10 ms·

Why do all browsers' user agents start with "Mozilla/"? (2008)

116 points by nan60 1y ago

gnabgib 1y ago
(2008) The post popular answer includes: History of the browser user-agent string related discussions: 2022 (87 points, 20 comments) https://news.ycombinator.com/item?id=31246438 https://news.ycombinator.com/item?id=31246438 2019 (62 points, 22 comments) https://news.ycombinator.com/item?id=21085388 https://news.ycombinator.com/item?id=21085388 2018 (558 points, 168 comments) https://news.ycombinator.com/item?id=16525559 https://news.ycombinator.com/item?id=16525559 2013 (100 points, 32 comments) https://news.ycombinator.com/item?id=6674812 https://news.ycombinator.com/item?id=6674812
shmerl 1y ago
Really weird and convoluted reasons for it. A better question is why it was never fixed / renamed to proper names.
- ronsor 1y ago
  Backwards compatibility at all costs
- ExoticPearTree 1y ago
  Probably because now if you come with a different User-Agent you might get blocked by a WAF or a load balancer. Too much history to just forget overnight.
- madeofpalk 1y ago
  They did in the new UA api https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-CH-UA https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
- fredoralive 1y ago
  To avoid breaking stuff basically, easier to have ugly UA strings than persuade every site that does weird UA parsing to fix themselves. The main exception to this was Opera back when it had its own engine, which did use Opera at the start of its fairly clean default UA string. Then when they reached version 10 they had to make the primary version 9 with a second real version later in the string as sites couldn’t cope with two digit version numbers…
  - imiric 1y ago
    I miss Opera. It's a damn shame that it was so badly mismanaged, and ultimately sold off to investors, which further buried it into irrelevance. It now survives on gaming-oriented gimmicks and shady promotions. I hear that Vivaldi is supposed to be a continuation of it, but from what I've seen it's just another Chromium clone with a closed-source UI, without any distinguishing features. Opera in the late 90s / early 2000s was excellent. It was lightweight and snappy. Among the first to support tabs. The Presto engine was the most performant on machines of the era. The trialware/adware was annoying, but the browser was solid. The built-in email client was decent as well. In 2009 they launched a very interesting web server / sharing feature with Opera Unite, which unfortunately didn't gain traction. Opera Mini was the best mobile browser for a few years as well, before smartphones took off.
    - FirmwareBurner 1y ago
      >It's a damn shame that it was so badly mismanaged I think even the best management in the world wouldn't have helped it survive the onslaught of Google's Chrome and their massive war chest in that time. It's like a team of girl scouts versus the NBA.
      - deleted 1y ago
        [deleted]
    - fredoralive 1y ago
      Amen brother. My personal big thing was the ability to "minimise" / deque tabs, a legacy of the really early version of tabs that were basically based around the concept of the Windows task bar (and MDI), not tabs. I'm not a Firefox user as it's the least worst option, and there used to be Firefox extensions that mostly (but not quite) did it, but Mozilla naturally broke it as part of their general view that making Firefox worse will somehow make it popular[1]. Also mouse gestures. Again, you can kinda do it with Firefox, but random stuff like the home shortcut screen don't support it nowadays because??? Also, I want a status bar. I don't care if it's old fashioned, but I want one. Sorry if this is becoming a Mozilla / Firefox gripe fest. [1] I don't think Opera had a nice preview view for RSS feeds, but Firefox did. Then they broke it for random reasons? Gee, raw XML is so much better than a sensible view, thank you Mozilla!
- JdeBP 1y ago
  Possibly, but it wouldn't be the first time that people took a field that was supposed to be an originator name and made it something else entirely. There's a field in the Volume Boot Record of disc volumes, in the PC compatible world, that was supposed to be the name of the OEM whose software formatted the volume. It was (and is) a few bytes of identifying human-readable text. Operating systems ended up doing string comparisons and parsing numbers, and breaking in odd ways, including not even recognizing their own handiwork, when operating system vendors did not use the name of the first vendor. * https://jdebp.uk/FGA/volume-boot-block-oem-name-field.html https://jdebp.uk/FGA/volume-boot-block-oem-name-field.html It has probably been long enough since MS-DOS 3.3 and in turn the Browser Wars that someone is right now failing to learn from history and making this mistake anew, yet again, somewhere.
- wolrah 1y ago
  > A better question is why it was never fixed / renamed to proper names. Because the reason it is the way it is in the first place is compatibility with sites that are doing things objectively wrong already, which makes it really hard to get them to change. The problem is that poorly designed systems limit access or disable features based on a user-agent allowlist, which is never the right answer. There is no right way to do it because it's always wrong, but people choose to do it anyways. I'm personally a fan of treating broken sites as broken, but I understand that realistically any "alternative" browser has to deal with all the broken sites designed for whatever came before it because otherwise most normal users won't consider switching. If I were made King of the Internet for a day and able to enforce any changes I wanted on everyone, all the major browsers would have to change their user-agent string to something totally unique on the same day, intentionally breaking any sites that are doing it wrong for everyone so the broken sites are forced to fix their own nonsense. That'd come maybe two or three decrees down the line from "All ISPs are required to provide a globally routable IPv6 block in accordance with RFC 6177, providing only CGN IPv4 is a capital offense".
  - Gigachad 1y ago
    Personally I’d get rid of the user agent entirely. Stop sending it and let sites query available features rather than check the specific browser version.
    - wolrah 1y ago
