Lots of noise about user agent strings

[RobG]

Seems developers of mobile applications are pretty much devoted to UA
sniffing:

<URL: http://wurfl.sourceforge.net/vodafonerant/index.htm >


--
Rob

[Richard Cornford]

Re: Lots of noise about user agent strings

RobG wrote:

Seems developers of mobile applications are pretty much devoted
to UA sniffing:
>
<URL: http://wurfl.sourceforge.net/vodafonerant/index.htm >

Yes, it appears to be someone who has made a serious mistake complaining
about the reality that made it a mistake. Quoting a bit of that page
shows that quite a few false beliefs were behind the mistake:-

| All the way since the inception of the web, HTTP clients have
| had unique User-Agent (UA) strings which let the server know
| who they were. This mechanism was taken over as-is by mobile
| browser manufacturers. While there have been a few exceptions
| due to device manufacturer's sloppiness, it is accurate to say
| that 99.99% of the devices out there have unique UA strings
| which can be associated to brand, model and a bunch of other
| info about the device properties.

HTTP clients have not had unique UA strings for well over a decade now,
and even UA strings that were distinct from others were explicitly
designed to prevent the server from knowing which client was being used
(hence the "Mozilla" bit at the front of IE's UA header, it was put
there only to mislead servers).

And it is absolutely not the case the 99.99% of devices have unique UA
strings. I may not get to look at mobile device browsers that often but
to date the vast majority of the scriptable browsers I have examined
have had UA strings that were more or less indistinguishab le from those
of IE 6.

The bottom line remains that the HTTP specification defines the
User-Agent header as an arbitrary sequence of characters and does not
even require that the sequence of characters be the same for two
consecutive requests, let alone being in any sense unique. Any attempt
to treat something that is specified in that way as a source of
information is going to be a very obvious mistake.

Richard.

[Gregor Kofler]

Re: Lots of noise about user agent strings

RobG meinte:

Seems developers of mobile applications are pretty much devoted to UA
sniffing:
>
<URL: http://wurfl.sourceforge.net/vodafonerant/index.htm >

A real expert:

"All the way since the inception of the web, HTTP clients have had
unique User-Agent (UA) strings which let the server know who they were."

He should probably try to understand web technologies and not write 43kB
of rant.

Gregor


--
http://photo.gregorkofler.at ::: Landschafts- und Reisefotografie
http://web.gregorkofler.com ::: meine JS-Spielwiese
http://www.image2d.com ::: Bildagentur für den alpinen Raum

[VK]

Re: Lots of noise about user agent strings

On May 27, 2:23 pm, Gregor Kofler <use...@gregork ofler.atwrote:

RobG meinte:
>

Seems developers of mobile applications are pretty much devoted to UA
sniffing:

>

<URL:http://wurfl.sourcefor ge.net/vodafonerant/index.htm>

>
A real expert:
>
"All the way since the inception of the web, HTTP clients have had
unique User-Agent (UA) strings which let the server know who they were."

What offense to you have to that?
User-Agent string is intended to let the server know who is requesting
the page, this is why they were created and how they are used since
Mosaic. Is your version being that it is a NCSA invented beatifying
ornament of HTTP request? Sorry to say then that it is utterly wrong
though semi-poetic version.

User-Agent are unique to each browser and each browser version unless
the browser code is manually reverse-engineered and altered by the end
user in violence of EULA. Such situation is definitely possible but
serious solutions do not normally account users surfing the Web with
hacked software: unless it is a special statistics collector.

The Vodafon problem is a problem causing money loss to the involved
MMS / media push providers. The problem is not deadly because the
agent info is not removed but only reformatted - yet such things are
not allowed anyway, the intermediary servers must not be refactoring
HTTP requests. Otherwise one day by typing example.com one will end up
in example.net because some intermediary server's admin will decide
that example.net is better as the target address. It is easy to start
and much harder to stop so, yes, such things should be squeezed out
right at the beginning.

[Holger Jeromin]

Re: Lots of noise about user agent strings

VK schrieb am 27.05.2008 15:50:

On May 27, 2:23 pm, Gregor Kofler <use...@gregork ofler.atwrote:

>RobG meinte:
>>

>>Seems developers of mobile applications are pretty much devoted to UA
>>sniffing:
>><URL:http://wurfl.sourcefor ge.net/vodafonerant/index.htm>

>A real expert:
>>
>"All the way since the inception of the web, HTTP clients have had
>unique User-Agent (UA) strings which let the server know who they were."

