- Dillo-dev - lists.mailman3.com

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Diego Sáenz

I agree with this. Only one detail about the path: what about use autoconfig to fill a define with the system and plataform instead to add code? Diego. El Tue, 8 Jul 2003 19:44:50 -0700 Kelson Vibber <kelson(a)pobox.com> escribio: > I know this is too late to even consider for 0.7.3, but I thought I'd > get this out for discussion. > > I've been looking at browser statistics on my website, and started > thinking about what various browsers do and don't report in their > User-Agent identification. All report their name. Many report the > rendering engine (Gecko, KHTML, etc.) Many also report the operating > system and the type of system (with varying levels of detail), and > some even report the language of the user interface. > > Here are some examples from my website's server logs: > > Mozilla/4.7 [en] (WinNT; U) > Mozilla/5.0 (compatible; Konqueror/3.1; Linux) > Mozilla/4.72 [en] (X11; U; Linux 2.4.18 i686) > Opera/7.11 (Linux 2.4.20-18.9 i686 [en] > Opera/6.0 (Macintosh; PPC Mac OS X; U) [en] > Mozilla/4.0 (compatible; MSIE 5.22; Mac_PowerPC) > Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3.1) > Gecko/20030524 Mozilla/5.0 (Macintosh; U; PPC Mac OS X; > en-us) AppleWebKit/85 (KHTML, like Gecko) Safari/85 > > Some interesting notes: > - Netscape and Mozilla always use "X11" for anything X-based, and have > a separate field to indicate the actual OS (Linux, Solaris, *BSD, > etc.)- Konqueror lets you configure the amount of detail you report. > The example here is the default. > - Most of the *nix-based strings use qhat you get from uname -sm or > uname -srm. > - Most browsers designed for Mac OS X report "PPC Mac OS X" > - There are possible privacy/security implications of revealing too > much information, like your system's kernel version or your primary > language. > > I think that knowing the operating system is interesting, but much > more than that probably isn't necessary, so I'd like to suggest one of > the following syntaxes to extend the Dillo user-agent string: > Dillo/<version> (<system>) > Dillo/<version> (<platform>; <system>) > > Where <system> is the output of "uname -sm" (i.e. Linux PPC, FreeBSD > i386, etc) and <platform> is of the form (Windows|Macintosh|X11|etc.) > as used by Mozilla (see > http://www.mozilla.org/build/revised-user-agent-strings.html ). > > This would result in identification like the following: > Dillo/0.8 (Linux i386) > Dillo/0.8 (FreeBSD i686) > Dillo/0.8 (Linux PPC) > Dillo/0.8 (PPC Mac OS X)* > and so on, or perhaps: > Dillo/0.8 (X11; Linux i386) > Dillo/0.8 (X11; CYGWIN_NT-5.0 i686) > to fit Netscape/Mozilla's pattern. > > * (Aside from the reversed order, Mac OS X would probably show up as > Darwin unless a special case is made. This would probably mean > setting the User-Agent string once and keeping it in memory instead of > building it with each HTTP request. And for the longer syntax there's > the issue that it still runs under X, so the platform would probably > be X11 instead of Macintosh.) > > I have attached a quick patch which uses the utsname struct to create > the first syntax, and I've tested it successfully on Linux and Cygwin > on Intel hardware. > > So does anyone else think this is a good/bad/interesting idea? And is > anyone interested in testing it on *BSD/Solaris/Mac/etc.? > > -- > Kelson Vibber > www.hyperborea.org > >

July 9, 2003

Re: [Dillo-dev] # users (OT)

by JoeHill

On Wed, 9 Jul 2003 08:10:56 -0500 linux seaq <linux(a)seaq.com.co> uttered: > Hi, i wonder how many of us (dillo's users) exists already? 42 -- Joehill Registered Linux user #282046 Homepage: http://nodex.sytes.net 09:32:47 up 14 days, 15:13, 4 users, load average: 0.05, 0.01, 0.00

