Re: [perpass] HTTP user-agent fingerprinting

Le Ven 13 septembre 2013 21:18, Patrick Pelletier a écrit :

> And, of course, using the simplified User-Agent strings was just one
> of my two proposals.  My other proposal, which was even simpler,
> though perhaps more radical, was to downgrade the requirement on User-
> Agent from SHOULD to MAY, and encourage browsers not to send User-
> Agent at all.  (We could even change it to a SHOULD NOT if we feel
> really heavy-handed.)

Please don't. If any change it from SHOULD to MUST

User-Agent is invaluable for filtering out pathologic web clients in a
network without bothering legitimate users. And in fact 9 web clients out
of ten that do not declare user-agent are broken one way or another
protocol-wise (and they're a PITA because you can't filter them out
without breaking the few correctly implemented clients that take advantage
of the SHOULD)

In fact no-user-agent should be "I swear on the penalty of [insert cruel
and deserved punishment] to never take liberties with the HTTP protocol
and never add a bug to my software".

Right now no-user-agent-is "I don't want to understand HTTP but it gets me
through the firewall, simulate a real web client and only implement the
parts I need most of the time with no error handling except for retrying
in a loop with no sleeps"


-- 
Nicolas Mailhot

Received on Monday, 16 September 2013 16:35:33 UTC