3 ms·

Using HTTP meta-headers is actually something we seem to have forgotten how to do. The one that annoys me most is the accept-language header which is almost en

by dijit 2y ago

Using HTTP meta-headers is actually something we seem to have forgotten how to do. The one that annoys me most is the accept-language header which is almost entirely ignored in favour of GeoIP lookups to figure out regionality... which I find super odd; as if people are walking around using a browser in a language they don't speak. (or, an operating system configured for a language they don't speak). ETAG's though, are a bit fraught- if you're a company, a security scan will fire if an etag is detected because you might be able to figure out the inode on the filesystem based on it... which, idk why that's a security problem eitherway[0], but it's common for there to be false-positives[1]... which makes people not respect the header. Last-Modified should work though, I love the idea of checking headers and not content. I think people don't care to imagine the computer doing as little as possible to get the job done, and instead use the near unlimited computing power to just avoid thinking about consequences. [0]: https://www.pentestpartners.com/security-blog/vulnerabilities-that-arent-etag-headers/ https://www.pentestpartners.com/security-blog/vulnerabilitie... [1]: https://github.com/sullo/nikto/issues/469 https://github.com/sullo/nikto/issues/469

balamatom 2y ago
>as if people are walking around using a browser in a language they don't speak. (or, an operating system configured for a language they don't speak Well, yes, they are! Computers translated in my native language sound dumb. That's how a whole generation of my world learned better English than native speakers, ffs! Half of the time it's just translated wrong. You think anyone has any incentive to translate any technology to a language with a couple million speakers, all of whom are obligate pirates? And it seems like you might be surprised to hear that people speak more than one language. Then where's my global setting to tell the browser what languages I speak, so it'd know what header to send? Same place that lets me configure what ads I'm actually interested in. Nowhere. >I think people don't care to imagine the computer doing as little as possible to get the job done, and instead use the near unlimited computing power to just avoid thinking about consequences. This, friend, is what computers are for in the XXI century. "Bicycle for the mind", ha...
- dijit 2y ago
  Accept-Language is an array, not a string. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...
  - balamatom 2y ago
    [flagged]
    - deleted 2y ago
      [deleted]
    - 3np 2y ago
      You really don't need to have Accept-Language overlap with language of browser. I'm sorry but reading-comprehension department seems out today. I suggest you try reading without assistance. Also would you please tune it down and stop having such a confrontative and aggressive tone in your comments?
      - balamatom 2y ago
        Would you please show me where that fact was pointed out prior to invoking the reading comprehension department?
    - dijit 2y ago
      Just so you're aware, the way in which you've chosen to conduct this conversation is not in-keeping with the desired environment. I'm not entirely sure why you are coming across as deeply emotional about this topic, but it's really not worth getting angry over. However, you made a specific point: > And it seems like you might be surprised to hear that people speak more than one language. And I was mentioning that, actually, the header has support for multiple languages and the point is to fall back to the one you actually support; so if a site is translated in Spanish, but not Catalonian, then a person living in Barcelona might have ["ca_ES", "es_ES"], and actually only be served "es_ES" Spanish despite requesting the former as a preference. Also, there are mechanisms for changing this locale away from the Operating Systems choice, but, I would wager a sane default is to use the localisation of the operating system, as that is largely going to be localised for the person already- moreso than browser fingerprinting(?) or GEOIP lookups, as computers move just like humans do throughout our world.
yonatan8070 2y ago
To add to the language problem, when I travelled to Europe, some websites (like YouTube) changed to whatever regional language based on where I was, despite me being logged in and Google knowing full well which languages I speak. Even the ads changed language, as if advertising in a language I don't speak will help anyone
- golph 2y ago
  I think that Ads on Google are different in regards to licensing and targeting. A company might target "Users in Europe" for example.
  - hylaride 2y ago
    I'm Canadian and I switched from an ISP headquartered in Ontario to one headquarterd in Quebec (Teksavvy to Bell because of a bulk agreement my building got) and now half my youtube ads are in french, despite me living in Ontario. Don't care either way, but it does make you think...
    - shadowgovt 2y ago
      That's a targeting limitation. I don't know OTOH whether "target audience's spoken language" is one of the signals an advertiser can key into in targeting an ad (at a glance, it looks like it might be). But (a) advertisers don't always have that signal and (b) advertisers themselves aren't always savvy enough to set it (how many American advertisers targeting Iowa actually tag their ads as "in English?"), so you'll end up with region targeting as a proxy for language targeting. In your case, it's probably that the ad engine doesn't have enough info on you so it's falling back to geotargeting and hoping for the best (are you running with JavaScript disabled? Clearing cookies frequently? Avoiding logins? If so, these are all things known to decrease ad signal quality).
      - hylaride 2y ago
        That's the point. Youtube/Google knows who I am and I'm logged in - my preferences are all set to english and my searches, videos watched, etc are all 99% english, with the rest being with english subtitles.. I'm not talking about banner ads on random websites. They literally have first class data.
shadowgovt 2y ago
IIUC, accept-language is mostly ignored because the tooling to configure it on the user agent is really poor for most user agents. So users log into a site, they get the site in the wrong language, and because only the site is visible they blame the site, not their UA. It's the "Your site's broken if IE won't load it" problem.
- dijit 2y ago
  Can someone attest that this is actually the issue? FWIW Outlook does accept the "Accept-Language" header and I don't think anyone is saying that outlook is wrong for doing that or claiming it to be broken? Are you totally sure that this isn't a backwards myth? I think the most likely situation is that locale information for English speaking countries would be incorrect if the default (en_US) was used to install the operating system, which happens on occasion.
  - shadowgovt 2y ago
    I couldn't speak to Outlook, but Outlook is both popular enough and has enough people locked-in to its ecosystem (as business users) that it doesn't have to worry about losing users if Accept-Language doesn't do the right thing. Companies have IT departments to fix that stuff. I'm talking more like https://www.buerklin.com/ https://www.buerklin.com/. If that site comes up in the wrong language and the only way to fix it is to change the user agent's Accept-Language header, the user isn't going to just figure it out; they're going to navigate elsewhere. So the site has a bug in the top-left to toggle English or German. Something you mentioned up-thread that I should have commented on but overlooked: > which I find super odd; as if people are walking around using a browser in a language they don't speak ... yes, all the time. In libraries and Internet cafes, schools, and other shared spaces.
    - dijit 2y ago
      But then, that's not worse, because geoip would already be forcing those users into a language they potentially don't speak by not listening to their device. Or your library has somehow misconfigured their PCs when setting them up? A cookie based override already exists, forcing geoip is strictly worse as a default, except for localising currency? I guess.
unregistereddev 2y ago
Even when etag's have nothing to do with the filesystem they can still be a security vector. Some API's use etag's to identify what has changed since the last time you called a particular API. This means the ETAG values are probably stored in a database, which means the API server needs to protect against SQL injection in the request headers.
- mikevin 2y ago
  I mean that's something you need to do every time a DB is involved. Not really an argument against ETAGS.
OptionOfT 2y ago
Growing up in Belgium I feel your pain about GeoIPs and accept-language. I lived in Flanders, with my accept-language set to en-US, en. Ads would pop up in Dutch, Flemish, French and sometimes German. When you think about it, from a brick-and-mortar point of view, it makes sense. I'm more likely to buy <physical product advertised> at the <local chain grocery store> vs buying it anywhere in the USA, based on my IP. Next to that, imagine you browsing Reuters.com in with a Berlin IP and accept-language set to en-US, en. What SHOULD they show you? Local news in German, auto translated? Local news in German? Or redirect you to the US page?
- Ghoelian 2y ago
  Locality is different from language. In your example, it would have to show you the local German news, as that's local to you, and it would have to show it to you in the first supported language in your accept-language header. Personally I would prefer, for example, Reuters.com to be a "hub", and all the regional variants on de.reuters.com. Then just let the user choose what they want.

