally trust your client to show stuff to the user. And you can generally trust your client when giving you user data, in the sense that you can trust that the data came from the user. (Unless the client is hacked by third-parties or buggy.) Basically, you can trust your client as much as you can trust your user. Not more.
ErikAugust 7y ago
Obligatory: https://groups.google.com/forum/m/#!msg/comp.lang.java/aSPAJO05LIU/ushhUIQQ-ogJ https://groups.google.com/forum/m/#!msg/comp.lang.java/aSPAJ...
stickfigure 7y ago
the next spec will end up saying...Must be equal to the string... This is exactly the right way to solve the problem. The UA header isn't going away because of Legacy. Pin it to an arbitrary generally accepted value and be done with it. The best part about this is that any client-side developer can implement this solution unilaterally... and Vivaldi now has.
- stephenr 7y ago
  Assuming that the problem here is people doing UA sniffing, the problem, like with people doing glue sniffing, is to stop people sniffing the UA (or glue) - not to make the UA (or glue) unusable for it's intended purpose. Have you ever used a service that shows things like your active sessions, login attempts etc? Notice how they basically all show you what kind of device and usually what browser the session/login is from, with a date time and usually location? If everyone pretends to be Chrome what's the fucking point any more? "You logged in from Chrome on Tuesday the 3rd at 8am". "Well no I fucking didn't, I guess I better go reset my damn passwords again".
  - denormalfloat 7y ago
    There are wrong reasons to sniff the UA string, and less wrong reasons. If a Browser has a bug that gets fixed in later versions, sites have to sniff the UA string to do the right thing. For example, a browser bug may cause people to see an error, and the they are using an old version of the browser. The right thing to do is to upgrade, but how to tell? When you are subject to the bugs of some other code, and which are skewed across different versions of the software, the most reasonable way to work around it is by UA sniffing.
    - zeta0134 7y ago
      I would have bought this argument a decade ago, but at this stage the number of site users not doing some form of automatic updates on their browser should be in the minority. The problems user agents were designed to solve back in the Netscape Navigator days have since been standardized using much better signals, and the odd standards compliance bug here and there isn't really justification for something as weak and unreliable as a user agent string. I say kill it. Fix it to some static value and require new sites moving forward to do proper feature detection if they really care to work around standards bugs or use experimental new features.

by pornel 7y ago

chrismorgan 7y ago

For reference, https://html.spec.whatwg.org/multipage/system-state.html#client-identification https://html.spec.whatwg.org/multipage/system-state.html#cli.... Browsers are essentially required to pretend to be Firefox from 2010, or Chrome from 2003 (!), or Safari from 2003—all while pretending to be Firefox or its predecessor in a couple of other ways. I find it very amusing.

naniwaduni 7y ago
Some context: 20030107 is Safari's first public release date.
kccqzy 7y ago
Chrome didn't exist in 2003. The year 2003 is because Safari existed then, but Google forked WebKit later on.
bryanrasmussen 7y ago
this reads like an April 1st spec, "The taintEnabled() method must return false" - hur hur hur.

bowmessage 7y ago

Interesting perspective; one could argue that the creators of non-web-standards-compliant browsers are really to blame here, forcing webdevs to branch / gate so often on the UA header. Agreed that it is really becoming dead, though.

gbear605 7y ago
The whole point of the article is that a number of sites (Google, Facebook, Netflix) are returning invalid sites because the browser is Vivaldi, not to make the site work with Vivaldi, but to make Vivaldi not work. It’s entirely the developer’s fault, not the browser’s.
- bowmessage 7y ago
  Sure, but developers were forced down this path due to IE6 et. al. not respecting an open-standards-compliant grammar for HTML, JS, etc.
  - GoblinSlayer 7y ago
    What you can't do on IE6 without user agent sniffing?

TylerE 7y ago

As soon as you trust the client, it's game over. Period.

eru 7y ago
There's more than one kind of trust. You should totally trust your client to show stuff to the user. And you can generally trust your client when giving you user data, in the sense that you can trust that the data came from the user. (Unless the client is hacked by third-parties or buggy.) Basically, you can trust your client as much as you can trust your user. Not more.

ErikAugust 7y ago

Obligatory: https://groups.google.com/forum/m/#!msg/comp.lang.java/aSPAJO05LIU/ushhUIQQ-ogJ https://groups.google.com/forum/m/#!msg/comp.lang.java/aSPAJ...

stickfigure 7y ago

the next spec will end up saying...Must be equal to the string... This is exactly the right way to solve the problem. The UA header isn't going away because of Legacy. Pin it to an arbitrary generally accepted value and be done with it. The best part about this is that any client-side developer can implement this solution unilaterally... and Vivaldi now has.

stephenr 7y ago
Assuming that the problem here is people doing UA sniffing, the problem, like with people doing glue sniffing, is to stop people sniffing the UA (or glue) - not to make the UA (or glue) unusable for it's intended purpose. Have you ever used a service that shows things like your active sessions, login attempts etc? Notice how they basically all show you what kind of device and usually what browser the session/login is from, with a date time and usually location? If everyone pretends to be Chrome what's the fucking point any more? "You logged in from Chrome on Tuesday the 3rd at 8am". "Well no I fucking didn't, I guess I better go reset my damn passwords again".
- denormalfloat 7y ago
  There are wrong reasons to sniff the UA string, and less wrong reasons. If a Browser has a bug that gets fixed in later versions, sites have to sniff the UA string to do the right thing. For example, a browser bug may cause people to see an error, and the they are using an old version of the browser. The right thing to do is to upgrade, but how to tell? When you are subject to the bugs of some other code, and which are skewed across different versions of the software, the most reasonable way to work around it is by UA sniffing.
  - zeta0134 7y ago
    I would have bought this argument a decade ago, but at this stage the number of site users not doing some form of automatic updates on their browser should be in the minority. The problems user agents were designed to solve back in the Netscape Navigator days have since been standardized using much better signals, and the odd standards compliance bug here and there isn't really justification for something as weak and unreliable as a user agent string. I say kill it. Fix it to some static value and require new sites moving forward to do proper feature detection if they really care to work around standards bugs or use experimental new features.