Re: [w3ctag/design-reviews] User-Agent Client Hints & UA Reduction (#640)

Hi @torgo, I responded yesterday to some of @hsivonen's comments at https://github.com/mozilla/standards-positions/issues/552#issuecomment-879162601, as they were based on outdated information (or simple misunderstandings perhaps). 

I don't fully understand what "Harmful" means in the context of his post, as the info is already available in the User-Agent header. For example, for hints such as Sec-CH-UA-Model (which Firefox does _not_ expose in its Android mobile browser UA strings), the spec [explicitly states](https://wicg.github.io/ua-client-hints/#http-ua-hints):

> User agents MAY return the empty string or a fictitious value for full version, platform architecture, platform bitness or model, for privacy, compatibility, or other reasons.

If a browser were to implement UA-CH, didn't want to expose Model, or Full Version, etc., it has the ability to respond with the empty string and be conforming - either because some privacy policy or user setting was being enforced (Privacy Budget, Firefox's ETP Strict Mode, Firefox's "Resist Fingerprinting" mode, etc.) - or just because a vendor decides that should be default value. 

Perhaps Henri can explain what he means by Harmful here.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/640#issuecomment-880056789