10 ms·

User-agent string changes

88 points by anonymfus 12y ago

molf 12y ago
Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0 This is getting ridiculous. Every browser is now pretending to be all browsers at the same time, and a simple version change apparently warrants an entire article. Not sending the UA string would avoid this madness. But on the other hand a UA string is great for analytics. Is it possible to come up with some method that discloses information about the user agent which can be used for analytical purposes but cannot be used to change the bahaviour of a web page?
- pbhjpbhj 12y ago
  Isn't this a trademark infringement? They're using AppleWebKit, Chrome, Safari to identify their product when those terms are protected from use via trademark law. I know this isn't a new thing per se but this seems to be an especially egregious misrepresentation.
  - minot 12y ago
    Infringement, as far as I know is a civil matter. Who is going to sue when everyone is doing it?
  - freehunter 12y ago
    Is it any more of a trademark infringement than 'IBM PC Compatible'?
  - Dylan16807 12y ago
    Will anyone be tricked? No. So not infringement.
  - mcbutterbunz 12y ago
    I hope not. The last thing we need is a new round of lawsuits. Maybe everyone can agree on a set of rules for communicating this data.
  - lambda 12y ago
    No, because this is not in any way going to cause consumer confusion, but instead is simply used for compatibility purposes.
    - pbhjpbhj 12y ago
      Confusion is the measure used when trademarks aren't registered and is much harder to prove. When considering registered trademarks it's not necessary for confusion to be actually present at all - 100% of customers can know that your product isn't an iPad but if you advertise it as an iPad then you're infringing: it doesn't say "AppleWebKit compatible" in that string and the string is not required to make the browser function at all. If, for example, people offer alternative services to people with an Apple UA string (BBC iPlayer did this) then you're impersonating such tech use via the trademark - it might be now for example that people need to turn off specific iPad enhancements as they break IE11 - that's commercial interference using a trademark. The trademark isn't needed in any technical way for IE to operate as it should, so it's not a compatibility issue. Website content owners can choose to cut out certain browsers if they wish, impersonating another browser is fine .. but if you do that as a company utilising someone else's trademark to do so .. it just has feeling for me of not sitting quite right with what I know of TM law.
      - firepacket 12y ago
        I would think the courts would recognize a difference between advertising to the end user for the purpose of purchase/consumption, and advertising to 3rd parties as part of a compatibility protocol. The UA string is not visible to the consumer, and wouldn't affect the number of people who download and install the browser. Its only purpose is to ensure compatibility with the server after the browser has already been installed. Also I wouldn't say the browser is actually impersonating another browser. If it was trying to impersonate, the UA string would need to match the other browser exactly and it doesn't attempt to do that. The string is still uniquely identifiable as an IE11 UA.
  - cma 12y ago
    Sega and/or Nintendo tried to require games to display their trademarks before their system would run them, courts ruled that third parties could use the trademarks to overcome such systems.
- userbinator 12y ago
  Is it possible to come up with some method that discloses information about the user agent which can be used for analytical purposes but cannot be used to change the bahaviour of a web page? It's called "browser fingerprinting": https://panopticlick.eff.org/ https://panopticlick.eff.org/
- ancarda 12y ago
  It's useful to know the OS if you want to offer different binaries for each OS. Maybe just "BrowserName/Version (OSName/Version)" so Firefox/35 (Mac OS X/10.10.1)
- tacostakohashi 12y ago
  One approach would be for browsers to send a string that is along the lines of a uuid generated at compile time, or an MD5 of the executable. That way, analytics vendors or libraries could maintain a database that maps IDs to specific browsers releases, platforms, features, etc if they care about those things enough, but short-sighted web admins would have no hope of doing anything with primitive regex matching of the UA string.
  - firepacket 12y ago
    You mean a super cookie? Not only would this violate tracking laws in some areas, but who would ever want to use such a thing?
    - tacostakohashi 12y ago
      No. Generated at the time the browser executable is built (by the vendor, linux distro, etc), and hence shared by all the people using that browser executable. So, only good for identifying the browser, platform, OS and features, and much less so the users.
  - tracker1 12y ago
