17 ms·
The IE 11 user-agent forced Mozilla to freeze part of its user-agent string
- benj111 4y agoI get this warning for TSB in the UK. I was wondering why, despite having the latest version.
- Spivak 4y agoThe more this happens the more Chrome deciding to freeze the UA string forever makes sense.
- LightHugger 4y agoIt's not a bad idea for security either, as a way to combat fingerprinting efforts.
- Nextgrid 4y agoWhich is also exactly why it ended up being reverted.
- PenguinCoder 4y agoUser agent strings aren't reliable for fingerprinting users or devices already. Shouldn't be using them as high fidelity IOCs. But yeah, some still do. Much better ways to fingerprint users or devices on HTTP/websites.
- deleted 4y ago[deleted]
- ape4 4y agoLooks like that's been replace by "Reduce User-Agent request header Reduce (formerly, "freeze") the amount of information available in the User-Agent request header. See https://www.chromium.org/updates/ua-reduction https://www.chromium.org/updates/ua-reduction for more info. – Mac, Windows, Linux, ChromeOS, Android, Fuchsia, Lacros #reduce-user-agent"
- chungy 4y agoWhat? Since when? I just checked with useragentstring.com and the UA reports the same version I'm actually using.
- Hamuko 4y agoI was under the impression that the User-Agent is kinda on its way out anyways.
- Dalewyn 4y agoPerhaps reflective of the times. A browser becomes less and less an agent of the user with each passing day.
- olliej 4y agoYeah, all browser developers have tried to essentially freeze the UA, if nothing else to stop keying site behaviour off random subsets of it. For example here is my UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15 Which is all sorts of frozen (old os version, intel on an arm device, etc)
- pwdisswordfish9 4y ago[flagged]
- kevin_thibedeau 4y agoIt's anything that communicates via HTTP. A WebDAV file manager isn't a web browser. It's still a user agent.
- pwdisswordfish9 4y ago[flagged]
- jchw 4y agoNope. A web browser browsers the world wide web. A WebDAV file browser just speaks HTTP. No hypertext, no web. edit: Wow, it's not really that complicated. Please take a moment to stop taking a crowbar to each and every crack and crevice of this argument. It's not about hypertext specifically, or hypermedia, or HTTP, or HTML, that's missing the point. The point is, a web browser is software that browses websites. A WebDAV browser browses WebDAV. WebDAV is built on web technology and can be used inside a web browser, but it is no more "the web" than anything else. A WebDAV file browser is absolutely no more a web browser than the Deno JavaScript runtime is. I can't browse HN with a WebDAV browser, or Deno. Speaking HTTP does not make you a web browser.
- TylerE 4y ago[flagged]
- None4U 4y agoIf I download a Debian .iso using HTTP, is that hypertext? How about updating my system using `apt`?
- gruez 4y agoIt's called that, but the program in question doesn't understand it. The fact that the protocol's name contains "hypertext" is irrelevant, just as using http to download a .zip file doesn't make that file a "hypertext".
- zitterbewegung 4y agoAre they talking about only MacBook Pros with Intel chips since they reference Butterfly keyboards or is that sarcasm that sort of feels out of place ?
- eyelidlessness 4y agoI strongly suspect they’re referring to the aspects of the UA string specific to their own device. I.e. they used an MBP (whose vintage can be intuited from its notorious keyboard problems and) which has evidently stopped receiving OS updates past 10.15. Edit to add: I also suspect they thought this was a clever way to avoid some nerd inevitably chiding them to upgrade their OS, but it’s probably too clever to achieve that.
- auscompgeek 4y agoMozilla froze the macOS version in User-Agent strings past Catalina too, also due to web compatibility issues (particularly with older versions of the Unity game engine). Other engines do the same as well: https://www.otsukare.info/2021/02/15/capping-macos-user-agent https://www.otsukare.info/2021/02/15/capping-macos-user-agen...
- eyelidlessness 4y agoI welcome any correction or explanation for why my comment was unhelpful.
- mrweasel 4y agoThat honestly seemed a little unnecessary and made the whole thing confusing. I read it as: "This is only an issue on a MacBook, assuming that your s key sticks and the date is December 29th, 2022". I suspect that the only part of that which is true is that the bug only occurs on macOS. The date or a sticky s keys isn't a prerequisite. What would be more interesting is: Why isn't this an issue on Windows?