>
What offense to you have to that?
User-Agent string is intended to let the server know who is requesting
the page, this is why they were created and how they are used since
Mosaic. Is your version being that it is a NCSA invented beatifying
ornament of HTTP request? Sorry to say then that it is utterly wrong
though semi-poetic version.
>
User-Agent are unique to each browser and each browser version unless
the browser code is manually reverse-engineered and altered by the end
user in violence of EULA. Such situation is definitely possible but

Opera was shipped a while in the default config of cloning IE6 to avoid
user problems.

serious solutions do not normally account users surfing the Web with
hacked software: unless it is a special statistics collector.

i dont think all those opera users hacked their software .-)

--
Mit freundlichen Grüßen
Holger Jeromin

[VK]

Re: Lots of noise about user agent strings

On May 27, 6:48 pm, Holger Jeromin <news03_2...@ka tur.dewrote:

Opera was shipped a while in the default config of cloning IE6 to avoid
user problems.

Opera never was shipped User-Agent string _cloning_ any of existing IE
User-String. In some older releases Opera's User-Agent string was
partially altered to contain some keywords most oftenly used for
server-side or client-side IE detection so it had "MSIE" and
"Microsoft Internet Explorer" in it. It still was vendor-specific
enough to detect Opera if one was targeted to detect exactly Opera and
not IE.

Opera is not alone nor it is the champion in this producer-humiliating
activity. All time the best in my collection are remaining some
releases of Safari with User-Agent string - and I'm not kidding -
"Mozilla/5.0 MSIE Microsoft Internet Explorer like Gecko; KHTML..."
with the part after KHTML giving the actual Safari-specific info.
Sometimes when I am depressed this "Microsoft Internet Explorer like
Gecko" cheers me up. :-)

In any case the User-Agent spoofing business faded out way of time ago
as the "brand putting down" impact proved to be much higher than any
possible immediate benefits.

For the client-side there is also navigator.vendo r string which is
more easy to parse for the producer name. It is not relevant for the
original Vodafon topic.

[Gregor Kofler]

Re: Lots of noise about user agent strings

VK meinte:

What offense to you have to that?
User-Agent string is intended to let the server know who is requesting
the page, this is why they were created and how they are used since
Mosaic. Is your version being that it is a NCSA invented beatifying
ornament of HTTP request? Sorry to say then that it is utterly wrong
though semi-poetic version.

It isn't even "beautifyin g".

User-Agent are unique to each browser and each browser version unless
the browser code is manually reverse-engineered and altered by the end
user in violence of EULA.

A-ha. How come, that Firefox explicitly allows me to set my UA
identification string to whatever I want?

[fantasizing what is allowed and what not snipped]

Gregor


--
http://photo.gregorkofler.at ::: Landschafts- und Reisefotografie
http://web.gregorkofler.com ::: meine JS-Spielwiese
http://www.image2d.com ::: Bildagentur für den alpinen Raum

[VK]

Re: Lots of noise about user agent strings

On May 27, 8:55 pm, Gregor Kofler <use...@gregork ofler.atwrote:

A-ha. How come, that Firefox explicitly allows me to set my UA
identification string to whatever I want?

You are sounding like a child, really: "Look ma', I have just pulled
out a wheel out of my new toy car!. Am I cool or what?" :-)

I have no intention to stop you from your hacking exercises. After
Firefox is done

http://www.beatnikpad.com/archives/2006/10/28/how-to-change-the-user-agent-in-firefox

please feel free to start pulling out another wheel :-)

http://www.pctools.com/guides/registry/detail/799/

As I said before it is perfectly possible in this or another way for
absolutely any browser on the market. Another question that it has no
relation to the real Web development. The amount of users going
through the User-Agent string change doesn't exceed the amount of
other inadequately acting groups of Web surfers: Lynx users, self-made
browser users, officially registered psycho cases with Internet
access: and other inevitable small shrink one has to expect in any
business involved with a big amount of people.

