Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please standardize your version number format #1253

Closed
ZB-Block-JamesC opened this issue Nov 1, 2019 · 26 comments
Closed

Please standardize your version number format #1253

ZB-Block-JamesC opened this issue Nov 1, 2019 · 26 comments

Comments

@ZB-Block-JamesC
Copy link

ZB-Block-JamesC commented Nov 1, 2019

I realize this project is based on Firefox, and I realize that you'd like websites to treat Waterfox as though it IS Firefox.

But here's the issue: some sites have "obsolete browser" code that examines the user-agent Waterfox (and Firefox, and Chrome, and IE, and and...) provide when they connect ... and Waterfox isn't being identified as equivalent to a current version of Firefox. If you're lucky, the site will nag your users to upgrade to a newer version ... but some sites will simply block obsolete browsers from seeing the site at all.

I am the current developer of ZB-Block (a website protection script), and ZB-Block has an optional module that blocks spambots and content scrapers that claim to be older browsers. For my code to work reliably, I need to be able to determine CURRENT version numbers from an official download site or a Wikipedia entry.

Per your download page, your blog, and Wikipedia, the current version of Waterfox is 2019.10. But on installing Waterfox two hours ago, I found that Waterfox Classic's useragent reports as 56.3, and Waterfox Current doesn't claim Waterfox in the useragent at all!

Classic: https://imgur.com/3QVtlsR
Current: https://imgur.com/E8qCM8L
Wikipedia: https://en.wikipedia.org/wiki/Template:Latest_stable_software_release/Waterfox
Your blog: https://www.waterfox.net/blog/waterfox-2019.10-release-download/

Please, PLEASE standardize your version number. If you want the useragent to show 2019.10 to match your blog, download page, and Wikipedia entry, then change your useragent already. If you want the useragent to show a Firefox-like version number, then list the useragent's version number on Wikipedia and your website, so all the websites that identify browser versions (Udger, WhatsmyUA, etc) can keep THEIR code up to date.

@grahamperrin
Copy link

Thanks.

With or without standardisation, I think that the project should:

  • never again use a single identifier i.e. 2019.10 for two or more different releases of the browser

– four, most recently (https://github.com/MrAlex94/Waterfox/releases/tag/2019.10-classic, https://github.com/MrAlex94/Waterfox/releases/tag/2019.10-classic-1, https://github.com/MrAlex94/Waterfox/releases/tag/2019.10-current and https://github.com/MrAlex94/Waterfox/releases/tag/2019.10-current-1).

Whilst I agree with the logic of 'soft and hard' launches: significantly changing the code without changing the version is likely to be troublesome, sooner or later. I expect to find in-the-wild copies of Waterfox Classic 2019.10 Setup.exe that do not match SHA56 3f58d5a5b1379323729ccb75374e1213c4ad7b4209f63ead1d5e3c2c0c00538f, and so on.

Waterfox Classic's useragent reports as 56.3

#1204 (comment)

Additional background:

@grahamperrin
Copy link

Meta, tracking: #582 in particular #582 (comment)

Thanks for the pings. Website is being re-done 👍

– and four days ago, https://www.reddit.com/comments/dmmfxv/-/f5nwg5c/?context=1:

… I am updating the website to be more verbose. I just get caught up in dev work and vice versa. I’ll get there though and try add useful info.

@ZB-Block-JamesC
Copy link
Author

Thank you, Graham.

Another issue was filed a month ago, about Waterfox identifying as Firefox/2019.10:
#1171
... and to be honest, I read the response as changing the UA to read as Waterfox/2019.10, NOT reverting to the previous identification format.

