Bug 216593 – [macOS] Limit reported macOS release to 10.15 series

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Brent Fulgham]

The world apparently isn't ready for macOS 11.0 in User Agents. Because of the depressing UA sniffing code on the web, let's just report our current shipping release until things settle down.

[Brent Fulgham]

<rdar://68937905>

[Brent Fulgham]

Created attachment 408883 [details]
Patch

[Maciej Stachowiak]

Comment on attachment 408883 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=408883&action=review

> Source/WebCore/platform/mac/UserAgentMac.mm:39
> +        osVersion = "10_15_6"_s;

Why do it this roundabout way instead of hardcoding this to "10_15_6"_s always? Under what circumstances would osVersion not start with 10? And if we fully hardcoded it, maybe we could encode it directly in the template string, same as the AppleWebKit/ version number.

[Maciej Stachowiak]

Comment on attachment 408883 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=408883&action=review

r=me

>> Source/WebCore/platform/mac/UserAgentMac.mm:39
>> +        osVersion = "10_15_6"_s;
> 
> Why do it this roundabout way instead of hardcoding this to "10_15_6"_s always? Under what circumstances would osVersion not start with 10? And if we fully hardcoded it, maybe we could encode it directly in the template string, same as the AppleWebKit/ version number.

Oh, I understand now. This is to preserve original OS version on older macOS.

[Brent Fulgham]

(In reply to Maciej Stachowiak from comment #4)
> Comment on attachment 408883 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=408883&action=review
> 
> r=me
> 
> >> Source/WebCore/platform/mac/UserAgentMac.mm:39
> >> +        osVersion = "10_15_6"_s;
> > 
> > Why do it this roundabout way instead of hardcoding this to "10_15_6"_s always? Under what circumstances would osVersion not start with 10? And if we fully hardcoded it, maybe we could encode it directly in the template string, same as the AppleWebKit/ version number.
> 
> Oh, I understand now. This is to preserve original OS version on older macOS.

Yes, exactly. That was Charles's request.

[EWS]

Committed r267148: <https://trac.webkit.org/changeset/267148>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 408883 [details].

Out of curiosity, when will this be changed again?

Would a better option perhaps have been to change it to 10.16 instead (which is what older Xcode versions did)? So that Big Sur can still be detected?

[Ryosuke Niwa]

(In reply to akielbas from comment #7)
> Out of curiosity, when will this be changed again?
> 
> Would a better option perhaps have been to change it to 10.16 instead (which
> is what older Xcode versions did)? So that Big Sur can still be detected?

The long term goal is to limit the disclosure of the underlying macOS via user agent string and other means since it can be used for finger printing purposes.

[Eric Portis]

Cloudinary is struggling to implement a workaround for https://bugs.webkit.org/show_bug.cgi?id=219977 / rdar://problem/72485913, which affects MacOS ≥ 11.1. Is there any reliable way to detect platform version, currently?

[karl]

Brent, Maciej,

> The world apparently isn't ready for macOS 11.0 in User Agents. Because of the depressing UA sniffing code on the web, let's just report our current shipping release until things settle down.

Do you have examples of sites which were breaking because of the OS information in the UA string?

I'm trying to retrace the origin of it. 
https://www.otsukare.info/2021/02/15/capping-macos-user-agent

We (Mozilla) are likely to try to work together with Google Chrome team on understanding the webcompat space as we are in the process of making similar changes.

[Aodhan Cullen]

(In reply to Ryosuke Niwa from comment #8)
> (In reply to akielbas from comment #7)
> > Out of curiosity, when will this be changed again?
> > 
> > Would a better option perhaps have been to change it to 10.16 instead (which
> > is what older Xcode versions did)? So that Big Sur can still be detected?
> 
> The long term goal is to limit the disclosure of the underlying macOS via
> user agent string and other means since it can be used for finger printing
> purposes.

That doesn't really make sense, as you were happy to report is as macOS 11.0 - but only rolled it back when it broke some websites?

We can't report on Big Sur usage correctly for the world any more at

https://gs.statcounter.com/macos-version-market-share/desktop/worldwide

Could you reconsider changing it to 10.16?

[Jonathan Watt]

FWIW Mozilla made the same change in Firefox 87 to report 10.15 forever to reduce fingerprint surface[1] (backported to Firefox ESR 78). That was after initially adding various special cases to report 10.16 for specific sites for web compat[2].

1. https://bugzilla.mozilla.org/show_bug.cgi?id=1679929
2. e.g. https://github.com/mozilla-extensions/webcompat-addon/pull/200

Safari (and all browsers) on my M1 MacBook running macOS Ventura still shows the useragent as "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4 Safari/605.1.15"

[Dushan]

Hi Team,
Still we can see the issue even this issue is fixed. All the usages are being tracked to macOS 10.15 Safari.Would you be able to take look into this

[Ashley Gullen]

Could Apple implement the navigator.userAgentData API? (Issue 241749)

Having frozen the user agent string macOS version, there is now essentially no public information on macOS usage by version. Apple do not appear to publish any such stats themselves, leaving web stats the only source of information that software developers can make decisions on (like StatCounter global stats) - but this information is no longer reliable as UA strings are frozen. It is difficult to know which versions to target and the wrong decision could leave lots of macOS users unsupported.

The navigator.userAgentData API could provide just the bare minimum major OS version (e.g. 14.0, 15.0) which provides basic compatibility information with minimal fingerprinting impact. It also has the benefit of not needing websites to have to parse obscure user agent strings.