Hacker News Reader

Comment by lallysingh | Hacker News Reader

I don't get this feature detection problem. The browser identifies itself in the request. Why not serve the right version at the beginning?

View on HN

1. Because every browser pretends to be each other and so the UA is worthless: https://webaim.org/blog/user-agent-string-history/

2. Because you're not going to update your detection every time a new version comes out, meaning that new browsers that support the features you need are still going to get served the wrong version of your site.

3. Because there are more browsers than you can count.

4. Because for non-syntax related features, feature detection on the client is usually pretty simple.

5. Because the UA is trivial to spoof.

For 1, 2, and 3: I figure you just need to parse the UA string to get the actual browser and version number, then have a variant for before and after a given threshold number. You're only doing this for the number of variants of code you want to run/maintain, so this isn't some sort of combinatorial explosion.

It's just another method of dispatch instead of runtime checks inside JS. At worst you put the runtime check in the "I don't know what you are" variant and let them run slower.

For 5: If the browser's lying, you're morally off the hook. The user's configured their browser to lie, and gets what they deserve.

For point 4, fair enough. Go for that when you can.

Browser sniffing falls in the same category as time, crypto, and string encoding for me. If you think it's easy, you haven't spent enough time thinking about it.

A few seconds of googling found quite a few prebuilt results. First one: https://github.com/faisalman/ua-parser-js

It doesn't have to be trivial to be worth doing.

Direct from the README of the linked library:

> However, it's not recommended to use this library as browser detection since the result may not accurate than using feature detection.

Are you referring to user agents? Serving different code based on user agent is considered bad practice, and would be a maintenance nightmare. Not to mention, serving different JavaScript would make it more difficult to reason about what is running client-side. Plus, user agents are neither canonical nor necessarily even reliable sources of information about the browser.

Because it's bad behaviour to rely on browser user agents instead of feature detection. It's what led to IE-only sites and is currently leading to Chrome-only sites.

Are there Chrome-only sites? I'm sure they exist on LANs, but are there public sites that only work with Chrome?

https://meet.google.com/

Although, it's not very good in Chrome either :)

> Are there Chrome-only sites?

Yes, very much so. Especially on mobile, where UA-sniffing is rife.

Here's a very much non-exhaustive sample:

https://bugzilla.mozilla.org/show_bug.cgi?id=1047854

https://bugzilla.mozilla.org/show_bug.cgi?id=975444

https://bugzilla.mozilla.org/show_bug.cgi?id=1322001

https://bugzilla.mozilla.org/show_bug.cgi?id=958575

https://bugzilla.mozilla.org/show_bug.cgi?id=1020740

https://bugzilla.mozilla.org/show_bug.cgi?id=1232656

https://bugzilla.mozilla.org/show_bug.cgi?id=1377499

https://bugzilla.mozilla.org/show_bug.cgi?id=1393109

(funny what percentage of those are google.com sites....)

In addition to the UA spoofing others mention, there's also forward conpatibility.

If your app holds a mini "caniuse.com" UA-feature mapping, you have to keep it up to date infinitely forward in time, or new browsers won't work (think Brave/etc)

Better to detect features directly, and reward anyone who implements them, rather than just hardcode the present incumbents.

The browser only identifies itself by name, not by the features it supports. Having the server decide blindly on what features the browser can handle, would be terrible.

Having browsers identify themselves by the features they support would have been nice, but also very complicated, and it's not where we are now.

Because browsers can and do lie? Often to get around such "serving the right version" logic.

Or the "Browse the web faster and more securely, try (Chrome|Edge)" crap?

Reply on news.ycombinator.com