There is a big variety of browsers there, and as I said, the UA is simply one of the many tracking points.
Websites often dont support users, they live off ads because we didnt find any internet model that can live without ads, which are a horrible concept.
I was in a supermarket today where card payment was broken. There was a huge sign in the middle of the entrance about that, but a lot of people still didnt read it and had to bring back their groceries.
I think this is in part due to ads. Ads train us to not concentrate, zoom out and be passive. Otherwise, looking at all that manipulative garbage would make us insane.
So I am curious to why Websites would need to support users. Normal web standards work the same. There is a trend towards not supporting Firefox or maybe platforms with worse DRM, like Linux (where you can screencast any DRM browser anyways). So I think Netflix uses the Linux user agent to limit you to 1080p (as a laptop user and pirate I have no idea how this is an issue though)
You are lucky here with your generic UA. maybe this is also outdated, but I read this was a thing at least on some distro packaged Firefoxes.
Also that the search engines preconfigured would always get the info about what OS you are using.
Yes these things may not be critical, and Firefox does a ton of awesome things like cookie isolation and containers, to limit the creepy stuff.
But
having HTTPS off by default
being on “default” privacy level
keeping all cookies
Is simply not okay. HTTP is still possible, I only know a single popup-ads-riddled site that doesnt work with Firefoxes most private setting. And deleting all cookies and making exceptions work kinda fine.
There was a button to save cookies for a site, but it is gone? No idea why.
Improving good private UX helps. Being too shy to implement it harms its reputation I think.
I also like Brave with their model for monetization via crypto. I would be happy to tip a few cents for every website click, but micro transactions just dont really work.
But as a sensitive person, I will absolutely always block every ad possible, as ads are horrible.
I agree with you about ads for sure. But I’m not really sure what you mean about https being off by default. What I’ve noticed is that if I type an IP address into the address bar, FF first tries https and if that fails falls back to http.
Regarding UA string: As a web developer I have worked on many projects, one currently, where browsers misbehave in unpredictable ways. Most notable these days is Safari. Without a user agent string I really don’t have a way to workaround that browser’s shortcomings. Yes, for this purpose, the UA string should be a last resort because feature detection is best, but trust me feature detection isn’t always possible. It would not work for the current slew of issues I’m working through in Safari.
Also, I would encourage you to read up on Brave and funder/fundamentalist Peter Thiel. Brave is not only a Google supporting browser by virtue of using chromium, it’s also wrapped up in some shady shit, including being funded by a conservative psychopath.
I really don’t understand. So the fact that FF warms you against a (btw rare) thing is somehow not enough? …
And I’m telling you as a web developer who has to support multiple versions of Safari, it’s not something I can just dismiss as irrelevant as you’re apparently intent on doing.
And about brave, you brought it up not me. Still don’t understand why it even came up, especially if you’re actively against it…
I am not sure how embedded media inside HTTPS websites use HTTP. But using HTTPS exclusively is very possible today, nearly no websites not supporting it. So I see no reason here.
But this is just an example and that is also GUI configurable.
I see that Safari and different Browsers are an issue, but do you need OS info for that? Especially fine grained info?
I mentioned Brave because they integrated something that is not ads, but I think it is ads anyways? So not using the browser, but pro anything with direct payment
Still unsure what you’re saying about https. Firefox treats insecure sites as dangerous and tries to tell the user to beware, for that one time a year you might run into that situation. And by default, insecure content in a secure page is blocked in FF and I think that was true even in IE 11. That’s been pretty standard for a long time.
Regarding OS in the UA, no, rarely would you need it. I think browsers can send whatever they want there though. Are you saying that LibreWolf sends one without OS? Again to me it’s a little paranoid to nitpick this but what I thought you were saying before is that UAs should not exist period, which I was disputing because I literally have been spending the last month working through safari specific bugs that would be nearly impossible to handle without a UA string to know the user is running safari. Sometimes I do need to know iPad vs iPhone, but that’s not only rare but probably even more offensive to you than the UA mentioning the OS/OS family.
