Subject: Re: Issue 166: clarify term "User Agent" and resolve inconsistencies with W3C specs

From: Julian Reschke <[email-masked]>
Date: Mon, 05 Dec 2011 22:26:15 +0100

On 2009-06-03 09:48, Mark Nottingham wrote:
> I'd agree the chosen terminology isn't great. Not sure that changing it
> wouldn't cause more proplems than it solves.
> ...

We had a off-list conversation with Larry, and he suggested text leaving 
the definition as-is, but adding a note make it clearer that in
HTTP, "user agent" can also mean "autonomous client".

Proposed text: 
<http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/166/166.diff>.

The new paragraph would be:

"Note: The term 'user agent' covers both those situations where there is 
a user (human) interacting with the software agent (and for which user 
interface or interactive suggestions might be made, e.g., warning the 
user or given the user an option in the case of security or privacy 
options) and also those where the software agent may act autonomously."

Feedback appreciated, Julian

---

From: Willy Tarreau <[email-masked]>
Date: Mon, 5 Dec 2011 23:11:05 +0100

Hi Julian,

> options) and also those where the software agent may act autonomously."

The long sentence between parenthesis is not easy to parse but I have no
proposal for anything better. Anyway, once you get it, everything is clear.

+1 for me.

Best regards,
Willy

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 6 Dec 2011 09:35:45 +1100

+1

On 06/12/2011, at 8:26 AM, Julian Reschke wrote:

> We had a off-list conversation with Larry, and he suggested text leaving the definition as-is, but adding a note make it clearer that in
> Proposed text: <http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/166/166.diff>.
> 
> "Note: The term 'user agent' covers both those situations where there is a user (human) interacting with the software agent (and for which user interface or interactive suggestions might be made, e.g., warning the user or given the user an option in the case of security or privacy options) and also those where the software agent may act autonomously."
> 

--
Mark Nottingham   http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Mon, 05 Dec 2011 23:52:44 +0100

OK, applied with 
<http://trac.tools.ietf.org/wg/httpbis/trac/changeset/1488>.

---

From: Karl Dubost <[email-masked]>
Date: Thu, 8 Dec 2011 14:22:30 -0500

> Feedback appreciated, Julian

if not too late, another suggestion.

"Note: The term 'user agent' is generic. It can be a software 
controlled by a human (including user interactions such as 
warnings, privacy and security options, etc.) and it can also 
be an autonomous software. The term 'client' is also often used."

-- 
Karl Dubost - http://dev.opera.com/
Developer Relations & Tools, Opera Software

---

From: Julian Reschke <[email-masked]>
Date: Thu, 08 Dec 2011 20:32:21 +0100

On 2011-12-08 20:22, Karl Dubost wrote:
>> Proposed text:<http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/166/166.diff>.
>>

I'd like to avoid re-opening, unless we have broad consensus that this 
is better...

> be an autonomous software. The term 'client' is also often used."

Best regards, Julian

---

From: Larry Masinter <[email-masked]>
Date: Thu, 8 Dec 2011 11:55:08 -0800

I think Karl's rewording is worse. The point I really wanted to make was that documents that follow HTTP terminology often make the mistake of assuming a "user agent" has a "user".

But if "client" means the same thing as "user agent", then why have a separate term?

I just gave up on trying to fix this since no one wanted to do the work of changing "user agent" to "client" throughout the document, which might otherwise be necessary.

Larry
--
http://larry.masinter.net

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Thursday, December 08, 2011 11:32 AM
To: Karl Dubost
Cc: Mark Nottingham; Daniel Stenberg; Roy T. Fielding; HTTP Working Group; Larry Masinter
Subject: Re: Issue 166: clarify term "User Agent" and resolve inconsistencies with W3C specs

> if not too late, another suggestion.

I'd like to avoid re-opening, unless we have broad consensus that this is better...

> controlled by a human (including user interactions such as warnings, 
> privacy and security options, etc.) and it can also be an autonomous 
> software. The term 'client' is also often used."

Best regards, Julian

---

From: Karl Dubost <[email-masked]>
Date: Thu, 8 Dec 2011 15:33:08 -0500

> I think Karl's rewording is worse. The point I really wanted to make was that documents that follow HTTP terminology often make the mistake of assuming a "user agent" has a "user".

Ahah! I didn't have the initial context. :)

> But if "client" means the same thing as "user agent", then why have a separate term?

I would rather prefer client everywhere too.

