Re: [perpass] HTTP user-agent fingerprinting

On Sep 13, 2013, at 1:51 PM, Poul-Henning Kamp wrote:

> In message <826E49BC-8F03-43DA-9B19-62F5C999B5C1@gbiv.com>, "Roy T. Fielding" writes:
> 
>> One could argue a lot of things, but disabling the often-used
>> and very useful User-Agent string [...]
> 
> How about making it intelligently usable instead ?

These concerns are already addressed (to the extent we can) in p2.

Nobody is being forced to send long UA header fields.
I also find it silly to send TMI, particularly when browser
folks complain about request latency (sending and parsing
the UA string is always in the critical path).  However,
there is a huge difference between TMI and sending enough
information for a server to identify and work around
known protocol issues.

....Roy

Received on Friday, 13 September 2013 21:07:36 UTC