Another Firefox derivative (Pale Moon) carries unique version numbers, but their on-screen and useragent version numbers match, and they note which Firefox ESR they base their code. In my opinion, this is the best way for Firefox derivatives to identify themselves, as sites that don't recognize the derivative can still determine whether the underlying Firefox code is recent or obsolete.
Wikipedia: https://en.wikipedia.org/wiki/Template:Latest_stable_software_release/Pale_Moon
Example useragent string: https://developers.whatismybrowser.com/useragents/parse/4932993-pale-moon-windows-goanna

Apple and Microsoft use "friendly names" for marketing purposes, but list version numbers in their useragent strings. I would be okay with Waterfox following this example as long as the version numbers shown on Wikipedia match the version numbers in the useragent string.
https://en.wikipedia.org/w/index.php?title=Template:Latest_stable_software_release/macOS

In contrast, the TOR Browser intentionally claims to be the current Firefox ESR (rather than adding a TORBrowser/xx.x token). While this isn't the most ideal -- once the mainline Firefox reaches 73, Firefox/68.0 appears to be 5 versions (6 months) out of date -- it does save the "obsolete browser detection" authors from maintaining a unique regex; TOR Browser automatically falls back to Firefox detection code.
https://imgur.com/2TdazVl

Just being honest, my code (as well as most other sites that run similar code) only looks at the major version number (Firefox/70, Chrome/78, etc). The issue is that PHP's regex tries to match from the end of the useragent string, so if I'm looking for Waterfox/xx (two digits) but Waterfox presents as Waterfox/xxxx (four digits) then I need to update my regex. Otherwise my code will skip the Waterfox token and match on Firefox/56, which looks like a bot since a human should have updated to FF 60 if not FF 68 or 70 by now.

@laniakea64
Copy link

the TOR Browser intentionally claims to be the current Firefox ESR (rather than adding a TORBrowser/xx.x token). While this isn't the most ideal -- once the mainline Firefox reaches 73, Firefox/68.0 appears to be 5 versions (6 months) out of date -- it does save the "obsolete browser detection" authors from maintaining a unique regex; TOR Browser automatically falls back to Firefox detection code.

This is what Waterfox Current does, as Waterfox Current is based on Firefox ESR.

@ZB-Block-JamesC
Copy link
Author

ZB-Block-JamesC commented Nov 2, 2019

This is what Waterfox Current does, as Waterfox Current is based on Firefox ESR.

And you've no idea how many complaints I receive from TOR Browser and Firefox ESR users, because Firefox doesn't update the ESR useragents to show 68.1, 68.2, etc.

And I can understand your point of view: if Firefox doesn't update the UA, why should Waterfox (or TOR or any other ESR derivative) update theirs?

That's WHY I specifically look for a Waterfox (or Pale Moon, or whomever) token in the UA, so that I don't mistake Firefox derivatives for spambots or other unwanted connections. :)

@grahamperrin
Copy link

A brief retrospective …

IIRC the notional Firefox/56.2 in Rabbit-specific https://www.reddit.com/comments/8q6dby/-/e0udcwr/ originated from earlier experiments that did not involve Rabbit. Note to self: #772 (comment) and https://www.reddit.com/comments/d4xgb2/-/f1c4tze/?context=1

https://www.reddit.com/comments/d79h2l/-/f1ulnxa/ reminds me that I was still, occasionally, experimenting with (but not recommending) Firefox/56.2 as recently as September 2019.

I'll probably never rediscover the origin of the Firefox 56.2 pretence, and Rabbit is no more, so I'll no longer try this.

… The issue is that PHP's regex tries to match from the end of the useragent string, so if I'm looking for Waterfox/xx (two digits) but Waterfox presents as Waterfox/xxxx (four digits) then I need to update my regex. Otherwise my code will skip the Waterfox token and match on Firefox/56, which looks like a bot since a human should have updated to FF 60 if not FF 68 or 70 by now.

This is very useful to know, thanks.

@ZB-Block-JamesC
Copy link
Author

ZB-Block-JamesC commented Nov 2, 2019

Graham, I took a quick glance at the links you offered earlier in this thread. Between them and the pinned issue about useragent switching, I believe many of the issues could be solved with a few simple changes.