What wikipedia says: 

	In computing, a user agent is a client application 
	implementing a network protocol used in communications 
	within a client–server distributed computing system.
	— http://en.wikipedia.org/wiki/User_agent

---

From: "William A. Rowe Jr." <[email-masked]>
Date: Thu, 08 Dec 2011 14:27:57 -0800

> 	— http://en.wikipedia.org/wiki/User_agent

We just had this discussion at the ASF httpd project.

In a proxy chain, each proxy server is a user agent itself reaching
out to the next server in the chain.  It is possible to describe
these each as clients, but when you start looking at end-to-end
definitions, "client" suggests the originating user agent (app, or
browser, or service).

So UA and client do have distinct connotations.

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 9 Dec 2011 09:41:44 +1100

That's exactly backwards from how we have always used the terms in HTTP -

1945:

>    client
> 
>        An application program that establishes connections for the
>        purpose of sending requests.
> 
>    user agent
> 
>        The client which initiates a request. These are often browsers,
>        editors, spiders (web-traversing robots), or other end user
>        tools.

2068:

>    client
>       A program that establishes connections for the purpose of sending
>       requests.
> 
>    user agent
>       The client which initiates a request. These are often browsers,
>       editors, spiders (web-traversing robots), or other end user tools.

2616:

>    client
>       A program that establishes connections for the purpose of sending
>       requests.
> 
>    user agent
>       The client which initiates a request. These are often browsers,
>       editors, spiders (web-traversing robots), or other end user tools.

---

From: "William A. Rowe Jr." <[email-masked]>
Date: Thu, 08 Dec 2011 15:43:01 -0800

>>       editors, spiders (web-traversing robots), or other end user tools.

I'm very glad you pointed this out, as we are in a good point in time
to fix it (nothing was baked yet).

Thanks.

---

From: Larry Masinter <[email-masked]>
Date: Thu, 15 Dec 2011 14:47:39 -0800

I think there was originally a distinction between "User Agent" and "Client" but that there is now broad use of "User Agent" for Client in HTTP, to the extent that "User Agent" is often taken to mean "HTTP client". 

I'm not sure this broad misuse extends to other protocols.

Agent (in computing) is a generic term that generally refers to software that does work on behalf of a person or another agent.
In the IETF (since IETF focused on network protocols), an agent was software at one of the endpoints of communication.

A "client" is an agent that acts as the initiator of a protocol transaction in a client-server relationship. (The 'server' is an agent that runs autonomously, and the 'client' invokes those actions.)

A "user agent" then is an agent with a "user", and in particular, an "end user".

I don't think the misuse of 'user agent' to cover clients of other client-server protocols extends outside HTTP... does it?

Unfortunately, this use continues even in the latest HTTP documents.

What wikipedia says: 

	In computing, a user agent is a client application 
	implementing a network protocol used in communications 
	within a client-server distributed computing system.
	- http://en.wikipedia.org/wiki/User_agent

I think this is wrong.  In HTTP (currently) the term "user agent" was misused for "client" because in the early implementations of the web, the only clients were user agents, and by the time anyone imagined other clients than those that were user-agents, the "user-agent:" header was fixed and it made no sense to rename it.

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 16 Dec 2011 10:03:54 +1100

Larry,

"user agent" and "client" are definitely distinct in the documents.

A client is one party to client/server relationship, scoped by a connection. Proxies are clients. Gateways are clients. And, User Agents are clients.

A user agent is a special kind of client; it's the one that originated the client.

Browsers are user agents. So are spiders, etc.

I think you may be getting hung up on "user", always mapping that to a live human in front of a keyboard at the time that the request is made. This isn't necessarily the case -- sometimes the live human at the keyboard does their keyboarding at some other time.

This is true even when the UA *is* a browser; consider all of the automatic updates and background checks that browsers tend to do these days.

As I think Julian has asked, it would be helpful if you could identify *specific* parts of the documents where it's important to distinguish between at-the-keyboard-now and at-the-keyboard-sometime.

Cheers,

---

From: David Morris <[email-masked]>
Date: Thu, 15 Dec 2011 16:04:20 -0800 (PST)

This is just so much arguing about the number of angels that can fit on 
the head of a pin. In the HTTP world, the terms "User Agent", "Agent" and 
"Client" are all munged together such that making a distinction requires
making arguments which don't hold together. More below ....

> "user agent" and "client" are definitely distinct in the documents.

Since the very early days, the distinction has never held up in my mind.

