Subject: Unified User-Agent String (draft-karcz-uuas)

From: Mateusz Karcz <[email-masked]>
Date: Fri, 14 Nov 2014 19:37:19 +0100

Welcome.

My name's Mateusz Karcz and I'm an author of the Internet Draft titled "Unified User-Agent String" ( full text: https://tools.ietf.org/html/draft-karcz-uuas-01 ). The main goal of this proposal is simplifying and clarifying the content of the User-Agent HTTP header field, while maintaining the existing possibility of its use and preserving validity of existing implementations.

Since the first revision of this draft I've changed the construction of it, simplified proposed UUAS structure, made a research about security and applied some other, minor changes. In the AppsAWG I've got some advice and I know that I need to correct some claims in the first section of the document. I need also to make a minor change in the formal definition.

In the AppsAWG I've also got advice to propose my draft here because it relates to the HTTP and (if accepted) it's going to update RFC7231, which has been created here. I would like to know what is Your opinion about this document. I would also like to know if there is any possibility of co-creation of this document with the HTTPBis working group.

Sincerely
M. Karcz

---

From: "Walter H." <[email-masked]>
Date: Fri, 14 Nov 2014 22:17:34 +0100

Hello,

the example in your draft:
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

would it be ok for you, when the real system is not a Windows (here Win8.1)?
I mean when someone fakes the User-Agent as a security reason?

my User-Agent:  "Mozilla/5.0 (UNIX; U; Cray X-MP/48; en-US; rv:2.71) 
Gecko/20110929 HbbTV/1.1.1 (;;;;;)"

Greetings,
Walter

---

From: Daniel Stenberg <[email-masked]>
Date: Fri, 14 Nov 2014 23:54:28 +0100 (CET)

On Fri, 14 Nov 2014, Mateusz Karcz wrote:

> My name's Mateusz Karcz and I'm an author of the Internet Draft titled 
> "Unified User-Agent String" ( full text: 
> https://tools.ietf.org/html/draft-karcz-uuas-01 ). The main goal of this 
> proposal is simplifying and clarifying the content of the User-Agent HTTP 
> header field, while maintaining the existing possibility of its use and 
> preserving validity of existing implementations.

While an interesting exercise, do you have any HTTP client/browser authors 
backing up this idea and syntax?

This seems like a futile effort to me with little hope of adaption. I'm the 
author of a HTTP client using the simplest possible User-agent but I'm also 
fully aware of how often users have to mimic popular browsers' user-agent 
strings to make servers respond appropriately.

There's a lot of pain and many side-effects in doing even minor modifications 
of the user-agent string.

-- 

  / daniel.haxx.se

---

From: "Martin Nilsson" <[email-masked]>
Date: Sat, 15 Nov 2014 09:17:18 +0100

On Fri, 14 Nov 2014 23:54:28 +0100, Daniel Stenberg <[email-masked]> wrote:

>
> While an interesting exercise, do you have any HTTP client/browser  
> authors backing up this idea and syntax?
>
> This seems like a futile effort to me with little hope of adaption. I'm  
> the author of a HTTP client using the simplest possible User-agent but  
> I'm also fully aware of how often users have to mimic popular browsers'  
> user-agent strings to make servers respond appropriately.
>
> There's a lot of pain and many side-effects in doing even minor  
> modifications of the user-agent string.
>

On the apps-discuss list it was stated that all major browsers already  
conformed to this specification, which makes it easy to conform to, but  
also a bit pointless.

If we could get agreement on a single user-agent string and have all  
browsers move to that one at the same time, that would be a standard I  
would be enthusiastic to endorse. An agreement in a secret back room would  
do just as fine as a standard I suppose...

/Martin Nilsson

-- 
Using Opera's revolutionary email client: http://www.opera.com/mail/

---

From: Amos Jeffries <[email-masked]>
Date: Sat, 15 Nov 2014 22:46:50 +1300

On 15/11/2014 9:17 p.m., Martin Nilsson wrote:
> On Fri, 14 Nov 2014 23:54:28 +0100, Daniel Stenberg wrote:
> 
>> 
>> While an interesting exercise, do you have any HTTP
>> client/browser authors backing up this idea and syntax?
>> 
>> This seems like a futile effort to me with little hope of
>> adaption. I'm the author of a HTTP client using the simplest
>> possible User-agent but I'm also fully aware of how often users
>> have to mimic popular browsers' user-agent strings to make
>> servers respond appropriately.
>> 
> On the apps-discuss list it was stated that all major browsers
> already conformed to this specification, which makes it easy to
> conform to, but also a bit pointless.
> 
> If we could get agreement on a single user-agent string and have
> all browsers move to that one at the same time, that would be a
> standard I would be enthusiastic to endorse. An agreement in a
> secret back room would do just as fine as a standard I suppose...

It would be even better if browsers just started to conform to RFC
7231 section 5.5.3. There is no conspired agreement or timing required
on their part to do so.

* "MUST NOT generate advertising or other nonessential information
within the product identifier"

no dumping comments about OS version, unrelated software installed,
other browsers installed!, patch levels, etc.
 "Mozilla/" is conformant but realistically unnecessary these days as
it can readily be inferred from the browser Product/x.y identifier
instead.

* "SHOULD limit generated product identifiers to what is necessary to
identify the product"

no dumping "like Gecko", "like Konquerer", "like Firefox" , "like
Chrome" into the UA string.

The draft-karcz-uuas as written does nothing to advance improvement of
U-A usage over RFC 7231, and in fact the browser-string section goes
so far as to recommend violations of the RFC 7231 requirements.

PS. Apparently the browser "like" is winning the browser war for
market share. No matter how much advertizing or downloads the other
so-called mainstream browsers put out this product just keeps coming
out on top. ;-P

Amos

---

From: "Walter H." <[email-masked]>
Date: Sat, 15 Nov 2014 13:42:48 +0100

> within the product identifier"
good argument; but be aware of conforming to
http://www.etsi.org/deliver/etsi_ts/102700_102799/102796/01.01.01_60/ts_102796v010101p.pdf 

section 7.3.2.4
> * "SHOULD limit generated product identifiers to what is necessary to
the server MUST NOT rely on the informations it gets from the 
User-Agent; there is no reason to do so ...
a website admin has done ugly bad work, if it does ...

e.g.
(www.)domain.tld can present its content in a normal standard way 
without knowledge of the User-Agent;

if there is a neccessarity to present the same content in a special way 
for mobile devices *), than this can
be done by just offering another host, e.g.  mobile.domain.tld

on the other hand, when some website means he/she must use the whole 
screen, even with very high resolutions of more
  than 2048x1536; this is a total design failure, because browsing in a 
windows, just using a piece of
the whole screen MUST be possible ...

*) this is most time because of the high fees of using the mobile 
device; so there is nearly no junk-content;
except at some online offerings from some TV broadcasts where mobile 
devices - because of there UA get
higher quality video content than just normal desktop pcs with big 
monitors ...

Walter