diff --git a/index.bs b/index.bs index 7cd55fe..6f75da9 100644 --- a/index.bs +++ b/index.bs @@ -411,49 +411,89 @@ Note: The high-entropy portions of the user agent information are retrieved thro Processing model {#processing} -------------- -
WindowOrWorkerGlobalScope
WindowOrWorkerGlobalScope
FrozenArray<NavigatorUABrandVersion>
. It is initially the result of [=create a frozen array|creating a frozen array=] from the [=user agent=]'s [=brands=].
+Every {{WindowOrWorkerGlobalScope}} object has an associated brands frozen array,
+which is a FrozenArray<NavigatorUABrandVersion>
. It is initially the
+result of [=create a frozen array|creating a frozen array=] from the [=user agent=]'s [=brands=].
-getHighEntropyValues
methodgetHighEntropyValues
methodgetHighEntropyValues(|hints|)
method MUST run these steps:
@@ -527,20 +567,20 @@ One approach which might be advisable could be for each [=user agent=] to lock t
the version number, then shifting platform and model information to something reasonably generic in
order to reduce the fingerprint the header provides.
-GREASE-like UA Strings {#grease}
+GREASE-like UA Brand Lists {#grease}
----------------------
History has shown us that there are real incentives for [=user agents=] to lie about their branding
in order to thread the needle of sites' sniffing scripts, and prevent their users from being blocked
by UA-based allow/block lists.
-Resetting expectations may help to prevent abuse of the UA string's brand in the short term, but
-probably won't help in the long run. The world of network protocols introduced the notion of GREASE [[I-D.ietf-tls-grease]].
We could borrow from that concept to tackle this problem.
[=User agents=]' [=user agent/brands=] containing more than a single entry could encourage
-standardized processing of the `UA` string. By randomly including additional, intentionally
+standardized processing of the [=user agent/brands=] list. By randomly including additional, intentionally
incorrect, comma-separated entries with arbitrary ordering, they would reduce the chance that we
ossify on a few required strings.
@@ -548,10 +588,10 @@ Let's examine a few examples:
* In order to avoid sites from barring unknown browsers from their allow lists, Chrome could send a
UA set that includes an non-existent browser, and which varies once in a while.
- `"Chrome"; v="73", "NotBrowser"; v="12"`
-* In order to enable equivalence classes based on Chromium versions, Chrome could add the rendering
+* In order to enable [=equivalence classes=] based on Chromium versions, Chrome could add the rendering
engine and its version to that.
- `"Chrome"; v="73", "NotBrowser"; v="12", "Chromium"; v="73"`
-* In order to encourage sites to rely on equivalence classes based on Chromium versions rather than
+* In order to encourage sites to rely on [=equivalence classes=] based on Chromium versions rather than
exact UA sniffing, Chrome might remove itself from the set entirely.
- `"Chromium"; v="73", "NotBrowser"; v="12"`
* Browsers based on Chromium may use a similar UA string, but use their own brand as part of the
@@ -559,16 +599,11 @@ Let's examine a few examples:
- `"Chrome"; v="73", "Awesome Browser"; v="60", "Chromium"; v="73"`
-[=User agents=] MUST include more than a single value in [=user agent/brands=], where at least one
-of these values is an arbitrary value.
-
-When adding arbitrary values to [=user agent/brands=], [=user agents=] MUST make sure that receivers
-of the header adhere to [=Structured Header=] parsing, by adding escaped double-quotes, commas and
-semi-colons to those values. The purpose of this is to make non-compliant server implementations
-immediately aware that their parsing code is inadequate.
+[=User agents=] MUST include more than a single value in [=user agent/brands=], where one of these values is an
+arbitrary value.
-The value order in [=user agent/brands=] MUST change over time, the prevent receivers of the header
-from relying on certain values being in certain locations in the string.
+The value order in [=user agent/brands=] MUST change over time to prevent receivers of the header
+from relying on certain values being in certain locations in the list.
When choosing GREASE strategies, [=user agents=] SHOULD keep caching variance in mind and minimize
variance among identical [=user agent=] versions.