> 
> A client is one party to client/server relationship, scoped by a
> connection. Proxies are clients. Gateways are clients. And, User Agents
> are clients.

Using the assertion below that spiders are "User Agents", I assert that
proxies and gateways are also user agents because they never take action
without the action of a user at some point in time.

> A user agent is a special kind of client; it's the one that originated the client.

All clients are user originated.

> I think you may be getting hung up on "user", always mapping that to a
> live human in front of a keyboard at the time that the request is made.
> This isn't necessarily the case -- sometimes the live human at the
> keyboard does their keyboarding at some other time.

I think the whole world is confused by this attempt to distinguish client
vs. user agent. In the HTTP world, everything request is in response to
a user action, including the hidden update and news feed actions
by a browser.

> This is true even when the UA *is* a browser; consider all of the
> automatic updates and background checks that browsers tend to do these
> days.
> 
> As I think Julian has asked, it would be helpful if you could identify 
> *specific* parts of the documents where it's important to distinguish 
> between at-the-keyboard-now and at-the-keyboard-sometime.

I don't know that there is a way to improves things short of wholesale
replacement of user agent with client or vice versa. Or some new
term.

Essentially, there are synchronous clients and asynchronous clients. We
generally tried very hard to not dictate how errors should be handled
by the client software.

Even synchronous clients (user@keyboard) may have active software
(e.g., javascript, flash, java applets, etc.) which intercept
error conditions and take actions on behalf of some user who may
not be the user at the keyboard. The whole User Agent vs. Client
distinction is not useful in helping folks understand the protocol
and requirements for robust interoperation.

---

From: Jan Algermissen <[email-masked]>
Date: Fri, 16 Dec 2011 01:44:37 +0100

Hi,

On Dec 16, 2011, at 1:04 AM, David Morris wrote:

> The whole User Agent vs. Client

I think it is because it helps to differentiate connector (client) from component (user agent). Much of the HTTP spec deals with stuff that regards correct connector implementation, but, e.g. headers such as User-Agent or Accept apply to the user agent and its capabilities.

I think that the HTTP spec can contribute to correct use of HTTP by emphasizing that a user agent is a software component that takes actions on behalf of a user and is not just constructing HTTP requests and receiving responses (that is what the client does).

Jan

[1] Such as 'GETing all resources referenced by HTML <img>-elements and embedding them in the rendered page' or 'GET article details from diverse sites, compare prices and initiate order of cheapest article'

---

From: Larry Masinter <[email-masked]>
Date: Thu, 15 Dec 2011 16:58:02 -0800

..., it would be helpful if you could identify *specific* parts of the documents where it's important to distinguish between at-the-keyboard-now and at-the-keyboard-sometime.

As I said, I think the problem is less with the HTTP documents than it is with other specification writers who are not careful to distinguish client-with-user and autonomous clients.  But...

http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-17

   o  Clients which have been idle for an extended period following
      which the server might wish to cause the client to reprompt the
      user for credentials.

"if they have one"?  The server causes the client to???

  If the 401 response contains the same challenge as the
   prior response, and the user agent has already attempted
   authentication at least once, then the user SHOULD be presented the
   representation that was given in the response, since that
   representation might include relevant diagnostic information.

Getting terminology wrong leads to thinkos.

Larry

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 23 Dec 2011 22:21:31 -0500

On 15/12/2011, at 7:58 PM, Larry Masinter wrote:

> Getting terminology wrong leads to thinks.

Thanks Larry, I think that's a bug.

--
Mark Nottingham
http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Tue, 27 Dec 2011 20:11:01 +0100

>> "if they have one"?  The server causes the client to???

Adding more context:

6.1. Authentication Credentials and Idle Clients

    Existing HTTP clients and user agents typically retain authentication

...that's a bug; user agents are clients in our terminology. Remove "and 
user agents"?

    information indefinitely.  HTTP/1.1 does not provide a method for a
    server to direct clients to discard these cached credentials.  This
    is a significant defect that requires further extensions to HTTP.
    Circumstances under which credential caching can interfere with the
    application's security model include but are not limited to:

Is there a problem here except that there maybe no user around (as Larry 
pointed out)?

(note that the above isn't normative text but just examples in the 
Security Considerations; I'm not sure something needs to be fixed here).

> Thanks Larry, I think that's a bug.

...assuming there's a user? How do we rephrase it? "interactive user agent"?

Best regards, Julian