9 ms·

This makes sense since it should avoid two issues: - Sites that try to detect mobile by looking at "ARM" in user-agent string - Sites that try to parse the ma

by m45t3r 6y ago

This makes sense since it should avoid two issues: - Sites that try to detect mobile by looking at "ARM" in user-agent string - Sites that try to parse the macOS minor version for some reason and would be confused to see something like "11_0" BTW, user-agent is a hell anyway. Just looking at this user-agent that OP posted, macOS still identifies itself as "Mac OS X", still is based on Mozilla/5.0(!), still identifies itself as KHTML enginee (compatible with Gecko), and so on...

empyrical 6y ago
Also, whether a system is ARM or Intel could be used as another bit of entropy for fingerprinting.
- gruez 6y ago
  You can probably get the same information by looking at the webgl fingerprint, since the iGPU inside the A12Z is different than the ones used in Intel macs.
  - alerighi 6y ago
    It's more complex and requires to use JavaScript that you can block in the browser, while the user agent is always sent to the server on every request, and thus is much easier to fingerprint the user with that.
fluffything 6y ago
And doing this encourages websites that actually need to detect this platform properly to introduce the next generation of horrible things.
- dwaite 6y ago
  Browsers will almost certainly begin to phase out user agent strings anyway: https://www.zdnet.com/article/google-to-phase-out-user-agent-strings-in-chrome/ https://www.zdnet.com/article/google-to-phase-out-user-agent... . In the vast majority of use cases, these values should not be used to detect platform features - actual feature detection should be used instead.
  - kevin_thibedeau 6y ago
    They should just make a gentleman's agreement that the four majors will change it to name and version without any of the cruft. Every broken site will be quickly shamed into fixing their shit.
    - DaiPlusPlus 6y ago
      “Every broken site” will be internal enterprise web-applications that haven’t been touched in 15 years where they’ve also lost the source code.
      - kevin_thibedeau 6y ago
        They can slap a proxy on the front to change it back to what they need.
        saagarjha 6y ago
        That sounds like work. Which costs money.
        fluffything 6y ago
        They can just not update their browser - which is essentially doing "no work", and is free.
  - grishka 6y ago
    The replacement they're going with, "client hints", is weird in its own way. Suppose you render your website server-side, and suppose you use different templates for desktop and mobile. You then have to determine the kind you want before any response is sent, but the new method prevents you from doing that; you have to send a response to ask the browser to send the mobile flag in a subsequent request. You'd have to use ugly workarounds for that. One that comes to mind is to issue a redirect to the requested URL itself, but ask for the additional headers. Not optimal because it adds a round-trip and I'm not sure it'll work at all. User agent strings aren't pretty but they make this kind of detection extremely easy and straightforward. And "actual feature detection" doesn't work with SSR, like, at all.
- ryandrake 6y ago
  If there is a constant in the universe it's that developers will always be trying to detect X by querying for Y and then have their code break when those assumptions become wrong.
infogulch 6y ago
Oh my god can we please kill the user agent string already? Every time any new combination of browser/os/platform is created it claims that it's as some other user agent from an established browser because sites are lazy and abuse user agent string to determine capability. Meaning they have long lost all meaning and we should just dump them.
- olliej 6y ago
  Right? I mean we can’t kill it because everything currently exists would die. But the many attempts to freeze the existing UA are for the purpose of stopping people testing through the UA
- AnonC 6y ago
  > Oh my god can we please kill the user agent string already? Browser makers tried to do that by providing feature detection, but the weight of legacy code and developers already used to using the user agent strings has made killing it impossible. Edit: As pointed out in another comment here, it seems like Google is killing it (or planning to). [1] [1]: https://www.zdnet.com/article/google-to-phase-out-user-agent-strings-in-chrome/ https://www.zdnet.com/article/google-to-phase-out-user-agent...
mmis1000 6y ago
It is hell, but it is only way to workaround the hell tons of safari graphic bug. Because it only affect graphic, you can't really detect whether you are affected by it or not from js. The best thing you can do it guess the browser from user-agent and apply the workaround anyway. Or you can pray for the apple to fix their sh*t (given what they have done in the past, it is unlikely).
- sirn 6y ago
  I’m curious what is this graphic bug?
  - mmis1000 6y ago
    Something like the safari failed to draw some elements suddenly. JS reported it is there. Query the size with js do work. Select it with devtool works. The only thing not work is... the element is invisible. Hide and show the element again makes it show correctly. But how do I know whether it is bugged now without guest the browser from user-agent?
AnonC 6y ago
> BTW, user-agent is a hell anyway. Just looking at this user-agent that OP posted, macOS still identifies itself as "Mac OS X", still is based on Mozilla/5.0(!), still identifies itself as KHTML enginee (compatible with Gecko), and so on... This is why we have some more developers spending time on creating FOSS libraries that parse user agent strings and tell you exactly what the browser claims to be, with attributes like browser name, OS, version, browser engine, etc. All these libraries need updates (or at least a cursory look) whenever a new browser version is released so that they can continue identifying browsers correctly. All those people, bless them for this work, could be doing something else in an alternate universe. Notwithstanding feature detection and graceful downgrades, browser user agent strings seem to be very commonly used to decide the behavior of many websites.