- jrochkind1 4y agoIn retrospect, wasn't putting "Mozilla" in your user-agent string when you aren't the Mozilla Foundation or project a trademark violation, that they could have enforced?
- Dylan16807 4y agoNot when it's for compatibility and talking to a machine.
- rmccue 4y agoThe use of “Mozilla” I believe predates the Mozilla Foundation, as it was from Netscape’s user agent string before it was spun out. https://webaim.org/blog/user-agent-string-history/ https://webaim.org/blog/user-agent-string-history/
- jdsully 4y agoThey would have passed on the trademark rights with the rest of the IP
- eyelidlessness 4y agoI’m on mobile so kinda limited search capacity, but it looks like IE was using “Mozilla” in its UA string for a couple years before the trademark was published (granted it was filed a few months prior to that IE release, and granted I have no idea how to read uspto.gov with any confidence that I understand it, and also granted I have no idea how much prior usage of trademarks overlaps with concepts like prior art for patents and copyright).
- pbhjpbhj 4y agoIt could be passing-off which is an unregistered right (in UK at least) as they were using that mark to pretend to be another product.
- 4y ago
- fortnum 4y agoThe title is clickbait. If anyone forced here anything, then it was not IE but - once again - webmasters who don't deserve that "title" ;)
- drdaeman 4y ago"Webmasters" were told to use XHTML and they massively cried how that they just can't write correct code so they absolutely need sloppy parsers that would analyze the mess of unclosed tags and weirdly placed elements and try to understand the intent. And the industry gave up. This is essentially the same story.
- MBCook 4y agoI know it would be a temporary disaster but I think at this point I wish Safari, FF, Chrome and Edge would just decide on a flag day to get rid of user agents. From March 17th, 2023 (or whatever) all user agent strings are now “WebBrowser/1.0” until the end of time. Just force the switch to better methods.
- logicallee 4y agowhat are better methods?
- MBCook 4y agoJust check if the thing you want is defined in JS. Maybe add some supplementary methods to help with that kind of check. Parsing out the UA header mess is a disaster.
- andirk 4y agoThis is the correct answer. Allow 3rd party analytics or whatever to do as they choose, but your javascript should pretty much never believe a UA string. `if (someFeature && someFeature.someSpecificMethod)...` Or you can try/catch if you are less sympathetic to inferior tech.
- Macha 4y agoThis would be sufficient if features were a yes/no binary of supported or not, but sometimes browsers implement features but get them wrong, or incompletely.
- Xelynega 4y agoThen the features aren't supported in the browser and you should file a bug report to the vendor. Having the developers that use a tool work around the bugs in that tool is a recipe for having millions of repeated lines of code that don't actually solve the problem upstream.
- feyman_r 4y agoClient Hints are the recommended replacement for UA strings. I believe the default behavior for Chromium browsers is already changing (looking for schedule link). [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hints https://developer.mozilla.org/en-US/docs/Web/HTTP/Client_hin...
- inthepipe 4y agoThe issue is that you often want to work around bugs in a browser. For instance, Safari technically supports a lot of features, but very often there are slight inconsistencies with other browsers. Would Safari’s capability be something like “capture-stream-with-bugs”?
- oefrha 4y ago> Client Hints are <del>the recommended</del><ins>Chrome's</ins> replacement for UA strings. FTFY. Last I checked it's just a unilateral Chrome implementation, no one else recommends it.
- bobse 4y ago>Teams are broken under Firefox >change useragent to egde/chrome >it works now Thank you Microsoft.
- pbhjpbhj 4y agoThis is just anti-competitive practice, yes? Presumably unlawful.
- bobse 4y agoThis is Rajesh and welcome to Microsoft forums. Please install Microsoft Edge TM. Bye.
- olliej 4y agoNo, it's just standard web developer laziness. They haven't made it IE only, they just broke the less popular browser, and likely anything else that is not chrome/blink, because chrome/blink is the new IE: its bugs define "correct behavior" it shipping something means "it's standard", no different from the "IE is the internet" era (and just like chrome there was a long period where IE was the best browser, before devs started targeting it alone).
- bobse 4y agoIt does work correctly once you change useragent string though.