Firefox treats insecure sites as dangerous and tries to tell the user to beware
I only get that behavior when setting HTTPS-only. If I dont, I think it may display a warning but thats it.
Are you saying that LibreWolf sends one without OS?
No they often take Windows 10 on FF ESR
Sometimes I do need to know iPad vs iPhone
I think that is a problem of the browser isnt it? And how does a “desktop site” button work? Does it change the UA or is there a different way to switch between the site views?
I dont know why this couldnt be done with a “safari on iPadOS” vs “Safafi on iOS” or a separate value for “phone”, “tablet”, “desktop”.
The OS is way less important than the browser and the form factor here.
Yeah that’s what I said. It is your opinion that a warning is not enough but I very much don’t feel that way. Users should be treated like adults by default.
No they often take Windows 10 on FF ESR
I don’t know what this means unless you’re saying it just always reports win 10
As far as the rest of your comment… I have been building websites for 20 years now and I’m not content to do things the wrong way, so I’ve researched and considered the available options.
It doesn’t matter if it’s a “browser problem” since I don’t get to tell users that iOS sucks ass, which it does.
Kind of feels dismissive the way you’re hand waving away all the problems I deal with all the time. Like I said, until browsers behave consistently or at least predictably if they don’t support something, UA will be needed sometimes. I haven’t needed it for anything but safari in a long time but again I don’t get to tell those users to get a decent browser. On iOS they don’t even have that option if they were to want another browser.
Thats why there is an “accept the risk and proceed” button ;)
By default, Firefox loads Javascript from any site. The Pegasus Trojan was transmitted by hijacking 2G and 3G network connections, and using malicious HTTP redirects that wouldnt work with HTTPS.
They are zero-click, meaning just opening that site would run the code.
i think security should be normalized.
it just always reports win 10
It reports to be Firefox ESR on Windows 10. Maybe Windows 11 now.
you’re hand waving away all the problems I deal with all the time.
I didnt. I just find it odd that you need to know the OS to display a site for 3 different form factors. But if that is true, then a UA might be a solution.
There is a big variety of browsers there, and as I said, the UA is simply one of the many tracking points.
Websites often dont support users, they live off ads because we didnt find any internet model that can live without ads, which are a horrible concept.
I was in a supermarket today where card payment was broken. There was a huge sign in the middle of the entrance about that, but a lot of people still didnt read it and had to bring back their groceries.
I think this is in part due to ads. Ads train us to not concentrate, zoom out and be passive. Otherwise, looking at all that manipulative garbage would make us insane.
So I am curious to why Websites would need to support users. Normal web standards work the same. There is a trend towards not supporting Firefox or maybe platforms with worse DRM, like Linux (where you can screencast any DRM browser anyways). So I think Netflix uses the Linux user agent to limit you to 1080p (as a laptop user and pirate I have no idea how this is an issue though)
You are lucky here with your generic UA. maybe this is also outdated, but I read this was a thing at least on some distro packaged Firefoxes.
Also that the search engines preconfigured would always get the info about what OS you are using.
Yes these things may not be critical, and Firefox does a ton of awesome things like cookie isolation and containers, to limit the creepy stuff.
But
Is simply not okay. HTTP is still possible, I only know a single popup-ads-riddled site that doesnt work with Firefoxes most private setting. And deleting all cookies and making exceptions work kinda fine.
There was a button to save cookies for a site, but it is gone? No idea why.
Improving good private UX helps. Being too shy to implement it harms its reputation I think.
I also like Brave with their model for monetization via crypto. I would be happy to tip a few cents for every website click, but micro transactions just dont really work.
But as a sensitive person, I will absolutely always block every ad possible, as ads are horrible.
I agree with you about ads for sure. But I’m not really sure what you mean about https being off by default. What I’ve noticed is that if I type an IP address into the address bar, FF first tries https and if that fails falls back to http.
Regarding UA string: As a web developer I have worked on many projects, one currently, where browsers misbehave in unpredictable ways. Most notable these days is Safari. Without a user agent string I really don’t have a way to workaround that browser’s shortcomings. Yes, for this purpose, the UA string should be a last resort because feature detection is best, but trust me feature detection isn’t always possible. It would not work for the current slew of issues I’m working through in Safari.
