3 ms·

In all seriousness can we please replace the user agent, and add a new header that is meant to supersede it. We can then freeze the current user agent at v99 wi

In all seriousness can we please replace the user agent, and add a new header that is meant to supersede it. We can then freeze the current user agent at v99 with all the other rubbish that's still in it and put real correct date in a standard format in a new header. I know there are arguments that a new version will be abused just as much, but I think we should be able to find ways to elevate that by, for example, limiting the length of different fields so doubling up of information to mask the truth or detect as two different browsers isn't possible. We could even design this new system specifically to be fingerprint proof, just report the essentials which is pretty much just the browser engine (webkit/blink/gecko) and version. don't even need the actual browser and os.

hoten 5y ago
It's called Sec-CH-UA.
- samwillis 5y ago
  This seems very overly engineered, I was thinking something far simpler and much more limited with no negotiation. I can see the use case for this. Maybe in parallel with a simpler header. https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hints https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hin...
  - hoten 5y ago
    I encourage you to review the decision making and engage in the discussion here: https://github.com/WICG/ua-client-hints https://github.com/WICG/ua-client-hints
    - samwillis 5y ago
      Thank you for the pointer. I will happily read up on the thought process.
capableweb 5y ago
Everyone knows it's so easy to migrate a HTTP header that has been in use since basically forever (in internet time). It'll never be possible to completely change it to something else, just imagine all the software that assumes that header to be there. And for in-browser stuff (via JS), you already have an alternative that works perfectly fine, `window.navigator`, that looks something like this: { "permissions": {}, "mimeTypes": {}, "plugins": {}, "doNotTrack": "unspecified", "maxTouchPoints": 0, "mediaCapabilities": {}, "oscpu": "Linux x86_64", "vendor": "", "vendorSub": "", "productSub": "20100101", "cookieEnabled": true, "buildID": "20181001000000", "mediaDevices": {}, "serviceWorker": {}, "credentials": {}, "clipboard": {}, "mediaSession": {}, "webdriver": false, "hardwareConcurrency": 8, "geolocation": {}, "appCodeName": "Mozilla", "appName": "Netscape", "appVersion": "5.0 (X11)", "platform": "Linux x86_64", "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:97.0) Gecko/20100101 Firefox/97.0", "product": "Gecko", "language": "en-US", "languages": [ "en-US", "en" ], "locks": {}, "onLine": true, "storage": {} } Or is there something else you're missing from window.navigator?
- olex 5y ago
  Looking at this, the actually useful information is still heavily obscured and hides in the same "userAgent" string - the "Firefox/97.0" at the end. One would expect this information to be in appName, appCodeName and appVersion by semantics - but those fields are useless, arguably misleading, with "Netscape" having seized to exist a long time ago.
- littlestymaar 5y ago
  "appName": "Netscape", "appVersion": "5.0 (X11)", So, without checking the user agent string, window.navigator basically tells me that this browser is Netscape 5.0. How is that helpful?
- thealig 5y ago
  think there should be a separate 'browserVersion' field that is numeric which should be checked. then again, browsers are such complex beasts with multiple components mixed and matched together by different vendors, it would be great to have separate user agent component fields for those.
detaro 5y ago
that's what https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hints https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hin... aim to do over time.

hoten 5y ago

It's called Sec-CH-UA.

samwillis 5y ago
This seems very overly engineered, I was thinking something far simpler and much more limited with no negotiation. I can see the use case for this. Maybe in parallel with a simpler header. https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hints https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hin...
- hoten 5y ago
  I encourage you to review the decision making and engage in the discussion here: https://github.com/WICG/ua-client-hints https://github.com/WICG/ua-client-hints
  - samwillis 5y ago
    Thank you for the pointer. I will happily read up on the thought process.

capableweb 5y ago

Everyone knows it's so easy to migrate a HTTP header that has been in use since basically forever (in internet time). It'll never be possible to completely change it to something else, just imagine all the software that assumes that header to be there. And for in-browser stuff (via JS), you already have an alternative that works perfectly fine, `window.navigator`, that looks something like this: { "permissions": {}, "mimeTypes": {}, "plugins": {}, "doNotTrack": "unspecified", "maxTouchPoints": 0, "mediaCapabilities": {}, "oscpu": "Linux x86_64", "vendor": "", "vendorSub": "", "productSub": "20100101", "cookieEnabled": true, "buildID": "20181001000000", "mediaDevices": {}, "serviceWorker": {}, "credentials": {}, "clipboard": {}, "mediaSession": {}, "webdriver": false, "hardwareConcurrency": 8, "geolocation": {}, "appCodeName": "Mozilla", "appName": "Netscape", "appVersion": "5.0 (X11)", "platform": "Linux x86_64", "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:97.0) Gecko/20100101 Firefox/97.0", "product": "Gecko", "language": "en-US", "languages": [ "en-US", "en" ], "locks": {}, "onLine": true, "storage": {} } Or is there something else you're missing from window.navigator?

olex 5y ago
Looking at this, the actually useful information is still heavily obscured and hides in the same "userAgent" string - the "Firefox/97.0" at the end. One would expect this information to be in appName, appCodeName and appVersion by semantics - but those fields are useless, arguably misleading, with "Netscape" having seized to exist a long time ago.
littlestymaar 5y ago
"appName": "Netscape", "appVersion": "5.0 (X11)", So, without checking the user agent string, window.navigator basically tells me that this browser is Netscape 5.0. How is that helpful?
thealig 5y ago
think there should be a separate 'browserVersion' field that is numeric which should be checked. then again, browsers are such complex beasts with multiple components mixed and matched together by different vendors, it would be great to have separate user agent component fields for those.

detaro 5y ago

that's what https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hints https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hin... aim to do over time.