by dijit 2y ago

balamatom 2y ago

>as if people are walking around using a browser in a language they don't speak. (or, an operating system configured for a language they don't speak Well, yes, they are! Computers translated in my native language sound dumb. That's how a whole generation of my world learned better English than native speakers, ffs! Half of the time it's just translated wrong. You think anyone has any incentive to translate any technology to a language with a couple million speakers, all of whom are obligate pirates? And it seems like you might be surprised to hear that people speak more than one language. Then where's my global setting to tell the browser what languages I speak, so it'd know what header to send? Same place that lets me configure what ads I'm actually interested in. Nowhere. >I think people don't care to imagine the computer doing as little as possible to get the job done, and instead use the near unlimited computing power to just avoid thinking about consequences. This, friend, is what computers are for in the XXI century. "Bicycle for the mind", ha...

dijit 2y ago
Accept-Language is an array, not a string. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...
- balamatom 2y ago
  [flagged]
  - deleted 2y ago
    [deleted]
  - 3np 2y ago
    You really don't need to have Accept-Language overlap with language of browser. I'm sorry but reading-comprehension department seems out today. I suggest you try reading without assistance. Also would you please tune it down and stop having such a confrontative and aggressive tone in your comments?
    - balamatom 2y ago
      Would you please show me where that fact was pointed out prior to invoking the reading comprehension department?
  - dijit 2y ago
    Just so you're aware, the way in which you've chosen to conduct this conversation is not in-keeping with the desired environment. I'm not entirely sure why you are coming across as deeply emotional about this topic, but it's really not worth getting angry over. However, you made a specific point: > And it seems like you might be surprised to hear that people speak more than one language. And I was mentioning that, actually, the header has support for multiple languages and the point is to fall back to the one you actually support; so if a site is translated in Spanish, but not Catalonian, then a person living in Barcelona might have ["ca_ES", "es_ES"], and actually only be served "es_ES" Spanish despite requesting the former as a preference. Also, there are mechanisms for changing this locale away from the Operating Systems choice, but, I would wager a sane default is to use the localisation of the operating system, as that is largely going to be localised for the person already- moreso than browser fingerprinting(?) or GEOIP lookups, as computers move just like humans do throughout our world.