For Waterfox Current (based on FF 68.0 ESR), use the 2019.10 version format:

  • default useragent: Mozilla/5.0 (OS identifier; rv:68.0) Gecko/20100101 Firefox/68.0 Waterfox/2019.10
  • if a user turns privacy.resistFingerprinting on (to TRUE), existing FF 68esr code should swap the useragent to Mozilla/5.0 (OS identifier; rv:68.0) Gecko/20100101 Firefox/68.0
  • please update the Gecko and FF versions on Waterfox updates, so sites can see that the underlying ESR code is fairly current:
    Mozilla/5.0 (OS identifier; rv:68.1) Gecko/20100101 Firefox/68.1 Waterfox/2019.11
    Mozilla/5.0 (OS identifier; rv:68.2) Gecko/20100101 Firefox/68.2 Waterfox/2019.12
    Mozilla/5.0 (OS identifier; rv:68.3) Gecko/20100101 Firefox/68.3 Waterfox/2020.01

For Waterfox Classic (based on FF 56 non-ESR), stay to the established FF format:

  • default useragent: Mozilla/5.0 (OS identifier; rv:56.3) Gecko/20100101 Firefox/56.3 Waterfox/56.3
    [Edit: my suggestion for a "fake Firefox/70 useragent" is withdrawn, as Graham's video in the next post shows this is not a viable solution.]

Update the version numbers on the Download page, then post a blog entry announcing the revised version formatting (so you have a quotable (linkable) source for Wikipedia):

Yeah it's a bit of work to do this, but it'll solve sooooo many compatibility problems going forward. :)

@grahamperrin
Copy link

For Waterfox Classic

A pretence of Firefox/70.0 will cause problems.

#882 (comment) the second non-checked checkbox and "it might be tempting to drop from 65.0 to 62.0" remind me that Firefox/63.0 is too far (from 56.0) for sites such as YouTube:

@ZB-Block-JamesC
Copy link
Author

ZB-Block-JamesC commented Nov 3, 2019

For Waterfox Classic
A pretence of Firefox/70.0 will cause problems.

Do you have a useragent-switcher addon that would allow you to test some of the "fake" useragents I suggested? If YouTube and the other sites magically allow Waterfox/56 to work (when it claims to be Firefox/68 or higher, instead of Firefox/56), I see no harm in doing this as long as the Waterfox/56.x token is present and accurate.

I'd do a few tests myself, but I'm on Windows 7 32-bit ... the currently-available versions of Waterfox are x64 only, I can't install them. :(

If it turns out that claiming a fake Firefox/68+ causes code problems (sites send the wrong stylesheets or assume functionality Waterfox Classic doesn't have), then I agree, Waterfox Classic shouldn't send the Firefox/68+ token. But that's why I suggested this be toggled on with a "compatibility mode" button, so that Waterfox Classic users won't be sending this unless necessary. :)

Edit 1: I'm sorry, I didn't watch your videos before responding. Let me take a closer look at them, I may update this in a few minutes....

Edit 2: Okay, I see how YouTube drops the icons at the top and the suggested videos along the side, when you spoof a later Firefox useragent. But if YouTube works with a Firefox/56 useragent (as your video appears to prove), then you wouldn't need to send a "fake" Firefox/68+ useragent to begin with; you'd stay with the default Waterfox Classic useragent.

I withdraw my "fake Firefox/70 useragent" idea. It makes more sense for anyone who can't use Waterfox Classic on a website, to instead use Waterfox Current.

@c33s
Copy link

c33s commented Nov 4, 2019

never again use a single identifier i.e. 2019.10 for two or more different releases of the browser

#1253 (comment)

i only can 2nd this. it is very important to see in the version number if its the classic or the current build. i made a backup before i installed the update, because it was not clear which version will get installed.

@grahamperrin
Copy link

grahamperrin commented Nov 4, 2019

UA strings aside, for now …

Version identifiers

to see in the version number if its the classic or the current build

+1

My current thinking – without knowing all technical consequences – is to echo (in future) the format, or something like the format, that was seen for tagged releases in October. Compare with https://github.com/MrAlex94/Waterfox/releases/

At their simplest, without variation from the October format, assuming November 2019 pre-releases (soft) and releases of both Waterfox Classic and Waterfox Current beta:

  • 2019.11-classic
  • 2019.11-current
  • 2019.11-classic-1
  • 2019.11-current-1

Defocusing from Waterfox Project and Mozilla: I should expect any version of beta software (for testing) to include b in its version identifier.