      There are valid reasons to want to know the specific user agent when working around bugs in old but popular versions, that's why I said a user-agent allowlist for access or advanced functionality was bad. That inevitably breaks any new platforms that haven't been explicitly approved, which is obviously bad. Denying access from or specifically only applying fixes to known bad versions is fine. Also IMO it's useful as an admin to know what clients your users are using, but I do understand why many would prefer to limit the data shared with the sites you visit.
      - Gigachad 1y ago
impure 1y ago
Mozilla should start charging a licensing fee for starting your user agent with Mozilla/ Money problems solved!
- wvbdmp 1y ago
  In a way it seems like a classic trademark violation, tricking people (or their servers) into thinking your product is someone else’s. I wonder if there are actual agreements about this these days.
  - rileymat2 1y ago
    The mark in this usage has gone unprotected for so long, I doubt there would be any success with that. Also, I doubt tricking servers would indicate creating consumer confusion with the trademark.
    - ojosilva 1y ago
      Yeah, but the case law resulting from the denied ruling could prove valuable for others who need to defend their use of trademarks in API naming. "API" here refers to the broad judicial term, where the User-Agent header falls under.
  - im3w1l 1y ago
    Adversarial compatibility is pretty nice though, I don't think we should do away with it.
  - userbinator 1y ago
    See Sega v. Accolade for a precedent of why that likely won't work.
  - wmf 1y ago
    User agent strings aren't really seen by people so arguably there is no consumer confusion. And if you need the Mozilla user agent for compatibility it's reminiscent of https://en.wikipedia.org/wiki/Sega_v._Accolade https://en.wikipedia.org/wiki/Sega_v._Accolade
deleted 1y ago
[deleted]
RainyDayTmrw 1y ago
In a similar way: Why was there no Windows 9? [1] [1]: https://www.pcworld.com/article/435584/why-windows-10-isnt-named-9-windows-95-legacy-code.html https://www.pcworld.com/article/435584/why-windows-10-isnt-n...
- uxjw 1y ago
  TL;DR: Some code looking for Windows 95 or 98 only looked for "Windows 9" to match both, and would have matched Windows 9. Now Apple has the year in the OS version we'll have people wondering in a few years what happened to iOS 19-25.
  - DecentShoes 1y ago
    [flagged]
    - danielheath 1y ago
      I worked on a codebase that had this bug, so I’m not sure where you’re getting “this is false” from. We sold software that was installed long-term at customer sites, and they weren’t going to update it until they needed to, so the bug persisted in production well after we fixed it.
      - Johnbot 1y ago
        Best I can tell it's only libraries that generate those sort of strings, which could just as well report a different string for Windows 9. The actual Windows API even returns the version information for Windows 8 if the application isn't manifested for 10 and onwards.
        danielheath 1y ago
        Company I joined in 2008 had sold software back in 2005 or so which had the bug, and customers were still running it in 2015 when Win10 came out. The idea that "sensibly designed software wouldn't have this issue, so it must not exist" is absolutely at odds with virtually everything I've seen in my career.
technothrasher 1y ago
Not all browsers (e.g. "Lynx/2.9.0dev.12 libwww-FM/2.1") :)
- the_third_wave 1y ago
  Not to forget SpaceGoat/2000, my usual go-to when building something which does browser-like things. I've been using that one since before the year 2000 so maybe it is time for an upgrade to SuperSpaceGoat/2100?
- Rediscover 1y ago
  And all heavy lynx users know about changing that on the fly to Mozilla for screwy websites that claim they won't work with lynx. I'm happy that I am encountering such behavior less and less over time.
nreilly 1y ago
Maybe we should move to something like termcap for browsers? /s
anamexis 1y ago
Has anyone tried running a generic User-Agent on a standard modern browser? (By "generic", I mean one that does away with this whole compatibility dance.) I'm curious how much would break or degrade.
- userbinator 1y ago
  Unfortunately, everything that does fingerprinting/"bot detection" will get triggered.
  - Gigachad 1y ago
    All of the privacy stuff straight up breaks the internet these days. Try using a VPN and half the time CDNs straight up refuse to serve you the JS files so sites like supermarkets or flight booking websites load broken or show some generic forbidden error. Blanking out the user agent would have to be pushed by either Apple, Google, or Microsoft. And out of those I feel like only Apple would do it. iCloud private relay doesn’t end up breaking websites since companies care about not degrading the experience for Apple users and make sure the site still works.
- arp242 1y ago
  Opera Presto didn't use it, and had a User-Agent like: Opera/9.80 (X11; Linux zvav; U; en) Presto/2.12.423 Version/12.16 Didn't seem to cause that much problems. It did keep the version at 9.80, presumably because >=10 must have caused problems somewhere.
  - sunaookami 1y ago
    God I miss Presto... but Opera did have major compatibility issues even when it was still popular.
- ryao 1y ago
  I once tried having my web browser claim to be the Google spider. It worked well and I completely forgot about it until one website soft banned me a year or two later for impersonating the Google spider. I contacted them to complain. They lifted the ban and told me the ban reason, which made me remember the experiment I never terminated.
usr1106 1y ago
Ironically Cloudflare blocks the real Mozilla derived browser on this Linux phone, so I can't access SO anymore. (Turnstile was broken a long time. It finally got fixed half a year ago. Now I note it does not even come up any more, just a static message that I should throw away my phone^W^W^W^W upgrade my browser. No idea whether Cloudflare or SO is to blame.)
- userbinator 1y ago
  No surprise, CF is in bed with Big Browser. There are workarounds but I won't go into detail here since "the walls have ears"; suffice to say that the "bot" scraping companies still have no trouble getting around it.
dankwizard 1y ago
It's funny, UserAgents are only used these days to either A - pretend to be a browser, B - bad actors exchanging decrypts why haven't we deprecated this junk