by m45t3r 6y ago

empyrical 6y ago

Also, whether a system is ARM or Intel could be used as another bit of entropy for fingerprinting.

gruez 6y ago
You can probably get the same information by looking at the webgl fingerprint, since the iGPU inside the A12Z is different than the ones used in Intel macs.
- alerighi 6y ago
  It's more complex and requires to use JavaScript that you can block in the browser, while the user agent is always sent to the server on every request, and thus is much easier to fingerprint the user with that.

fluffything 6y ago

And doing this encourages websites that actually need to detect this platform properly to introduce the next generation of horrible things.

dwaite 6y ago
Browsers will almost certainly begin to phase out user agent strings anyway: https://www.zdnet.com/article/google-to-phase-out-user-agent-strings-in-chrome/ https://www.zdnet.com/article/google-to-phase-out-user-agent... . In the vast majority of use cases, these values should not be used to detect platform features - actual feature detection should be used instead.
- kevin_thibedeau 6y ago
  They should just make a gentleman's agreement that the four majors will change it to name and version without any of the cruft. Every broken site will be quickly shamed into fixing their shit.
  - DaiPlusPlus 6y ago
    “Every broken site” will be internal enterprise web-applications that haven’t been touched in 15 years where they’ve also lost the source code.
    - kevin_thibedeau 6y ago
      They can slap a proxy on the front to change it back to what they need.
      - saagarjha 6y ago
        That sounds like work. Which costs money.
        fluffything 6y ago
        They can just not update their browser - which is essentially doing "no work", and is free.
- grishka 6y ago
  The replacement they're going with, "client hints", is weird in its own way. Suppose you render your website server-side, and suppose you use different templates for desktop and mobile. You then have to determine the kind you want before any response is sent, but the new method prevents you from doing that; you have to send a response to ask the browser to send the mobile flag in a subsequent request. You'd have to use ugly workarounds for that. One that comes to mind is to issue a redirect to the requested URL itself, but ask for the additional headers. Not optimal because it adds a round-trip and I'm not sure it'll work at all. User agent strings aren't pretty but they make this kind of detection extremely easy and straightforward. And "actual feature detection" doesn't work with SSR, like, at all.
ryandrake 6y ago
If there is a constant in the universe it's that developers will always be trying to detect X by querying for Y and then have their code break when those assumptions become wrong.

infogulch 6y ago

Oh my god can we please kill the user agent string already? Every time any new combination of browser/os/platform is created it claims that it's as some other user agent from an established browser because sites are lazy and abuse user agent string to determine capability. Meaning they have long lost all meaning and we should just dump them.

olliej 6y ago
Right? I mean we can’t kill it because everything currently exists would die. But the many attempts to freeze the existing UA are for the purpose of stopping people testing through the UA
AnonC 6y ago
> Oh my god can we please kill the user agent string already? Browser makers tried to do that by providing feature detection, but the weight of legacy code and developers already used to using the user agent strings has made killing it impossible. Edit: As pointed out in another comment here, it seems like Google is killing it (or planning to). [1] [1]: https://www.zdnet.com/article/google-to-phase-out-user-agent-strings-in-chrome/ https://www.zdnet.com/article/google-to-phase-out-user-agent...

mmis1000 6y ago

It is hell, but it is only way to workaround the hell tons of safari graphic bug. Because it only affect graphic, you can't really detect whether you are affected by it or not from js. The best thing you can do it guess the browser from user-agent and apply the workaround anyway. Or you can pray for the apple to fix their sh*t (given what they have done in the past, it is unlikely).

sirn 6y ago
I’m curious what is this graphic bug?
- mmis1000 6y ago
  Something like the safari failed to draw some elements suddenly. JS reported it is there. Query the size with js do work. Select it with devtool works. The only thing not work is... the element is invisible. Hide and show the element again makes it show correctly. But how do I know whether it is bugged now without guest the browser from user-agent?

AnonC 6y ago

> BTW, user-agent is a hell anyway. Just looking at this user-agent that OP posted, macOS still identifies itself as "Mac OS X", still is based on Mozilla/5.0(!), still identifies itself as KHTML enginee (compatible with Gecko), and so on... This is why we have some more developers spending time on creating FOSS libraries that parse user agent strings and tell you exactly what the browser claims to be, with attributes like browser name, OS, version, browser engine, etc. All these libraries need updates (or at least a cursory look) whenever a new browser version is released so that they can continue identifying browsers correctly. All those people, bless them for this work, could be doing something else in an alternate universe. Notwithstanding feature detection and graceful downgrades, browser user agent strings seem to be very commonly used to decide the behavior of many websites.