Mozilla uses channels, which is fine for their user base however I'd not want to see the word channel in (for example) an About Waterfox Current dialogue. Whilst the Waterfox user base includes a good proportion of technically savvy people, let's not forget the 'average' end user, who might be disinterested in (or off-put by) geeky codewords.

Waterfox Project has its branches – again, not a word that I'd like to see in an About dialogue.

Colloquially I sometimes use the word flavours – i.e. two flavours of the Waterfox application, which probably makes some people cringe but it's to avoid using words such as channel or branch in an environment (e.g. Community Support) where readers might want minimal jargon.


All things considered I'm toying with this, for example:

  • 2019.11-classic-p
  • 2019.11-current-p
  • 2019.11-classic-r1
  • 2019.11-current-r1

More specifically, tying that to a notion of separate web pages (one starting page for Waterfox Classic, one starting page for Waterfox Current):

@ZB-Block-JamesC
Copy link
Author

UA strings aside, for now …

With all due respect, I opened this issue to address the UA discrepancy. Whatever Waterfox does in the human-readable About box is a different concern, as YouTube will never see the About box.

I can tell you that if Waterfox starts adding dashes and letters (such as -classic) to the UA, you'll cause a LOT of problems for sites that are only looking for numeric values (such as 56.4). PHP will log each access from Waterfox/2019.11-classic as an error that the site administrator (or their IT team) will NEVER be able to track to the UA, it'll only track back to the script on the webserver. Which, on sites that run my software, will look as though MY script is buggy.

Try running this UA through Udger and some other UA identification sites:
Mozilla/5.0 (Windows NT 6.1; rv:56.0) Gecko/20100101 Firefox/56.0 Waterfox/2019.11-classic

You'll find that the dash and anything after are dropped ... which makes this form of versioning useless for sites that need to display different code for Waterfox Classic (FF 56.x code) and Waterfox Current (FF 68+ code).

That's why I suggested staying to the older version format for Waterfox Classic, and limiting use of 2019.xx to Waterfox Current -- so that websites that recognize the Waterfox token can know what to send to your browser.

This also allows the human-readable About box to display "Waterfox Classic 56.4" or "Waterfox Current 2019.11" without causing anyone any problems whatsoever. :)

@grahamperrin
Copy link

grahamperrin commented Nov 5, 2019

With all due respect, I opened this issue to address the UA discrepancy.

Apologies. Focusing on the subject line, I lost sight of the context. My previous comment was for version number format but in no way a suggestion re: UA strings.

@h1z1
Copy link

h1z1 commented Nov 6, 2019

Please do let me know what sites are running your script so I can block them preemptively because relying on a UA string for anything is naive at best. It says absolutely nothing about what the browser actually allows and frankly as someone who uses lynx a lot, it's damned annoying to get blocked by such silly sites. There's literally nothing nefarious about not using a string YOU expect.

Expecting Tor to identify itself as a tor user is just .. stupid.

Proper thing to do is detect what features you need

@grahamperrin
Copy link

@h1z1 thanks, your frustration (with lynx etc.) may be understandable but with respect, it doesn't help to progress this issue. I see past discussions of pros and cons of reliance upon UA strings; somewhat interesting to follow but they don't alter the reality of some sites choosing reliance of this type.

@h1z1
Copy link

h1z1 commented Nov 6, 2019

No, actually it does help. The request is lunacy.

@ZB-Block-JamesC
Copy link
Author

relying on a UA string for anything is naive at best. It says absolutely nothing about what the browser actually allows

You didn't read my first post. I'm not attempting to detect browser features -- I'm attempting to detect spambots and content scraper scripts.