    You're welcome to do just that.. md5(useragent) and keep your own definitions... be mindful that in IE in particular plugins affect the string itself. :-(
Strom 12y ago
I think the more interesting bit is that the new UA value contains all the alternative browser strings as well. Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0
- JBiserkov 12y ago
  I also read like a history of web browsers: first there was Mozilla, then Apple made WebKit (actually KHTML), then Google created Chrome and ... there will always be a bleading Edge for you to cut yourself :-)
  - mpyne 12y ago
    Actually, KDE made KHTML (for the Konqueror web browser), which was then used by Apple to create and evolve WebKit, and you know the story from there. But KHTML wasn't just a code name for WebKit, it actually came from outside Apple.
    - Svip 12y ago
      But KHTML always referred to itself as 'KHTML, like Gecko' to ensure people sniffing for Gecko would be displaying the same HTML for KHTML as Gecko. This is why 'Gecko' remains in all major browsers. Edit: Apparently Internet Explorer also has 'like Gecko'.
  - WorldWideWayne 12y ago
    Actually, first there was NCSA Mosaic which came out almost a full two years before Netscape Navigator. The first 6 versions of IE were also based on Mosaic.
    - lclarkmichalek 12y ago
      But what UA did Mosaic use?
      - 12y ago
nly 12y ago
We'd all be better off if they just stopped sending the UA string altogether
- kabdib 12y ago
  These strings make the parser guy in me just twitch. Do they expect many, many web developers to reliably extract accurate meaning from them?
  - dangrossman 12y ago
    Most developers would find and use a library rather than write their own parser. They pretty reliably extract the browser/version/platform/etc from the hundreds of thousands of UA strings you'll see in the wild. https://github.com/tobie/ua-parser https://github.com/tobie/ua-parser https://github.com/browscap/browscap https://github.com/browscap/browscap A user agent parser is built in to the PHP language as well. http://php.net/manual/en/function.get-browser.php http://php.net/manual/en/function.get-browser.php
  - xg15 12y ago
    I think it's the other way around. This happens when a field that no-one ever defined a syntax for suddenly gets important and everyone tries to extract meaning from it using arbitrary contains() and substring() acrobatics...
    - kabdib 12y ago
      So it's organic and ill-defined . . . and people are parsing it. Lovely :-)
- guardian5x 12y ago
  So much this. The UA string is flawed by itself. it shouldn't even be used anymore. The fact that browser manufacturers have to include all sorts of stuff is proof that this system doesn't work.
0x0 12y ago
Do they support NaCl and WebRTC and WebGL and WineVine DRM like Chrome, now that they stuff "Chrome" in their User-Agent? If not, what happens if a site (poorly) detects these features from the user agent?
- TazeTSchnitzel 12y ago
  Why on earth would you detect those things server-side, given you can do the fallback client-side? Also, no, they don't have those things, aside from WebGL and some form of DRM (not sure if it's the same as Chrome's). The reason they put Chrome in is for sites assuming only Chrome supports web standards (ugh).
  - Svip 12y ago
    Gee, just look for 'Gecko' in UA strings. That'll catch 'em.
  - 0x0 12y ago
    It could easily happen client-side, with something like /Chrome/.test(navigator.userAgent). I mean, there's probably sites using code like this already, why else would IE implement such a user-agent? But then they can't really know which Chrome feature the code is looking for. I guess they are moving from being unfairly excluded from modern standards, to possibly overshooting their target and getting served experimental features they don't support.
- Strom 12y ago
  A poorly written site will perform poorly. The hope is that newer sites (and sites using WineVine DRM are newer, relatively speaking) aren't written as poorly as old ones. Well written sites use feature detection, not user-agent detection. This move by Microsoft addresses problems with older sites, and IE12 supports these older features that the site doesn't belive IE can support.
  - TazeTSchnitzel 12y ago
    Hah, if only it were "older sites". People do user agent sniffing all the time, unfortunately. Thus the massive IE Mobile user agent string.
UnoriginalGuy 12y ago
UA strings need to die a horrible horrible death. "Everyone" should just agree on a standard string and completely stop updating them with anything else (and eventually remove the standard string, in theory). Feature detection is a major step forward HOWEVER sometimes a feature is "supported" but has different incompatible behaviour between browser A and browser B. I feel like that is less common today than it was even four years ago thanks in part to a better working relationship between browser vendors but also due to more comprehensive test suites and people spending time testing new functionality. If they absolutely insist on keeping UA strings then let's wrap them in a Javascript structure. Parsing them is insanely convoluted at this point (which is why many just use .Contains() which has its own issues). Just have e.g. UA.Agent (.Name, .Version, .OS) and UA.CompatibleWith[] (.Name, .Version, .OS).