July 9, 2003

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Phil Pennock

On 2003-07-08 at 19:44 -0700, Kelson Vibber wrote: > syntaxes to extend the Dillo user-agent string: > Dillo/<version> (<system>) > Dillo/<version> (<platform>; <system>) > > Where <system> is the output of "uname -sm" (i.e. Linux PPC, FreeBSD i386, > etc) and <platform> is of the form (Windows|Macintosh|X11|etc.) as used by > Mozilla (see http://www.mozilla.org/build/revised-user-agent-strings.html ). > > This would result in identification like the following: > Dillo/0.8 (Linux i386) The problem with these is when there are security holes in image rendering libraries (eg, versions of Netscape with custom handlers for extended information in GIF files). If you state the system architecture then it's relatively trivial to use the User-Agent field on the server-side to select the image with the correct shell-code to exploit your system. If you say "FreeBSD" or "Linux" then you're stating which system calls are where. All of which helps a malicious web-site operator target their exploit to your browser. As you note, Konqueror lets you configure the amount of information available without a source-patch. I'm one of those who reduces the information to the minimum -- I'm happy supplying something saying "Konqueror" or "Dillo" and don't get upset at the version being present. I like to turn it off though -- this is one of the things which I like about Dillo -- it's so fast to compile that trivial local hacks like this become feasible. I don't supply patches for stuff that removes things that the developers like because it's their baby, but open source means I get to run stuff how I like it; everyone gets what they want (as long as they can make trivial hacks) so everyone's happy. Since I patch anyway, it makes no difference to me -- I'd just remove the extra information. But I do think that people should think about how easy it is to target shell-code exploits with this sort of information given away. -- 2001: Blogging invented. Promises to change the way people bore strangers with banal anecdotes about their pets. <http://www.thelemon.net/issues/timeline.php>

July 9, 2003

# users (OT)

by linux seaq

Hi, i wonder how many of us (dillo's users) exists already? --- Andres Mauricio Mujica SEAQ SERVICIOS CIA LTDA www.seaq.com.co

July 9, 2003

Suggestion & patch for browser identification

by linux seaq

It's a good idea; Would be nice if also the info reported could be configured with dillorc. -- Andres Mauricio Mujica SEAQ SERVICIOS CIA LTDA www.seaq.com.co

July 9, 2003

Re: [Dillo-dev] Porting to Windows?

by Lars Segerlund

It seem's the windows platform is losing ground rather rapidly, so it might not be worth the trouble to support at soon to be obsolete system. ;-) Lars Segerlund. ( there is a smiley above, no flames :-) ). Andreas Tolfsen wrote: > I've just been wondering; Are there any future plans for porting Dillo > to the Windows platform? Or is Dillo to stay on GNU/Linux? > > I think porting to Windows would let Dillo have a much bigger audience > to speak to (since about 90% of the worlds computers run Windows). > > I just wondered if there were any plans? > > > Best regards for a wonderful open-source browser, > > Andreas Tolfsen > <ato(a)itnerd.net> > > > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)lists.auriga.wearlab.de > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

July 9, 2003

the same name ronnie!!!!!!

by ronnie

July 9, 2003

Suggestion & patch for browser identification (user-agent)

