3 ms·

If you change your user agent header to avoid blocking, and the blocking is to prevent some harm, however trivial, it’s not hard to fit that into the definition

If you change your user agent header to avoid blocking, and the blocking is to prevent some harm, however trivial, it’s not hard to fit that into the definition of fraud: misreprenting a fact that the hearer relied on and then was harmed by that reliance [1]. [1]: https://www.law.cornell.edu/wex/fraud https://www.law.cornell.edu/wex/fraud

snidane 5y ago
If you can twist the wording into a fraud, I can twist my words too. I don't 'change' user agent. There is no mandated default value. I 'set' it to a value that the service accepts. I don't set it to avoid blocking, I set it to be served a response. You seem to imply that some act of 'changing' a value results in a fraud. Nonsense. There is nothing like an open standard of authentication or identity without the service authenticating explicitly = there is no fraud. The only grey territory is if the requester denies service to others. There is a higher chance of that happening using a script or a bot, but it can equally happen if one hires a grandma to keep clicking all day. Or 1000 grandmas at a time.
- repiret 5y ago
  If you send the googlebot user agent, and you’re not googlebot, that’s misrepresenting a fact. Same if you use curl and send a Firefox user agent. That’s all a fraudster needs to do - if the hearer of misrepresentation relies on it and is harmed then it’s fraud. It doesn’t matter that the user agent is trivial to misrrpresent. Just because it’s trivial for me to phone someone up and tell them that I’m from Windows support and there’s a hold on their social security number and they need to wire me money to help get their grandson out of jail in Nigeria doesn’t make it not fraud if someone relies on those misrepresentations and is harmed by that reliance.
  - zarzavat 5y ago
    You could easily use Firefox as curl with a bit of scripting, then of course it would be using Firefox's user agent by default. There's no fraud because there is no difference between a browser user agent or a custom one. They both mean the same thing.
  - Jensson 5y ago
    So when Firefox says it is chrome you consider it fraud? The user agent is there make the server better support your request, it serves no other purpose. Servers blocking certain user agents are misusing the field.
  - snidane 5y ago
    So are then all browsers committing fraud when they put 'Mozilla' in the user agent despite not being Mozilla based?
skissane 5y ago
Suppose you have a batch job which does web scraping. The job accepts a parameter which tells it what User-Agent value to use. And you have a web page which launches the job. And that web page passes the User-Agent header from the incoming HTTP request as that job parameter. You call the web page using curl to scrape a site. The batch job sends a curl User-Agent to the site, and the site blocks the request. Next you try calling the web page using Google Chrome. This time the crawler batch job sends a Google Chrome User-Agent to the site, and the site allows the crawling to happen. Did you commit fraud in the above scenario? And at which step was the fraud committed?
matheusmoreira 5y ago
And what harm does a simple web scraping script cause?

snidane 5y ago

If you can twist the wording into a fraud, I can twist my words too. I don't 'change' user agent. There is no mandated default value. I 'set' it to a value that the service accepts. I don't set it to avoid blocking, I set it to be served a response. You seem to imply that some act of 'changing' a value results in a fraud. Nonsense. There is nothing like an open standard of authentication or identity without the service authenticating explicitly = there is no fraud. The only grey territory is if the requester denies service to others. There is a higher chance of that happening using a script or a bot, but it can equally happen if one hires a grandma to keep clicking all day. Or 1000 grandmas at a time.

repiret 5y ago
If you send the googlebot user agent, and you’re not googlebot, that’s misrepresenting a fact. Same if you use curl and send a Firefox user agent. That’s all a fraudster needs to do - if the hearer of misrepresentation relies on it and is harmed then it’s fraud. It doesn’t matter that the user agent is trivial to misrrpresent. Just because it’s trivial for me to phone someone up and tell them that I’m from Windows support and there’s a hold on their social security number and they need to wire me money to help get their grandson out of jail in Nigeria doesn’t make it not fraud if someone relies on those misrepresentations and is harmed by that reliance.
- zarzavat 5y ago
  You could easily use Firefox as curl with a bit of scripting, then of course it would be using Firefox's user agent by default. There's no fraud because there is no difference between a browser user agent or a custom one. They both mean the same thing.
- Jensson 5y ago
  So when Firefox says it is chrome you consider it fraud? The user agent is there make the server better support your request, it serves no other purpose. Servers blocking certain user agents are misusing the field.
- snidane 5y ago
  So are then all browsers committing fraud when they put 'Mozilla' in the user agent despite not being Mozilla based?

skissane 5y ago

Suppose you have a batch job which does web scraping. The job accepts a parameter which tells it what User-Agent value to use. And you have a web page which launches the job. And that web page passes the User-Agent header from the incoming HTTP request as that job parameter. You call the web page using curl to scrape a site. The batch job sends a curl User-Agent to the site, and the site blocks the request. Next you try calling the web page using Google Chrome. This time the crawler batch job sends a Google Chrome User-Agent to the site, and the site allows the crawling to happen. Did you commit fraud in the above scenario? And at which step was the fraud committed?

matheusmoreira 5y ago

And what harm does a simple web scraping script cause?