4 ms·

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After l

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this. I posted my search for the cause of this issue on StackOverflow¹, and even got a reply from (presumably) someone who works for the company that hosts these websites, but alas, the websites remain broken to this day. They suspected a hack to prevent some WordPress exploit… It's frustrating, because a general practitioner's website should not fail like this (it is a point of contact that sits just below emergency services), but the people that work there don't understand the problem, and the company that hosts is can't be arsed to fix the issue. 1: https://stackoverflow.com/questions/66185885/some-websites-return-a-forbidden-response-only-in-firefox-on-linux-changing-the https://stackoverflow.com/questions/66185885/some-websites-r...

lmilcin 5y ago
> After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this. Haha! Never attribute malice when a simple incompetence would explain it!
- makeitdouble 5y ago
  This is not straight incompetence though, as that config is not there by accident. It’s more in line with “screw that 1 per 1000 users”, for whatever reason. Malice might be too strong of a word, disdain could be closer to what we are seeing.
  - Freak_NL 5y ago
    I would guess it was more in the line of not suspecting that it was a valid user-agent string; just one used by bots.
    - AnimalMuppet 5y ago
      "No True Human..."
    - makeitdouble 5y ago
      Not even checking what matches that user-agent would be a deeper level of “screw it”. You’d google what you’re banning before banning it.
hypeatei 5y ago
Yeah, it's amazing how short sighted some developers and sysadmins can be when tasked with solving a problem. Oh, we have a WordPress exploit? Let's blacklist User Agent strings!
JshWright 5y ago
If you're in the US, call your doc and mention that this may be a violation of the 21st Century Cures Act, as it is preventing or interfering with the access, exchange, or use of electronic health information. It would be a stretch to call this an outright violation (as they could satisfy the requirement by printing the information you want and mailing it to you...), but it's a trendy topic in healthcare right now, so it might be enough of a motivator.
- JumpCrisscross 5y ago
  > call your doc and mention that this may be a violation of the 21st Century Cures Act Unless you’re a lawyer, don’t do this. Empty threats are more frequently sorted into the crackpot category than the kind one responds to.
  - JshWright 5y ago
    While this is generally true, in my experience anything related to healthcare regulations are a lot less likely to get written off. Generally the failure mode is quite the opposite (people assume all sorts of things about, e.g. HIPAA, that aren't true). EDIT: I also wouldn't characterize it as an "empty threat", as it is neither empty (I think a good faith argument could be made that this needlessly disrupts patient access to information), nor a threat (it's just making them aware of something).
  - pyuser583 5y ago
    More realistically, they’ll refer you to their lawyer.
Neil44 5y ago
I host a few hundred wordpress sites and I recognise that string by sight! Tons of bots seem to use it. I haven’t 403’d it (yet) though.
- deleted 5y ago
  [deleted]
lupire 5y ago
The reaponse to that is to play dumb and repeatedly report yhar the website is failing, but don't try to diagnose it for them. Just focus on your problem, and keep annoying them so that it's their problem too (write a script to email occasionally, and share it with your friends). Eventually they and other customers will complain to the website vendor to make it their problem too.
- tentacleuno 5y ago
  Your comment seems to be dead (along with the last four of yours) which suggests you might be shadow banned? I vouched for you, hope it helps.
Freak_NL 5y ago
One happy addendum: Seeing this topic on HN reminded me to try to and contact the website builder again, and this time they did get their hosting party to fix the problem. The explanation as passed on to me was: > There was a bit in the htaccess that was there since 2019, we don't know why.

lmilcin 5y ago

> After I saw the same error with some other websites for businesses in my town I started seeing a pattern. The company that hosts/builds this website apparently copy/pastes their basic server set up, and so every website they host works everywhere, except when using Firefox on Linux. So maybe one in a thousand users gets this. Haha! Never attribute malice when a simple incompetence would explain it!

makeitdouble 5y ago
This is not straight incompetence though, as that config is not there by accident. It’s more in line with “screw that 1 per 1000 users”, for whatever reason. Malice might be too strong of a word, disdain could be closer to what we are seeing.
- Freak_NL 5y ago
  I would guess it was more in the line of not suspecting that it was a valid user-agent string; just one used by bots.
  - AnimalMuppet 5y ago
    "No True Human..."
  - makeitdouble 5y ago
    Not even checking what matches that user-agent would be a deeper level of “screw it”. You’d google what you’re banning before banning it.

hypeatei 5y ago

Yeah, it's amazing how short sighted some developers and sysadmins can be when tasked with solving a problem. Oh, we have a WordPress exploit? Let's blacklist User Agent strings!

JshWright 5y ago

If you're in the US, call your doc and mention that this may be a violation of the 21st Century Cures Act, as it is preventing or interfering with the access, exchange, or use of electronic health information. It would be a stretch to call this an outright violation (as they could satisfy the requirement by printing the information you want and mailing it to you...), but it's a trendy topic in healthcare right now, so it might be enough of a motivator.

JumpCrisscross 5y ago
> call your doc and mention that this may be a violation of the 21st Century Cures Act Unless you’re a lawyer, don’t do this. Empty threats are more frequently sorted into the crackpot category than the kind one responds to.
- JshWright 5y ago
  While this is generally true, in my experience anything related to healthcare regulations are a lot less likely to get written off. Generally the failure mode is quite the opposite (people assume all sorts of things about, e.g. HIPAA, that aren't true). EDIT: I also wouldn't characterize it as an "empty threat", as it is neither empty (I think a good faith argument could be made that this needlessly disrupts patient access to information), nor a threat (it's just making them aware of something).
- pyuser583 5y ago
  More realistically, they’ll refer you to their lawyer.

Neil44 5y ago

I host a few hundred wordpress sites and I recognise that string by sight! Tons of bots seem to use it. I haven’t 403’d it (yet) though.

deleted 5y ago
[deleted]

lupire 5y ago

The reaponse to that is to play dumb and repeatedly report yhar the website is failing, but don't try to diagnose it for them. Just focus on your problem, and keep annoying them so that it's their problem too (write a script to email occasionally, and share it with your friends). Eventually they and other customers will complain to the website vendor to make it their problem too.

tentacleuno 5y ago
Your comment seems to be dead (along with the last four of yours) which suggests you might be shadow banned? I vouched for you, hope it helps.

Freak_NL 5y ago

One happy addendum: Seeing this topic on HN reminded me to try to and contact the website builder again, and this time they did get their hosting party to fix the problem. The explanation as passed on to me was: > There was a bit in the htaccess that was there since 2019, we don't know why.