116 points by nan60 1y ago

(2008) The post popular answer includes: History of the browser user-agent string related discussions: 2022 (87 points, 20 comments) https://news.ycombinator.com/item?id=31246438 https://news.ycombinator.com/item?id=31246438 2019 (62 points, 22 comments) https://news.ycombinator.com/item?id=21085388 https://news.ycombinator.com/item?id=21085388 2018 (558 points, 168 comments) https://news.ycombinator.com/item?id=16525559 https://news.ycombinator.com/item?id=16525559 2013 (100 points, 32 comments) https://news.ycombinator.com/item?id=6674812 https://news.ycombinator.com/item?id=6674812

shmerl 1y ago

Really weird and convoluted reasons for it. A better question is why it was never fixed / renamed to proper names.

ronsor 1y ago
Backwards compatibility at all costs
ExoticPearTree 1y ago
Probably because now if you come with a different User-Agent you might get blocked by a WAF or a load balancer. Too much history to just forget overnight.
madeofpalk 1y ago
They did in the new UA api https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-CH-UA https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
fredoralive 1y ago
To avoid breaking stuff basically, easier to have ugly UA strings than persuade every site that does weird UA parsing to fix themselves. The main exception to this was Opera back when it had its own engine, which did use Opera at the start of its fairly clean default UA string. Then when they reached version 10 they had to make the primary version 9 with a second real version later in the string as sites couldn’t cope with two digit version numbers…
- imiric 1y ago
  I miss Opera. It's a damn shame that it was so badly mismanaged, and ultimately sold off to investors, which further buried it into irrelevance. It now survives on gaming-oriented gimmicks and shady promotions. I hear that Vivaldi is supposed to be a continuation of it, but from what I've seen it's just another Chromium clone with a closed-source UI, without any distinguishing features. Opera in the late 90s / early 2000s was excellent. It was lightweight and snappy. Among the first to support tabs. The Presto engine was the most performant on machines of the era. The trialware/adware was annoying, but the browser was solid. The built-in email client was decent as well. In 2009 they launched a very interesting web server / sharing feature with Opera Unite, which unfortunately didn't gain traction. Opera Mini was the best mobile browser for a few years as well, before smartphones took off.
  - FirmwareBurner 1y ago
    >It's a damn shame that it was so badly mismanaged I think even the best management in the world wouldn't have helped it survive the onslaught of Google's Chrome and their massive war chest in that time. It's like a team of girl scouts versus the NBA.
    - deleted 1y ago
      [deleted]
  - fredoralive 1y ago
    Amen brother. My personal big thing was the ability to "minimise" / deque tabs, a legacy of the really early version of tabs that were basically based around the concept of the Windows task bar (and MDI), not tabs. I'm not a Firefox user as it's the least worst option, and there used to be Firefox extensions that mostly (but not quite) did it, but Mozilla naturally broke it as part of their general view that making Firefox worse will somehow make it popular[1]. Also mouse gestures. Again, you can kinda do it with Firefox, but random stuff like the home shortcut screen don't support it nowadays because??? Also, I want a status bar. I don't care if it's old fashioned, but I want one. Sorry if this is becoming a Mozilla / Firefox gripe fest. [1] I don't think Opera had a nice preview view for RSS feeds, but Firefox did. Then they broke it for random reasons? Gee, raw XML is so much better than a sensible view, thank you Mozilla!
JdeBP 1y ago