- toast0 12y ago
  UA strings are increasingly atrocious, but they're still very useful for targeting platforms and reducing the amount of content sent. Eg, if an iPhone browser comes to my site, the FAQ shouldn't show s40 content by default. And when an s40 user comes, the download section shouldn't link to iTunes (and their browser probably doesn't support JavaScript in a meaningful way) It's also helpful to put a splash page up when a specific browser release breaks your site, and users need to down or upgrade. (users who tweak their UA may be wrong targeted in this case, but whatever)
- untog 12y ago
  Agreed. I'd love to use feature detection for everything, but I just can't - particularly on mobile. For instance, the iPhone has a weird caching bug with audio files - there's no feature detection for it, my only option is to sniff what browser we're on and change behaviour. Edge cases like this aren't going to disappear any time soon.
- userbinator 12y ago
  Absolutely. I use a filtering proxy which among other things enables modifying request headers, and I've experimented with a ton of different UA headers over the years; and it's astounding how many sites will fail in mysterious ways if your UA doesn't match one of the ones they're expecting (perhaps this has decreased a bit now with all the diversity in browsers.) In particular, I've noticed that having absolutely no UA header produces the most horrible results: "500 Internal Server Error"s, "we think you are a bot so you have been denied access" (403s are common), and even IP bans. UA strings were intended only as a form of branding/advisory, but I think they're now being used in an unfairly discriminatory way. Denying access because of a "foreign" UA is almost like racial profiling.
joshstrange 12y ago
I alway like to link to this blog post when UA's come up: History of the browser user-agent string - http://webaim.org/blog/user-agent-string-history/ http://webaim.org/blog/user-agent-string-history/
TillE 12y ago
I assume this also means the internal version will be 10.0? Although they're deprecating that API anyway, and telling you to use a bunch of helper functions instead, so maybe it's not too important.
slipstream- 12y ago
This isn't just about the UA string. The NT kernel version in the latest builds of Windows 10 has changed from 6.4 to 10.0 (as first revealed by Chinese leaks), and this article basically confirms it. Make of that what you will.
- anonymfus 12y ago
  Before mods renamed title to "User-agent string changes" it was "...Windows NT value in the UA string will change from 6.4 to 10.0..."
billpg 12y ago
Will it be "Microsoft Internet Explorer/11.0"?
yuhong 12y ago
Part of the reason for the change is that they removed X-UA-Compatible. I would have suggested TridentEdgeOnly/x.x.
ArtDev 12y ago
Microsoft. Your hubris is legendary! Feature detection DOES NOT SOLVE THE PROBLEM! The problem is poor, inconsistent, unreliable and incomplete adoption of features. Moderizr is no help here. Unless Internet Explorer magically can be treated at the same level as modern browsers, we will have to find a way to target it. Without a clear way to do that, we have to use hacks. I hate hacks and workarounds. I hate Internet Explorer.
spdustin 12y ago
I'll post here the same thing I posted on another HN post about user agent strings [0], because it's still relevant. I'll also add that the MS article link artfully dodges the whole "we suck at UA sniffing" issue their own products have. Asp.Net 2.0 (and up to 3.5, which is still framework 2.0) sites use UA sniffing to determine which markup to emit for many built-in controls, like Asp:Menu. When Yosemite / iOS 8 / Safari 8 was released, anyone with a SharePoint 2007/2010 site had their navigation get all screwy. I know first hand how infuriating someone's badly designed UA sniffing can be; it happened to me, and I wrote up a fix for it [1]. Why did it happen in the first place? Where did the UA sniffing fall apart? A poorly designed RegExp looking for "60" in Safari's UA without a word boundary or EOL check. The new Safari UA includes "600" in the relevant section, and suddenly SharePoint sites were sending markup intended for (now) ancient browsers - browsers that weren't even on the compatibility list for SharePoint in the first place. UA sniffing does need to go away for determining what structure your markup sends to the user agent. Edit: linked to earlier comment mentioned at beginning of this one [0]: https://news.ycombinator.com/item?id=8647749 https://news.ycombinator.com/item?id=8647749 [1]: http://blog.sharepointexperience.com/2014/10/did-safari-or-ios-8-break-your-sharepoint-2010-site/ http://blog.sharepointexperience.com/2014/10/did-safari-or-i...