There is one puzzling point that bothers while reading similar to that
discussions. It is a bit OT to OP but overall fits well into User-
Agent string questions.
Let's us imagine that the cell phone radio pollution indeed did get
some unexpected brain cells damage effect - so every single user in
the world first thing of all finds the appropriate hack for her
proffered browser and changing the current User-Agent string to "There
is no Web, there is only Xul". Therefore server-side detection and
User-Agent detection as such become totally unreliable. The only hope
is the client-side feature detection (and a few remaining sane doctors
searching a remedy from the brain disease). So the dream of some came
true. Cool. I just have one small question:
Look at the User-Agent hacks for Firefox or at IE. Now look at this
chunk of code:
document.getFoo bar = new Function;
window.alert(ty peof document.getFoo bar);
or
document.getFoo bar = new Object;
window.alert(ty peof document.getFoo bar);
So now the question: who and why had decided that much more labor and
skill intensive procedure will be most probably used - but an easy
like a moo-cow runtime feature spoofing will never be? Was it some
common "internal feeling" or at least once there was a reasonable
discussion on the subject? What were the arguments? Thank you in
advance.

[Gregor Kofler]

Re: Lots of noise about user agent strings

VK meinte:

On May 27, 8:55 pm, Gregor Kofler <use...@gregork ofler.atwrote:

>A-ha. How come, that Firefox explicitly allows me to set my UA
>identificati on string to whatever I want?

>
You are sounding like a child, really: "Look ma', I have just pulled
out a wheel out of my new toy car!. Am I cool or what?" :-)
>
I have no intention to stop you from your hacking exercises.

As I said before it is perfectly possible in this or another way for
absolutely any browser on the market.

In case you forgot, 4 hours 21 minutes earlier you stated:

"User-Agent are unique to each browser and each browser version unless
the browser code is manually reverse-engineered and altered by the end
user in violence of EULA."



--
http://photo.gregorkofler.at ::: Landschafts- und Reisefotografie
http://web.gregorkofler.com ::: meine JS-Spielwiese
http://www.image2d.com ::: Bildagentur für den alpinen Raum

[RobG]

Re: Lots of noise about user agent strings

On May 27, 8:23 pm, Gregor Kofler <use...@gregork ofler.atwrote:

RobG meinte:
>

Seems developers of mobile applications are pretty much devoted to UA
sniffing:

>

<URL:http://wurfl.sourcefor ge.net/vodafonerant/index.htm>

>
A real expert:
>
"All the way since the inception of the web, HTTP clients have had
unique User-Agent (UA) strings which let the server know who they were."
>
He should probably try to understand web technologies and not write 43kB
of rant.

The complaint is based on the belief that the UA string is the only
viable way to reliably deliver web content and downloads to mobile
devices. The owners of these sites want users to be able to download
games, software, ringtones, etc. to their mobile devices and have
confidence that they should work.

As a result, they have a database of thousands of UA strings that are
used to identify the browser and device and attempt to deliver
appropriate content.

It seems to me that they've ignored the simplest of solutions, which
might include delivering small test downloads so the user can discover
what works on their device (or not), or to just ask the user what
device they are using.

I don't have any experience in developing or using such sites, I was
wondering if anyone here has and can comment on the situation.



--
Rob

[Peter Michaux]

Re: Lots of noise about user agent strings

On May 28, 3:37 pm, "Richard Cornford" <Rich...@litote s.demon.co.uk>
wrote:

[snip]

That illustrates why UA strings are not a viable means of identifying
web browsers

If you were a system administrator and you wanted to send gzipped
JavaScript files to save bandwidth, how would you determine which
browsers could accept gzipped files and which could not? I have only
read explanations how to do this with the user agent string. I have
some ideas but have never tried any of them. For example, send a
gzipped file and then a non-gzipped file to see if the first file
worked. I'm curious what you would do or if you have any experience
with this area where user agent string is used.

[snip]

Peter

[RobG]

Re: Lots of noise about user agent strings

On May 29, 12:22 pm, Peter Michaux <petermich...@g mail.comwrote:

On May 28, 3:37 pm, "Richard Cornford" <Rich...@litote s.demon.co.uk>
wrote:
>
[snip]
>

That illustrates why UA strings are not a viable means of identifying
web browsers

>
If you were a system administrator and you wanted to send gzipped
JavaScript files to save bandwidth,

Many people consider bandwidth to be bytes sent by the server, whereas
it should be measured as bits transmitted by the modem after the
addition of network stuff and compression.