yonatan8070 2y ago

To add to the language problem, when I travelled to Europe, some websites (like YouTube) changed to whatever regional language based on where I was, despite me being logged in and Google knowing full well which languages I speak. Even the ads changed language, as if advertising in a language I don't speak will help anyone

golph 2y ago
I think that Ads on Google are different in regards to licensing and targeting. A company might target "Users in Europe" for example.
- hylaride 2y ago
  I'm Canadian and I switched from an ISP headquartered in Ontario to one headquarterd in Quebec (Teksavvy to Bell because of a bulk agreement my building got) and now half my youtube ads are in french, despite me living in Ontario. Don't care either way, but it does make you think...
  - shadowgovt 2y ago
    That's a targeting limitation. I don't know OTOH whether "target audience's spoken language" is one of the signals an advertiser can key into in targeting an ad (at a glance, it looks like it might be). But (a) advertisers don't always have that signal and (b) advertisers themselves aren't always savvy enough to set it (how many American advertisers targeting Iowa actually tag their ads as "in English?"), so you'll end up with region targeting as a proxy for language targeting. In your case, it's probably that the ad engine doesn't have enough info on you so it's falling back to geotargeting and hoping for the best (are you running with JavaScript disabled? Clearing cookies frequently? Avoiding logins? If so, these are all things known to decrease ad signal quality).
    - hylaride 2y ago
      That's the point. Youtube/Google knows who I am and I'm logged in - my preferences are all set to english and my searches, videos watched, etc are all 99% english, with the rest being with english subtitles.. I'm not talking about banner ads on random websites. They literally have first class data.

shadowgovt 2y ago

IIUC, accept-language is mostly ignored because the tooling to configure it on the user agent is really poor for most user agents. So users log into a site, they get the site in the wrong language, and because only the site is visible they blame the site, not their UA. It's the "Your site's broken if IE won't load it" problem.

dijit 2y ago
Can someone attest that this is actually the issue? FWIW Outlook does accept the "Accept-Language" header and I don't think anyone is saying that outlook is wrong for doing that or claiming it to be broken? Are you totally sure that this isn't a backwards myth? I think the most likely situation is that locale information for English speaking countries would be incorrect if the default (en_US) was used to install the operating system, which happens on occasion.
- shadowgovt 2y ago
  I couldn't speak to Outlook, but Outlook is both popular enough and has enough people locked-in to its ecosystem (as business users) that it doesn't have to worry about losing users if Accept-Language doesn't do the right thing. Companies have IT departments to fix that stuff. I'm talking more like https://www.buerklin.com/ https://www.buerklin.com/. If that site comes up in the wrong language and the only way to fix it is to change the user agent's Accept-Language header, the user isn't going to just figure it out; they're going to navigate elsewhere. So the site has a bug in the top-left to toggle English or German. Something you mentioned up-thread that I should have commented on but overlooked: > which I find super odd; as if people are walking around using a browser in a language they don't speak ... yes, all the time. In libraries and Internet cafes, schools, and other shared spaces.
  - dijit 2y ago
    But then, that's not worse, because geoip would already be forcing those users into a language they potentially don't speak by not listening to their device. Or your library has somehow misconfigured their PCs when setting them up? A cookie based override already exists, forcing geoip is strictly worse as a default, except for localising currency? I guess.

unregistereddev 2y ago

Even when etag's have nothing to do with the filesystem they can still be a security vector. Some API's use etag's to identify what has changed since the last time you called a particular API. This means the ETAG values are probably stored in a database, which means the API server needs to protect against SQL injection in the request headers.

mikevin 2y ago
I mean that's something you need to do every time a DB is involved. Not really an argument against ETAGS.

OptionOfT 2y ago

Growing up in Belgium I feel your pain about GeoIPs and accept-language. I lived in Flanders, with my accept-language set to en-US, en. Ads would pop up in Dutch, Flemish, French and sometimes German. When you think about it, from a brick-and-mortar point of view, it makes sense. I'm more likely to buy <physical product advertised> at the <local chain grocery store> vs buying it anywhere in the USA, based on my IP. Next to that, imagine you browsing Reuters.com in with a Berlin IP and accept-language set to en-US, en. What SHOULD they show you? Local news in German, auto translated? Local news in German? Or redirect you to the US page?

Ghoelian 2y ago
Locality is different from language. In your example, it would have to show you the local German news, as that's local to you, and it would have to show it to you in the first supported language in your accept-language header. Personally I would prefer, for example, Reuters.com to be a "hub", and all the regional variants on de.reuters.com. Then just let the user choose what they want.