I thought it was interesting when I read, not too long ago, that Google had decided to lead the charge against tailoring content based on useragent strings. It’s about time that this practice fade into oblivion!
Each browser sends an identifier known as a useragent string with HTTP requests, but there’s no standard format, and it’s become a convoluted mess. Consider Google’s own useragent from Chrome:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3835.0 Safari/537.36
Look at all the things it’s claiming to be. Mozilla, first of all, which is not true. AppleWebKit, which is also not true, including AppleWebKit’s claim to be KHTML, which is also also not true, both when Apple claims it and when Chrome claims it while claiming to be Apple. Blink was forked from WebKit, which was forked from KHTML, but it’s not either of them. Finally, it claims to be Safari, which is not true.
Chrome is the de facto standard browser for most people, and each time it connects, it claims to be four things it is not!
It’s been an insane mess for years, and it’s been famously lampooned by a humor piece called “History of the User-Agent string.” That piece was written in 2008, and you’d hope that by now, things would have gotten better. If it had, would Google feel compelled to try to get rid of it?
Yes, Google, the owner of Youtube, where I just got a message in my fully-updated Waterfox Classic:
Wait, when did YouTube or Google ever give people support for Waterfox? I’m not interested in any support from the likes of them; if I have an issue, I will sort it out on my own, thanks.
Somehow, I think they’re using that “other” definition of “support” once again.
The same company that recognizes the stupidity of useragent string sniffing enough to try to use their influence as developer of the most used browser in the world to eradicate it… is using the practice themselves.
Notice that there’s no close box. You have to follow the link and press “remind me later,” the only choice. “Don’t bother me with this nonsense ever again” is noticeably absent. Not that it would work, in my case, as Google cookies have a very short life expectancy on my PC. I can get rid of the offending message by hiding that element with uBlock Origin, but if YouTube decides to be dumb about it like Chase and Netflix, I will have to spoof the useragent with them too. If they actually want to make the site rely on features that don’t exist in Waterfox Classic, that’s even worse– accessibility demands that a site work with any browser a user wishes to use, down to the text-only Lynx or a browser without Javascript. Many sites ignore this, but the likes of Google, synonymous with the web for many people, should do better than that.
Spoofing the useragent string is simple, but the ease with which it can be done illustrates one of the reasons useragent sniffing is bad practice. It’s unreliable. I can claim to be any browser I want, including the Google web indexing bot (which can supposedly penetrate paywalls in some cases). If they want to use certain features that only some browsers offer, detect these features directly, and if they don’t exist, deliver the error based on the actual failure of my browser to work.
Other times, it gives the nannybot at the site in question the wrong idea. They see the bit of Waterfox Classic’s useragent string that suggests it’s Firefox 56 (that was the version from which Waterfox classic was forked), and they think I am using a long-neglected installation of Firefox. If the sniffer script is not programmed specifically to look for “Waterfox,” all it will see is the “Firefox/56” bit, and it will get the wrong idea. The same’s true for any other of the many browsers that identify as themselves, but do not have enough market share to make it worth it for the writers of the scripts to specifically look for them. Because each browser claims to be lots of things, rather than concluding that a browser the script does not know is an unknown browser, it will think the browser is the most recent of the other things the script recognizes that the browser claims to be in the useragent string.
I’m actually using a browser that is completely up to date, not that it’s any business of anyone, but I keep getting told that I’m out of date by scripts that know a lot less about what I am using than I do.
As I mentioned, the services offered by a web giant like Google should generally work with any browser, but sometimes there are specific features that are needed, like a new version of TLS encryption that a given banking site may require when the older ones are found to be insecure. Now that Flash is all but gone, requiring HTML 5 to view videos on YouTube would similarly make sense. Any lack of browser features short of that should degrade gracefully, allowing the rest of the features to work, just not the ones required by the feature in question. Simply denying access blindly because of an easily-misparsed useragent string is almost always the worst way of going about it.
Google, and all you other sniffers, out there: Stop!
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)