I asked about this on the Apache news group (figuring they'd be a
suitably open-minded and knowledgable lot) and got two responses, the
one I listened to suggested it is pointless zipping files because:

1. modems are optimised to compress text for transmission and so
likely compress files better (or at least no worse) than general
purpose compression programs

2. letting the modem do the work saves CPU effort at both ends

3. if the file is zipped before transmission, subsequent modem
compression may actually result in more data to transmit (though
likely not much more)

Anyhow, here's a link:

<URL:
http://groups.google.com.au/group/al...55117c72c4b5e0

>

how would you determine which
browsers could accept gzipped files and which could not? I have only
read explanations how to do this with the user agent string. I have
some ideas but have never tried any of them. For example, send a
gzipped file and then a non-gzipped file to see if the first file
worked. I'm curious what you would do or if you have any experience
with this area where user agent string is used.

There is an Open Mobile Alliance (OMA) user agent profile
specification that UAs can use to transmit capability and preference
information:

<URL: http://www.openmobilealliance.org/te...20011020-a.pdf

>

It is supposed to be used by developers of WAP and other mobile-
specific sites to identify device characteristics and then serve
appropriate content. The fact that projects like WURFL seem to be
more popular for such things shows that developers don't trust the
profile information to do the job.

Whether UA string or agent profiles are used, it seems that feature
detection has been abaondoned (perhaps it was never seen as a serious
contenter) as a strategy for determining mobile UA capability.

Maybe feature detection is employed as a second strategy for minor
irregularities and after device capability has already been defined
(or assumed) fairly precisely (where "precisely" is used in its
mathematic sense, which is quite different to "accurately ").


--
Rob

[Gordon]

Re: Lots of noise about user agent strings

On May 27, 7:11 pm, VK <schools_r...@y ahoo.comwrote:

On May 27, 8:55 pm, Gregor Kofler <use...@gregork ofler.atwrote:
>
Lots of rantage demonstrating a total lack of understanding of how browsers work snipped

You know, it's better to remain silent and be thought a fool than to
open your mouth and remove all doubt.

[Henry]

Re: Lots of noise about user agent strings

On May 29, 9:40 am, Gordon wrote:

On May 27, 7:11 pm, VK wrote:

>Lots of rantage demonstrating a total lack of understanding
>of how browsers work snipped

>
You know, it's better to remain silent and be thought a fool
than to open your mouth and remove all doubt.

But would a fool recognise that even when told?

[Peter Michaux]

Re: Lots of noise about user agent strings

On May 28, 9:27 pm, RobG <rg...@iinet.ne t.auwrote:

On May 29, 12:22 pm, Peter Michaux <petermich...@g mail.comwrote:
>

On May 28, 3:37 pm, "Richard Cornford" <Rich...@litote s.demon.co.uk>
wrote:

>

[snip]

>

That illustrates why UA strings are not a viable means of identifying
web browsers

>

If you were a system administrator and you wanted to send gzipped
JavaScript files to save bandwidth,

>
Many people consider bandwidth to be bytes sent by the server, whereas
it should be measured as bits transmitted by the modem after the
addition of network stuff and compression.
>
I asked about this on the Apache news group (figuring they'd be a
suitably open-minded and knowledgable lot) and got two responses, the
one I listened to suggested it is pointless zipping files because:
>
1. modems are optimised to compress text for transmission and so
likely compress files better (or at least no worse) than general
purpose compression programs
>
2. letting the modem do the work saves CPU effort at both ends

I didn't know modems do this. There must be a standard compression
algorithm to ensure the receiver knows how to decompress.

3. if the file is zipped before transmission, subsequent modem
compression may actually result in more data to transmit (though
likely not much more)
>
Anyhow, here's a link:
>
<URL:http://groups.google.com.au/group/al...ion/browse_frm...

Hmm. This is quite contrary to the current popular thought about
gzipping JavaScript before sending it over the wire.

Steve Souders works for Yahoo!'s performance team and has made many
experiments. I believe he watches total page load time in Firebug and
so that would include modem decompression time. You can see in the
Editorial Review section of the following page there are 14 rules to
speed a page.

<URL: http://www.amazon.com/dp/0596529309>

One of the rule is gzip components.

More confusion added to the pile.

Another issue is that files do not need to be compressed "on the fly"
by the server. They can be pre compressed and if the client can handle
the compressed version then that is the one sent.

[snip]

Peter