88 points by anonymfus 12y ago

molf 12y ago

Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0 This is getting ridiculous. Every browser is now pretending to be all browsers at the same time, and a simple version change apparently warrants an entire article. Not sending the UA string would avoid this madness. But on the other hand a UA string is great for analytics. Is it possible to come up with some method that discloses information about the user agent which can be used for analytical purposes but cannot be used to change the bahaviour of a web page?

pbhjpbhj 12y ago
Isn't this a trademark infringement? They're using AppleWebKit, Chrome, Safari to identify their product when those terms are protected from use via trademark law. I know this isn't a new thing per se but this seems to be an especially egregious misrepresentation.
- minot 12y ago
  Infringement, as far as I know is a civil matter. Who is going to sue when everyone is doing it?
- freehunter 12y ago
  Is it any more of a trademark infringement than 'IBM PC Compatible'?
- Dylan16807 12y ago
  Will anyone be tricked? No. So not infringement.
- mcbutterbunz 12y ago
  I hope not. The last thing we need is a new round of lawsuits. Maybe everyone can agree on a set of rules for communicating this data.
- lambda 12y ago
  No, because this is not in any way going to cause consumer confusion, but instead is simply used for compatibility purposes.
  - pbhjpbhj 12y ago
    Confusion is the measure used when trademarks aren't registered and is much harder to prove. When considering registered trademarks it's not necessary for confusion to be actually present at all - 100% of customers can know that your product isn't an iPad but if you advertise it as an iPad then you're infringing: it doesn't say "AppleWebKit compatible" in that string and the string is not required to make the browser function at all. If, for example, people offer alternative services to people with an Apple UA string (BBC iPlayer did this) then you're impersonating such tech use via the trademark - it might be now for example that people need to turn off specific iPad enhancements as they break IE11 - that's commercial interference using a trademark. The trademark isn't needed in any technical way for IE to operate as it should, so it's not a compatibility issue. Website content owners can choose to cut out certain browsers if they wish, impersonating another browser is fine .. but if you do that as a company utilising someone else's trademark to do so .. it just has feeling for me of not sitting quite right with what I know of TM law.
    - firepacket 12y ago
      I would think the courts would recognize a difference between advertising to the end user for the purpose of purchase/consumption, and advertising to 3rd parties as part of a compatibility protocol. The UA string is not visible to the consumer, and wouldn't affect the number of people who download and install the browser. Its only purpose is to ensure compatibility with the server after the browser has already been installed. Also I wouldn't say the browser is actually impersonating another browser. If it was trying to impersonate, the UA string would need to match the other browser exactly and it doesn't attempt to do that. The string is still uniquely identifiable as an IE11 UA.
- cma 12y ago
  Sega and/or Nintendo tried to require games to display their trademarks before their system would run them, courts ruled that third parties could use the trademarks to overcome such systems.
userbinator 12y ago
Is it possible to come up with some method that discloses information about the user agent which can be used for analytical purposes but cannot be used to change the bahaviour of a web page? It's called "browser fingerprinting": https://panopticlick.eff.org/ https://panopticlick.eff.org/
ancarda 12y ago
It's useful to know the OS if you want to offer different binaries for each OS. Maybe just "BrowserName/Version (OSName/Version)" so Firefox/35 (Mac OS X/10.10.1)
tacostakohashi 12y ago
One approach would be for browsers to send a string that is along the lines of a uuid generated at compile time, or an MD5 of the executable. That way, analytics vendors or libraries could maintain a database that maps IDs to specific browsers releases, platforms, features, etc if they care about those things enough, but short-sighted web admins would have no hope of doing anything with primitive regex matching of the UA string.
- firepacket 12y ago
  You mean a super cookie? Not only would this violate tracking laws in some areas, but who would ever want to use such a thing?
  - tacostakohashi 12y ago
    No. Generated at the time the browser executable is built (by the vendor, linux distro, etc), and hence shared by all the people using that browser executable. So, only good for identifying the browser, platform, OS and features, and much less so the users.
- tracker1 12y ago
  You're welcome to do just that.. md5(useragent) and keep your own definitions... be mindful that in IE in particular plugins affect the string itself. :-(

Strom 12y ago

I think the more interesting bit is that the new UA value contains all the alternative browser strings as well. Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0