- jeroenhd 4y agoI believe Firefox doesn't expose the audio device output picker, only letting you select a single output device (you can select one in the permission prompt, but changing it is difficult). Last time I looked into why Teams wasn't working right, that was the reason Firefox was still listed as unsupported, because this can easily miss up setups with conference call PCs hooked up to some fancy proprietary audio conferencing system.
- olliej 4y ago
- tzot 4y agoSo rv0110.0 would not work?
- auscompgeek 4y agoI presume that would unfortunately break websites in _other_ ways, if they're UA-sniffing Firefox in unconventional ways. At that point they might as well remove it altogether instead of drastically changing the UA string.
- masswerk 4y agoI can well see some non-trivial issues with `parseInt()`… if (paseInt(revMajor) === 72) { … } // rev 0110 detected! ;-)
- Hizonner 4y agoStop sending User-Agent. Replace it with nothing. Not client hints. Nothing. If sites start rejecting Firefox clients because of that, then instead change it to send exactly the same User-Agent (and other software identification) that Chrome sends, and commit to exactly faking Chrome's signals in the future. The UA header never had any business existing to begin with. Servers guessing client capabilities from the software they're running, or trying to work around client bugs, is architecturally insane, concentrates power excessively, and guarantees that morons will write bugs like the one this story is about. And the other uses of the information are simply evil. If you need to signal specific capabilities, which you generally should not be doing because you shouldn't have punted all real attempts at standardization years ago, then signal specific capabilities. Or let the server try stuff and give only success or failure feedback.
- metadat 4y agoAt first I was like "Yeah buddy, preach on". Then came the next thought: Then what. Site providers will still will want to know and this likely results in a browser detection excalation arms race pushed to JavaScript. I still think servers shouldn't get to know so much about browser clients, certainly not PII-level details (PII-level being the norm as it exists today).
- Hizonner 4y agoYou can't stop fingerprinting. I wish you could, but you can't. But you CAN make it enough of a pain to cut down on the number of half-qualified Web monkeys who try to use the information in ham-handed ways. You can stop just handing the information over for free to people who might want to casually exploit you. You might even make it harder for some more sophisticated and/or committed actors to do it; for example, if I'm an ISP running a middlebox and trying to fingerprint all the traffic that runs through me, I can't use JavaScript. And you can save some bandwidth in the process.
- codetrotter 4y ago> Won't this likely result in browser detection to be pushed to JavaScript and create an arms escalation race? NoScript. https://noscript.net/ https://noscript.net/
- andirk 4y agoUser agent sniffing is poor practice anyways. Try to use the feature and react according to the browser's abilities. Analytics and similar can sniff all day though. To push browsers to get rid of UA string, we should all use a UA string extension that uses the same string like "DOG-SHIT". That way it'll start showing up in analytics. And if you're trying to date the "data science" girl, spam the app/website with UA string like "hi-amy-will-you-go-out-with-me--sincerely-jack-who-sits-behind-you."
- altdataseller 4y agoFor your last point: that would be considered cute if you're attractive. Otherwise it's creepy.
- jeroenhd 4y agoHave more fun with your UA strings! Unclosed quotation marks, XXE strings, Shellshock, they might just earn you a bug bounty. Maybe throw in the EICAR test string as well, getting their shitty antivirus to purge the log files may just help protect your privacy!
- xyzzy_plugh 4y agoNah, you're both wrong. What you really want is social security numbers.
- wkat4242 4y agoLog4j would also be an interesting one there
- gregmac 4y agoDoes anyone know of (or work on) an app still doing user-agent sniffing to determine browser features (as in, the sniffing code has been touched in the last ~decade)? If so, why do it that way?
- oefrha 4y agoUser agent sniffing is still a very typical way to determine whether to send the mobile or desktop version of a site.
- tmpburning 4y ago[dead]
- WirelessGigabit 4y ago> overpriced MacBook Pro that has a sticky letter s today This joke flew right over me. Can someone elaborate?
- masswerk 4y agoI guess, this is targeted at Apple's butterfly key switches, which were used in their 2015-2019 MacBooks and prone to fail due to dust and other small particle intrusions. Compare: https://www.macrumors.com/guide/butterfly-keyboard-issues/ https://www.macrumors.com/guide/butterfly-keyboard-issues/
- deleted 4y ago[deleted]