Sadly, malicious bots don't declare themselves as bots. They claim to be common browsers, such as Chrome and Firefox, to try to get past software like mine. This is why I need to scrutinize the useragent for small details such as version numbers that don't correspond to known or supported releases.

I opened this issue because Waterfox 2019.10 isn't sending consistent version numbers, and I need to know whether to look for 2019.10, 56.x, or some other value ... or if I should forget about Waterfox and rely on the Firefox version instead.

@h1z1
Copy link

h1z1 commented Nov 12, 2019

You didn't read my first post. I'm not attempting to detect browser features

I did read your post, you're not reading mine. I never said you were trying to detect features, I said you aren't but SHOULD..

version numbers that don't correspond to known or supported releases.

Which is unbelievably silly. At the very least it prohibits self compiled/custom spins which may or may not have the same features enabled and thus SHOULD have different versions. Or users who copy a URL between different browsers? You're going to trigger on them as bots? As I said, lunacy. Are your unsuspecting users aware of this?

To be completely clear, you're not the only one whom does this. UA snooping has been around since at least Mosaic. There's a reason it's unreliable.

@NotesTracker
Copy link

Due to my heavy reliance on various old-fashioned XUL extensions that so far haven't been replaced by web extensions with equivalent functionality, I'm using Waterfox Classic (always u[dated to the latest release, which as of today is 2020.07.1). Like others, I still come across annoying websites that don't support Waterfox, for whatever reason.

I don't know if the following is an over-simplistic KISS approach, but here's my concept, goofy or otherwise ... Would it be possible to add the capability for a Waterfox Classic user to select the reported browser version from a drop-down list in an attempt to allow Waterfox to be recognized/accepted by such websites? My idea is that once you've tried to get such a website to accept Waterfox and done your business on that site, you would simply use the same drop-down list to reset to the latest version (maybe an item in the drop-down would be "latest version" or there could even be a button to click to do so).

This may be unrelated or only partially-related, but I'm also am finding that some websites (here in Australia, anyway) that have location awareness features are either reporting me to be in the wrong suburb or are reporting that the website's location awareness feature is not supported for the browser being used. (Just a few minutes ago I had to switch over to Chrome browser to make use of a site's location detection feature.) Am I confusing issues? Any general comments on this?

@Megalomaniak
Copy link

@NotesTracker A year late, but I can recommend User Agent Switcher add-on. You can assign an override per website domain and you can choose from a convenient list of common browsers to spoof as.

@NotesTracker
Copy link

@Megalomaniak, thanks for that, better late than never! I had seen references to UserAgent but didn't know how to tweak it.

One website that I use fairly frequently is rottentomatoes.com. Some months ago, after having no issues for years, I found that its search bar disappeared from the red header bar (at top) and I now have to switch to Chrome or Edge to be able to use the search function.

I was hopeful, however using User Agent Switcher for Windows / Firefox 83 (or any of the other Windows selections) plus overriding for the Rotten Tomatoes domain makes no difference, I still don't see the search bar. Any suggestions?

@NotesTracker
Copy link

Here's a screenshot of the search bar in Rotten Tomatoes
rotten-tomatoes-search-bar-in-chrome-browser

@Megalomaniak
Copy link

Can confirm, according to the web console it's an search-algolia js library that fails because of unexpected type error: TypeError: window.customElements is undefined. Likely not related to this issue/topic tho. Either open a new issue or find a related issue to bring it up in.

@Megalomaniak
Copy link

@NotesTracker Note that it stems from missing a feature introduced in FF 63:
https://developer.mozilla.org/en-US/docs/Web/API/Window/customElements

A polyfill might be able to work around this.

@NotesTracker
Copy link

So, if "it stems from missing a feature introduced in FF 63" I wonder what chance there is that it will be fixed. (Always hopeful.)

@Megalomaniak
Copy link

As I said, a polyfill might be able to fix it. I have the polly add-on installed that for a while was bundled along with waterfox classic and enabling some polyfills did get the searchbar rendering. I didn't test any further though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

8 participants