JBiserkov 12y ago
I also read like a history of web browsers: first there was Mozilla, then Apple made WebKit (actually KHTML), then Google created Chrome and ... there will always be a bleading Edge for you to cut yourself :-)
- mpyne 12y ago
  Actually, KDE made KHTML (for the Konqueror web browser), which was then used by Apple to create and evolve WebKit, and you know the story from there. But KHTML wasn't just a code name for WebKit, it actually came from outside Apple.
  - Svip 12y ago
    But KHTML always referred to itself as 'KHTML, like Gecko' to ensure people sniffing for Gecko would be displaying the same HTML for KHTML as Gecko. This is why 'Gecko' remains in all major browsers. Edit: Apparently Internet Explorer also has 'like Gecko'.
- WorldWideWayne 12y ago
  Actually, first there was NCSA Mosaic which came out almost a full two years before Netscape Navigator. The first 6 versions of IE were also based on Mosaic.
  - lclarkmichalek 12y ago
    But what UA did Mosaic use?
    - 12y ago

nly 12y ago

We'd all be better off if they just stopped sending the UA string altogether

kabdib 12y ago
These strings make the parser guy in me just twitch. Do they expect many, many web developers to reliably extract accurate meaning from them?
- dangrossman 12y ago
  Most developers would find and use a library rather than write their own parser. They pretty reliably extract the browser/version/platform/etc from the hundreds of thousands of UA strings you'll see in the wild. https://github.com/tobie/ua-parser https://github.com/tobie/ua-parser https://github.com/browscap/browscap https://github.com/browscap/browscap A user agent parser is built in to the PHP language as well. http://php.net/manual/en/function.get-browser.php http://php.net/manual/en/function.get-browser.php
- xg15 12y ago
  I think it's the other way around. This happens when a field that no-one ever defined a syntax for suddenly gets important and everyone tries to extract meaning from it using arbitrary contains() and substring() acrobatics...
  - kabdib 12y ago
    So it's organic and ill-defined . . . and people are parsing it. Lovely :-)
guardian5x 12y ago
So much this. The UA string is flawed by itself. it shouldn't even be used anymore. The fact that browser manufacturers have to include all sorts of stuff is proof that this system doesn't work.

0x0 12y ago

Do they support NaCl and WebRTC and WebGL and WineVine DRM like Chrome, now that they stuff "Chrome" in their User-Agent? If not, what happens if a site (poorly) detects these features from the user agent?

TazeTSchnitzel 12y ago
Why on earth would you detect those things server-side, given you can do the fallback client-side? Also, no, they don't have those things, aside from WebGL and some form of DRM (not sure if it's the same as Chrome's). The reason they put Chrome in is for sites assuming only Chrome supports web standards (ugh).
- Svip 12y ago
  Gee, just look for 'Gecko' in UA strings. That'll catch 'em.
- 0x0 12y ago
  It could easily happen client-side, with something like /Chrome/.test(navigator.userAgent). I mean, there's probably sites using code like this already, why else would IE implement such a user-agent? But then they can't really know which Chrome feature the code is looking for. I guess they are moving from being unfairly excluded from modern standards, to possibly overshooting their target and getting served experimental features they don't support.
Strom 12y ago
A poorly written site will perform poorly. The hope is that newer sites (and sites using WineVine DRM are newer, relatively speaking) aren't written as poorly as old ones. Well written sites use feature detection, not user-agent detection. This move by Microsoft addresses problems with older sites, and IE12 supports these older features that the site doesn't belive IE can support.
- TazeTSchnitzel 12y ago
  Hah, if only it were "older sites". People do user agent sniffing all the time, unfortunately. Thus the massive IE Mobile user agent string.

UnoriginalGuy 12y ago

UA strings need to die a horrible horrible death. "Everyone" should just agree on a standard string and completely stop updating them with anything else (and eventually remove the standard string, in theory). Feature detection is a major step forward HOWEVER sometimes a feature is "supported" but has different incompatible behaviour between browser A and browser B. I feel like that is less common today than it was even four years ago thanks in part to a better working relationship between browser vendors but also due to more comprehensive test suites and people spending time testing new functionality. If they absolutely insist on keeping UA strings then let's wrap them in a Javascript structure. Parsing them is insanely convoluted at this point (which is why many just use .Contains() which has its own issues). Just have e.g. UA.Agent (.Name, .Version, .OS) and UA.CompatibleWith[] (.Name, .Version, .OS).