Possibly, but it wouldn't be the first time that people took a field that was supposed to be an originator name and made it something else entirely. There's a field in the Volume Boot Record of disc volumes, in the PC compatible world, that was supposed to be the name of the OEM whose software formatted the volume. It was (and is) a few bytes of identifying human-readable text. Operating systems ended up doing string comparisons and parsing numbers, and breaking in odd ways, including not even recognizing their own handiwork, when operating system vendors did not use the name of the first vendor. * https://jdebp.uk/FGA/volume-boot-block-oem-name-field.html https://jdebp.uk/FGA/volume-boot-block-oem-name-field.html It has probably been long enough since MS-DOS 3.3 and in turn the Browser Wars that someone is right now failing to learn from history and making this mistake anew, yet again, somewhere.
wolrah 1y ago
> A better question is why it was never fixed / renamed to proper names. Because the reason it is the way it is in the first place is compatibility with sites that are doing things objectively wrong already, which makes it really hard to get them to change. The problem is that poorly designed systems limit access or disable features based on a user-agent allowlist, which is never the right answer. There is no right way to do it because it's always wrong, but people choose to do it anyways. I'm personally a fan of treating broken sites as broken, but I understand that realistically any "alternative" browser has to deal with all the broken sites designed for whatever came before it because otherwise most normal users won't consider switching. If I were made King of the Internet for a day and able to enforce any changes I wanted on everyone, all the major browsers would have to change their user-agent string to something totally unique on the same day, intentionally breaking any sites that are doing it wrong for everyone so the broken sites are forced to fix their own nonsense. That'd come maybe two or three decrees down the line from "All ISPs are required to provide a globally routable IPv6 block in accordance with RFC 6177, providing only CGN IPv4 is a capital offense".
- Gigachad 1y ago
  Personally I’d get rid of the user agent entirely. Stop sending it and let sites query available features rather than check the specific browser version.
  - wolrah 1y ago
    There are valid reasons to want to know the specific user agent when working around bugs in old but popular versions, that's why I said a user-agent allowlist for access or advanced functionality was bad. That inevitably breaks any new platforms that haven't been explicitly approved, which is obviously bad. Denying access from or specifically only applying fixes to known bad versions is fine. Also IMO it's useful as an admin to know what clients your users are using, but I do understand why many would prefer to limit the data shared with the sites you visit.
    - Gigachad 1y ago

impure 1y ago

Mozilla should start charging a licensing fee for starting your user agent with Mozilla/ Money problems solved!

wvbdmp 1y ago
In a way it seems like a classic trademark violation, tricking people (or their servers) into thinking your product is someone else’s. I wonder if there are actual agreements about this these days.
- rileymat2 1y ago
  The mark in this usage has gone unprotected for so long, I doubt there would be any success with that. Also, I doubt tricking servers would indicate creating consumer confusion with the trademark.
  - ojosilva 1y ago
    Yeah, but the case law resulting from the denied ruling could prove valuable for others who need to defend their use of trademarks in API naming. "API" here refers to the broad judicial term, where the User-Agent header falls under.
- im3w1l 1y ago
  Adversarial compatibility is pretty nice though, I don't think we should do away with it.
- userbinator 1y ago
  See Sega v. Accolade for a precedent of why that likely won't work.
- wmf 1y ago
  User agent strings aren't really seen by people so arguably there is no consumer confusion. And if you need the Mozilla user agent for compatibility it's reminiscent of https://en.wikipedia.org/wiki/Sega_v._Accolade https://en.wikipedia.org/wiki/Sega_v._Accolade

deleted 1y ago

[deleted]

