5 ms·

Can we take a moment to appreciate how obtuse UA strings are? I mean really, the user agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gec

Can we take a moment to appreciate how obtuse UA strings are? I mean really, the user agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.99 Safari/537.36 Vivaldi/2.9.1705.41 is almost laughable for a strange collection of historical reasons. The history of UA strings has come up before here: https://news.ycombinator.com/item?id=16525559 https://news.ycombinator.com/item?id=16525559 When is a browser going to just ditch the cruft and present something sensible?

naniwaduni 7y ago
Let's take a look at Firefox! Mozilla/5.0 (X11; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 Only, er, half of the version numbers are lies...
- NullPrefix 7y ago
  Are you on Wayland?
JoshTriplett 7y ago
I wonder if it'd be too late for http/3 to say "user-agent is deprecated, user-agents should not send it, any server accepting http/3 may assume the following compatibility value for the header without it being sent". Was anything like that considered during the http/3 design process? (I saw the linked "client hints" proposal in the article, but that doesn't mention the idea of completely dropping the header from client requests and assuming a certain baseline value for http/3.)
- toast0 7y ago
  User-Agent for browsers is pretty much useless now, but it's still a pretty useful name for a header if you want to put real information in it. Ex, if you're calling an api, it's nice to have a version number and a name/contact so broken things can be fixed. I don't remember if HTTP/2 (and presumably /3) has a initial dictionary for header compression, they could have a suggested value in there, so if you want to look like a browser, you can use that at a low byte cost.
  - edoceo 7y ago
    I make an API, for narrow use case. All calls have to be from a registered UA, among other things forms the HMAC sig.
    - sk5t 7y ago
      You have created a perverse-sounding design.
    - neikos 7y ago
      This sounds like authentication with extra steps? Why not just send a bearer token?
      - edoceo 7y ago
        We do. Header is for message signing. And UA has to be registered, part of the spec provided by client.
- denormalfloat 7y ago
  This would not work, too many websites (perhaps wrongly) depend on this string.
  - JoshTriplett 7y ago
    I'm specifically suggesting that http/3 could have an implied value for this header if not supplied, so that omitting it was semantically equivalent (and a server could synthesize it).
    - denormalfloat 7y ago
      That's not how HTTP works. HTTP is a transfer protocol, and is not so opinionated on the semantic meaning of the Data it moves. HTTP, HTTP/2, and HTTP/3 were designed to be backwards compatible. It would break that compatibility if there were a semantic change in the absence of the UA string. Specifically, H/3 requests couldn't be downgraded to HTTP/1.1 requests by proxies. There are a lot of proxies.
      - JoshTriplett 7y ago
        > It would break that compatibility if there were a semantic change in the absence of the UA string. Specifically, H/3 requests couldn't be downgraded to HTTP/1.1 requests by proxies. It would not reduce the semantic meaning of HTTP to say "in http/3, the default value of the user-agent header is XYZ (a non-specific modern browser), and if you want an empty header, you must specify the header with an empty value. Proxies and other software translating requests between http/3 and older versions of http should map an omitted header in http/3 to this value, and should map an empty string to a missing header." It would certainly require change, and it isn't a change likely to happen at this point, but it wouldn't have been impossible, nor would it have reduced the fidelity of http. It simply would have changed the default assumption from "something too ancient to identify itself" to "something modern that doesn't want to identify itself".
bowmessage 7y ago
From the article, there is this recent proposal for "UA-hints": https://github.com/WICG/ua-client-hints https://github.com/WICG/ua-client-hints
tropo 7y ago
Every browser has to act together, or the ones that don't will win due to better compatibility. The obvious way to make that happen is a law. Just prohibit the user agent string from being sent, starting with browsers that are distributed after a certain date. Perhaps a bit of voluntary cooperation is possible. It worked for webassembly.
- friendly_fren 7y ago
  That's insane to propose the government should regulate http headers. What happened to freedom of speech?
  - gruez 7y ago
    >What happened to freedom of speech? Deceptive speech is regularly curtailed by the government (eg. fraud, deceptive advertising)
    - speedplane 7y ago
      >> What happened to freedom of speech? > Deceptive speech is regularly curtailed by the government (eg. fraud, deceptive advertising) Is spoofing a User-Agent string really deceptive speech? It's just asking a server to return a web-page in the same format as a specific browser... somewhat like asking a salesperson to give you the same price they give everyone else.
    - lukifer 7y ago
      Only a small subset of deceptive speech; it’s perfectly legal to lie about who you voted for, or that you like someone’s haircut. Plausible deniability (my browser is Chrome, I swear) is potentially a means for individual autonomy and counteracting the misuse of power.
  - tuwtuwtuwtuw 7y ago
    While I agree with your first sentence, freedom of speech doesn't have anything to do with HTTP headers.
  - 7y ago
onion2k 7y ago
When is a browser going to just ditch the cruft and present something sensible? Better still, ditch the UA string entirely. The only thing that will force website developers to write cross-browser compatible progressively enhanced websites and apps is being forced to detect features and test in all browsers instead of just whitelisting Chrome based on the User Agent. User Agent strings are bad for the web.

naniwaduni 7y ago

Let's take a look at Firefox! Mozilla/5.0 (X11; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 Only, er, half of the version numbers are lies...