by Kelson Vibber

I know this is too late to even consider for 0.7.3, but I thought I'd get this out for discussion. I've been looking at browser statistics on my website, and started thinking about what various browsers do and don't report in their User-Agent identification. All report their name. Many report the rendering engine (Gecko, KHTML, etc.) Many also report the operating system and the type of system (with varying levels of detail), and some even report the language of the user interface. Here are some examples from my website's server logs: Mozilla/4.7 [en] (WinNT; U) Mozilla/5.0 (compatible; Konqueror/3.1; Linux) Mozilla/4.72 [en] (X11; U; Linux 2.4.18 i686) Opera/7.11 (Linux 2.4.20-18.9 i686; U) [en] Opera/6.0 (Macintosh; PPC Mac OS X; U) [en] Mozilla/4.0 (compatible; MSIE 5.22; Mac_PowerPC) Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3.1) Gecko/20030524 Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/85 (KHTML, like Gecko) Safari/85 Some interesting notes: - Netscape and Mozilla always use "X11" for anything X-based, and have a separate field to indicate the actual OS (Linux, Solaris, *BSD, etc.) - Konqueror lets you configure the amount of detail you report. The example here is the default. - Most of the *nix-based strings use qhat you get from uname -sm or uname -srm. - Most browsers designed for Mac OS X report "PPC Mac OS X" - There are possible privacy/security implications of revealing too much information, like your system's kernel version or your primary language. I think that knowing the operating system is interesting, but much more than that probably isn't necessary, so I'd like to suggest one of the following syntaxes to extend the Dillo user-agent string: Dillo/<version> (<system>) Dillo/<version> (<platform>; <system>) Where <system> is the output of "uname -sm" (i.e. Linux PPC, FreeBSD i386, etc) and <platform> is of the form (Windows|Macintosh|X11|etc.) as used by Mozilla (see http://www.mozilla.org/build/revised-user-agent-strings.html ). This would result in identification like the following: Dillo/0.8 (Linux i386) Dillo/0.8 (FreeBSD i686) Dillo/0.8 (Linux PPC) Dillo/0.8 (PPC Mac OS X)* and so on, or perhaps: Dillo/0.8 (X11; Linux i386) Dillo/0.8 (X11; CYGWIN_NT-5.0 i686) to fit Netscape/Mozilla's pattern. * (Aside from the reversed order, Mac OS X would probably show up as Darwin unless a special case is made. This would probably mean setting the User-Agent string once and keeping it in memory instead of building it with each HTTP request. And for the longer syntax there's the issue that it still runs under X, so the platform would probably be X11 instead of Macintosh.) I have attached a quick patch which uses the utsname struct to create the first syntax, and I've tested it successfully on Linux and Cygwin on Intel hardware. So does anyone else think this is a good/bad/interesting idea? And is anyone interested in testing it on *BSD/Solaris/Mac/etc.? -- Kelson Vibber www.hyperborea.org

July 9, 2003

some newbie questions!!

by ronnic

hi all I have enjoied dillo and want make it support chinese (a challenge to me ^o^ ),but i encountered some questions: 1)I can not understand the CCC function modules; 2)How the dillo get the HTML documents after establish socket connect; 3)when getting the file how dillo write to the proper dw archtecture; (please tell me by using detail function ) thanks all !!!!! --http://www.eyou.com --ÎÈ¶š¿É¿¿µÄÃâ·Ñµç×ÓÐÅÏä ÓïÒôÓÊŒþ ÒÆ¶¯ÊéÇ© ÈÕÀú·þÎñ ÍøÂçŽæŽ¢...ÒÚÓÊÎŽŸ¡

July 9, 2003

Re: [Dillo-dev] Porting to Windows?

by Kelson Vibber

At 03:37 AM 7/7/2003, Andreas Tolfsen wrote: >I've just been wondering; Are there any future plans for porting Dillo to >the Windows platform? Or is Dillo to stay on GNU/Linux? Good question. (Although technically it's not Linux-only right now, it's Linux & Unix only.) Just for fun I tried building it on Windows 2000 with Cygwin. It seems to work fine, although I can't say I've done any serious stress testing. Note that you do need to download and compile glib and gtk+ <http://www.gtk.org/> and make one change to the glib source <http://www.cygwin.com/ml/cygwin-xfree/2002-07/msg00276.html>. Of course this is no real solution, because you have to: (1) Install Cygwin with XFree86, (2) Install Glib/GTK+, and (3) Run X every time you want to use Dillo. There is a port of GTK+ to Windows, though, which was originally done for the Windows port of GIMP <http://www.gimp.org/~tml/gimp/win32/>. I have no idea what else would be needed to port Dillo using these, or whether any of the main developers would think it was worth the effort. Kelson Vibber www.hyperborea.org

July 8, 2003