RainyDayTmrw 1y ago

In a similar way: Why was there no Windows 9? [1] [1]: https://www.pcworld.com/article/435584/why-windows-10-isnt-named-9-windows-95-legacy-code.html https://www.pcworld.com/article/435584/why-windows-10-isnt-n...

uxjw 1y ago
TL;DR: Some code looking for Windows 95 or 98 only looked for "Windows 9" to match both, and would have matched Windows 9. Now Apple has the year in the OS version we'll have people wondering in a few years what happened to iOS 19-25.
- DecentShoes 1y ago
  [flagged]
  - danielheath 1y ago
    I worked on a codebase that had this bug, so I’m not sure where you’re getting “this is false” from. We sold software that was installed long-term at customer sites, and they weren’t going to update it until they needed to, so the bug persisted in production well after we fixed it.
    - Johnbot 1y ago
      Best I can tell it's only libraries that generate those sort of strings, which could just as well report a different string for Windows 9. The actual Windows API even returns the version information for Windows 8 if the application isn't manifested for 10 and onwards.
      - danielheath 1y ago
        Company I joined in 2008 had sold software back in 2005 or so which had the bug, and customers were still running it in 2015 when Win10 came out. The idea that "sensibly designed software wouldn't have this issue, so it must not exist" is absolutely at odds with virtually everything I've seen in my career.

technothrasher 1y ago

Not all browsers (e.g. "Lynx/2.9.0dev.12 libwww-FM/2.1") :)

the_third_wave 1y ago
Not to forget SpaceGoat/2000, my usual go-to when building something which does browser-like things. I've been using that one since before the year 2000 so maybe it is time for an upgrade to SuperSpaceGoat/2100?
Rediscover 1y ago
And all heavy lynx users know about changing that on the fly to Mozilla for screwy websites that claim they won't work with lynx. I'm happy that I am encountering such behavior less and less over time.

nreilly 1y ago

Maybe we should move to something like termcap for browsers? /s

anamexis 1y ago

Has anyone tried running a generic User-Agent on a standard modern browser? (By "generic", I mean one that does away with this whole compatibility dance.) I'm curious how much would break or degrade.

userbinator 1y ago
Unfortunately, everything that does fingerprinting/"bot detection" will get triggered.
- Gigachad 1y ago
  All of the privacy stuff straight up breaks the internet these days. Try using a VPN and half the time CDNs straight up refuse to serve you the JS files so sites like supermarkets or flight booking websites load broken or show some generic forbidden error. Blanking out the user agent would have to be pushed by either Apple, Google, or Microsoft. And out of those I feel like only Apple would do it. iCloud private relay doesn’t end up breaking websites since companies care about not degrading the experience for Apple users and make sure the site still works.
arp242 1y ago
Opera Presto didn't use it, and had a User-Agent like: Opera/9.80 (X11; Linux zvav; U; en) Presto/2.12.423 Version/12.16 Didn't seem to cause that much problems. It did keep the version at 9.80, presumably because >=10 must have caused problems somewhere.
- sunaookami 1y ago
  God I miss Presto... but Opera did have major compatibility issues even when it was still popular.
ryao 1y ago
I once tried having my web browser claim to be the Google spider. It worked well and I completely forgot about it until one website soft banned me a year or two later for impersonating the Google spider. I contacted them to complain. They lifted the ban and told me the ban reason, which made me remember the experiment I never terminated.

usr1106 1y ago

Ironically Cloudflare blocks the real Mozilla derived browser on this Linux phone, so I can't access SO anymore. (Turnstile was broken a long time. It finally got fixed half a year ago. Now I note it does not even come up any more, just a static message that I should throw away my phone^W^W^W^W upgrade my browser. No idea whether Cloudflare or SO is to blame.)

userbinator 1y ago
No surprise, CF is in bed with Big Browser. There are workarounds but I won't go into detail here since "the walls have ears"; suffice to say that the "bot" scraping companies still have no trouble getting around it.

dankwizard 1y ago

It's funny, UserAgents are only used these days to either A - pretend to be a browser, B - bad actors exchanging decrypts why haven't we deprecated this junk