NullPrefix 7y ago
Are you on Wayland?

JoshTriplett 7y ago

I wonder if it'd be too late for http/3 to say "user-agent is deprecated, user-agents should not send it, any server accepting http/3 may assume the following compatibility value for the header without it being sent". Was anything like that considered during the http/3 design process? (I saw the linked "client hints" proposal in the article, but that doesn't mention the idea of completely dropping the header from client requests and assuming a certain baseline value for http/3.)

toast0 7y ago
User-Agent for browsers is pretty much useless now, but it's still a pretty useful name for a header if you want to put real information in it. Ex, if you're calling an api, it's nice to have a version number and a name/contact so broken things can be fixed. I don't remember if HTTP/2 (and presumably /3) has a initial dictionary for header compression, they could have a suggested value in there, so if you want to look like a browser, you can use that at a low byte cost.
- edoceo 7y ago
  I make an API, for narrow use case. All calls have to be from a registered UA, among other things forms the HMAC sig.
  - sk5t 7y ago
    You have created a perverse-sounding design.
  - neikos 7y ago
    This sounds like authentication with extra steps? Why not just send a bearer token?
    - edoceo 7y ago
      We do. Header is for message signing. And UA has to be registered, part of the spec provided by client.
denormalfloat 7y ago
This would not work, too many websites (perhaps wrongly) depend on this string.
- JoshTriplett 7y ago
  I'm specifically suggesting that http/3 could have an implied value for this header if not supplied, so that omitting it was semantically equivalent (and a server could synthesize it).
  - denormalfloat 7y ago
    That's not how HTTP works. HTTP is a transfer protocol, and is not so opinionated on the semantic meaning of the Data it moves. HTTP, HTTP/2, and HTTP/3 were designed to be backwards compatible. It would break that compatibility if there were a semantic change in the absence of the UA string. Specifically, H/3 requests couldn't be downgraded to HTTP/1.1 requests by proxies. There are a lot of proxies.
    - JoshTriplett 7y ago
      > It would break that compatibility if there were a semantic change in the absence of the UA string. Specifically, H/3 requests couldn't be downgraded to HTTP/1.1 requests by proxies. It would not reduce the semantic meaning of HTTP to say "in http/3, the default value of the user-agent header is XYZ (a non-specific modern browser), and if you want an empty header, you must specify the header with an empty value. Proxies and other software translating requests between http/3 and older versions of http should map an omitted header in http/3 to this value, and should map an empty string to a missing header." It would certainly require change, and it isn't a change likely to happen at this point, but it wouldn't have been impossible, nor would it have reduced the fidelity of http. It simply would have changed the default assumption from "something too ancient to identify itself" to "something modern that doesn't want to identify itself".

bowmessage 7y ago

From the article, there is this recent proposal for "UA-hints": https://github.com/WICG/ua-client-hints https://github.com/WICG/ua-client-hints

tropo 7y ago

Every browser has to act together, or the ones that don't will win due to better compatibility. The obvious way to make that happen is a law. Just prohibit the user agent string from being sent, starting with browsers that are distributed after a certain date. Perhaps a bit of voluntary cooperation is possible. It worked for webassembly.

friendly_fren 7y ago
That's insane to propose the government should regulate http headers. What happened to freedom of speech?
- gruez 7y ago
  >What happened to freedom of speech? Deceptive speech is regularly curtailed by the government (eg. fraud, deceptive advertising)
  - speedplane 7y ago
    >> What happened to freedom of speech? > Deceptive speech is regularly curtailed by the government (eg. fraud, deceptive advertising) Is spoofing a User-Agent string really deceptive speech? It's just asking a server to return a web-page in the same format as a specific browser... somewhat like asking a salesperson to give you the same price they give everyone else.
  - lukifer 7y ago
    Only a small subset of deceptive speech; it’s perfectly legal to lie about who you voted for, or that you like someone’s haircut. Plausible deniability (my browser is Chrome, I swear) is potentially a means for individual autonomy and counteracting the misuse of power.
- tuwtuwtuwtuw 7y ago
  While I agree with your first sentence, freedom of speech doesn't have anything to do with HTTP headers.
- 7y ago

onion2k 7y ago

When is a browser going to just ditch the cruft and present something sensible? Better still, ditch the UA string entirely. The only thing that will force website developers to write cross-browser compatible progressively enhanced websites and apps is being forced to detect features and test in all browsers instead of just whitelisting Chrome based on the User Agent. User Agent strings are bad for the web.