Also, I would encourage you to read up on Brave and funder/fundamentalist Peter Thiel. Brave is not only a Google supporting browser by virtue of using chromium, it’s also wrapped up in some shady shit, including being funded by a conservative psychopath.
I mean the HTTPS-only toggle. It still allows HTTP but after a warning. HTTP sites still work, so this should be opt-out.
Safari only works on 2/3 Platforms, so I dont think a UA containing the OS, let alone a detailed “Lubuntu” etc. detail
I heard about Peter Thiel I think in very different contexts? I wouldnt support Brave at all, I use a mix or hardened Firefox, Mull and Vanadium.
I really don’t understand. So the fact that FF warms you against a (btw rare) thing is somehow not enough? …
And I’m telling you as a web developer who has to support multiple versions of Safari, it’s not something I can just dismiss as irrelevant as you’re apparently intent on doing.
And about brave, you brought it up not me. Still don’t understand why it even came up, especially if you’re actively against it…
I am not sure how embedded media inside HTTPS websites use HTTP. But using HTTPS exclusively is very possible today, nearly no websites not supporting it. So I see no reason here.
But this is just an example and that is also GUI configurable.
I see that Safari and different Browsers are an issue, but do you need OS info for that? Especially fine grained info?
I mentioned Brave because they integrated something that is not ads, but I think it is ads anyways? So not using the browser, but pro anything with direct payment
Still unsure what you’re saying about https. Firefox treats insecure sites as dangerous and tries to tell the user to beware, for that one time a year you might run into that situation. And by default, insecure content in a secure page is blocked in FF and I think that was true even in IE 11. That’s been pretty standard for a long time.
Regarding OS in the UA, no, rarely would you need it. I think browsers can send whatever they want there though. Are you saying that LibreWolf sends one without OS? Again to me it’s a little paranoid to nitpick this but what I thought you were saying before is that UAs should not exist period, which I was disputing because I literally have been spending the last month working through safari specific bugs that would be nearly impossible to handle without a UA string to know the user is running safari. Sometimes I do need to know iPad vs iPhone, but that’s not only rare but probably even more offensive to you than the UA mentioning the OS/OS family.
I only get that behavior when setting HTTPS-only. If I dont, I think it may display a warning but thats it.
No they often take Windows 10 on FF ESR
I think that is a problem of the browser isnt it? And how does a “desktop site” button work? Does it change the UA or is there a different way to switch between the site views?
I dont know why this couldnt be done with a “safari on iPadOS” vs “Safafi on iOS” or a separate value for “phone”, “tablet”, “desktop”.
The OS is way less important than the browser and the form factor here.
Yeah that’s what I said. It is your opinion that a warning is not enough but I very much don’t feel that way. Users should be treated like adults by default.
I don’t know what this means unless you’re saying it just always reports win 10
As far as the rest of your comment… I have been building websites for 20 years now and I’m not content to do things the wrong way, so I’ve researched and considered the available options.
It doesn’t matter if it’s a “browser problem” since I don’t get to tell users that iOS sucks ass, which it does.
Kind of feels dismissive the way you’re hand waving away all the problems I deal with all the time. Like I said, until browsers behave consistently or at least predictably if they don’t support something, UA will be needed sometimes. I haven’t needed it for anything but safari in a long time but again I don’t get to tell those users to get a decent browser. On iOS they don’t even have that option if they were to want another browser.
Thats why there is an “accept the risk and proceed” button ;)
By default, Firefox loads Javascript from any site. The Pegasus Trojan was transmitted by hijacking 2G and 3G network connections, and using malicious HTTP redirects that wouldnt work with HTTPS.
They are zero-click, meaning just opening that site would run the code.
i think security should be normalized.
It reports to be Firefox ESR on Windows 10. Maybe Windows 11 now.
I didnt. I just find it odd that you need to know the OS to display a site for 3 different form factors. But if that is true, then a UA might be a solution.