toast0 12y ago
UA strings are increasingly atrocious, but they're still very useful for targeting platforms and reducing the amount of content sent. Eg, if an iPhone browser comes to my site, the FAQ shouldn't show s40 content by default. And when an s40 user comes, the download section shouldn't link to iTunes (and their browser probably doesn't support JavaScript in a meaningful way) It's also helpful to put a splash page up when a specific browser release breaks your site, and users need to down or upgrade. (users who tweak their UA may be wrong targeted in this case, but whatever)
untog 12y ago
Agreed. I'd love to use feature detection for everything, but I just can't - particularly on mobile. For instance, the iPhone has a weird caching bug with audio files - there's no feature detection for it, my only option is to sniff what browser we're on and change behaviour. Edge cases like this aren't going to disappear any time soon.
userbinator 12y ago
Absolutely. I use a filtering proxy which among other things enables modifying request headers, and I've experimented with a ton of different UA headers over the years; and it's astounding how many sites will fail in mysterious ways if your UA doesn't match one of the ones they're expecting (perhaps this has decreased a bit now with all the diversity in browsers.) In particular, I've noticed that having absolutely no UA header produces the most horrible results: "500 Internal Server Error"s, "we think you are a bot so you have been denied access" (403s are common), and even IP bans. UA strings were intended only as a form of branding/advisory, but I think they're now being used in an unfairly discriminatory way. Denying access because of a "foreign" UA is almost like racial profiling.

joshstrange 12y ago

I alway like to link to this blog post when UA's come up: History of the browser user-agent string - http://webaim.org/blog/user-agent-string-history/ http://webaim.org/blog/user-agent-string-history/

TillE 12y ago

I assume this also means the internal version will be 10.0? Although they're deprecating that API anyway, and telling you to use a bunch of helper functions instead, so maybe it's not too important.

slipstream- 12y ago

This isn't just about the UA string. The NT kernel version in the latest builds of Windows 10 has changed from 6.4 to 10.0 (as first revealed by Chinese leaks), and this article basically confirms it. Make of that what you will.

anonymfus 12y ago
Before mods renamed title to "User-agent string changes" it was "...Windows NT value in the UA string will change from 6.4 to 10.0..."

billpg 12y ago

Will it be "Microsoft Internet Explorer/11.0"?

yuhong 12y ago

Part of the reason for the change is that they removed X-UA-Compatible. I would have suggested TridentEdgeOnly/x.x.

ArtDev 12y ago

Microsoft. Your hubris is legendary! Feature detection DOES NOT SOLVE THE PROBLEM! The problem is poor, inconsistent, unreliable and incomplete adoption of features. Moderizr is no help here. Unless Internet Explorer magically can be treated at the same level as modern browsers, we will have to find a way to target it. Without a clear way to do that, we have to use hacks. I hate hacks and workarounds. I hate Internet Explorer.

spdustin 12y ago

I'll post here the same thing I posted on another HN post about user agent strings [0], because it's still relevant. I'll also add that the MS article link artfully dodges the whole "we suck at UA sniffing" issue their own products have. Asp.Net 2.0 (and up to 3.5, which is still framework 2.0) sites use UA sniffing to determine which markup to emit for many built-in controls, like Asp:Menu. When Yosemite / iOS 8 / Safari 8 was released, anyone with a SharePoint 2007/2010 site had their navigation get all screwy. I know first hand how infuriating someone's badly designed UA sniffing can be; it happened to me, and I wrote up a fix for it [1]. Why did it happen in the first place? Where did the UA sniffing fall apart? A poorly designed RegExp looking for "60" in Safari's UA without a word boundary or EOL check. The new Safari UA includes "600" in the relevant section, and suddenly SharePoint sites were sending markup intended for (now) ancient browsers - browsers that weren't even on the compatibility list for SharePoint in the first place. UA sniffing does need to go away for determining what structure your markup sends to the user agent. Edit: linked to earlier comment mentioned at beginning of this one [0]: https://news.ycombinator.com/item?id=8647749 https://news.ycombinator.com/item?id=8647749 [1]: http://blog.sharepointexperience.com/2014/10/did-safari-or-ios-8-break-your-sharepoint-2010-site/ http://blog.sharepointexperience.com/2014/10/did-safari-or-i...