Hallvord R. M. Steen

10 is the one

Friday, 19. December 2008, 00:29:51

So we're busy preparing the major upgrade from 9.5x and 9.6x - and what's more obvious than calling it Opera 10? What's in a name, or a version number?

Apparently a lot of trouble.

As Andrew Gregory already noticed, we're the first browser ever to release with a two-digit version number. If websites assume that version numbers always have a one-letter "major" part and look for a single digit, they are going to "detect" Opera 1!

Since we released the first preview of Opera 10, we're seeing the bug reports come in. Web sites go belly up because of their bad sniffing. Some of them aren't even ashamed of it..

Thanks, Bank of America. Do you feel like it's 1995 again? Yeah, me too.

You'd think that with the intense development Microsoft has been lavishing on live.com they would have found somebody capable of writing a usable browser sniffer (or ideally a person clever enough to say "wait, we don't really need one - what if we just use feature detection instead?"). Think again..

..and for further evidence that their backend version detection is an odd piece of software engineering, read their cookies closely - Opera 9.62's request first, then Opera 10:

GET /mail/browsersupport.aspx 
Host: co109w.col109.mail.live.com 
User-Agent: Opera/9.62 (Windows NT 5.1; U; en) Presto/2.2.0 

Set-Cookie: BrowserSense=Win=1&Downlevel=0&WinIEOnly=0&Firefox=0&Opera=1&OperaVersion=9.2&Safari=0; domain=.live.com; path=/

GET /mail/browsersupport.aspx 
Host: co109w.col109.mail.live.com 
User-Agent: Opera/10.00 (Windows NT 5.1; U; en) Presto/2.2.0 

Set-Cookie: BrowserSense=Win=1&Downlevel=1&WinIEOnly=0&Firefox=0&Opera=1&OperaVersion=&Safari=0; domain=.live.com; path=/

Did you spot the missing version value? We really confused them by adding 0.37 to our previous value, didn't we?

Speaking of cookies, they are the main reason we added the feature that lets you hide Opera's identity. Back then in 1996 or so, some sites would do browser sniffing and send cookies only to known browsers. On the next page, if you didn't serve it cookies the site would say "hey, you don't support cookies so go away". What would Joseph Heller make of that, I wonder?

So, rewind to meet the catch-22 server, re-born at Bank South Australia:

GET /InternetBanking/ HTTP/1.1
User-Agent: Opera/9.62 (Windows NT 5.1; U; en) Presto/2.1.1
Host: ibanking.banksa.com.au

HTTP/1.1 200 OK
Set-Cookie: JSESSIONID=000019WTazsWAk-lB38OrmKD3kR:13l3ifhnq;Path=/
Set-Cookie: bhCookieSess=1;Path=/
Set-Cookie: bhCookiePerm=1;Expires=Sat, 20-Dec-2008 23:35:40 GMT;Path=/

..and Opera 10..:

GET /InternetBanking/ HTTP/1.1
User-Agent: Opera/10.00 (Windows NT 5.1; U; en) Presto/2.2.0
Host: ibanking.banksa.com.au

HTTP/1.1 200 OK
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-AU
Date: Thu, 18 Dec 2008 23:34:37 GMT
Connection: close

Um, I'm hungry. Where are your cookies? Predictably the next page looks like this:

This is probably just the beginning.

Will the web ever learn?

Browser security handbookGoogle Maps vs. DOM2 specification 1-0

Comments

Mickeyjoe_irl # 19. December 2008, 01:12

I'm getting Y2K deja-vu.

TreeGo # 19. December 2008, 02:26

So why trust the web? Simply call this new version Opera 9.64 or some such thing? Nobody cares about the numbers anyway except the browser sniffers.

Anonymous # 19. December 2008, 02:40

Moginspace writes:

Yahoo also doesn't work.

Anonymous # 19. December 2008, 02:45

Anonymous writes:

You're not quite the first. A lot of website are choking on Flash version 10.0 :)

Anonymous # 19. December 2008, 02:57

Anonymous writes:

just to screw with them call it Opera A

Anonymous # 19. December 2008, 03:12

Anonymous writes:

I second the Opera A suggestion.

Anonymous # 19. December 2008, 03:38

Anonymous writes:

Switch to roman numerals, they look cooler. Opera X.

Anonymous # 19. December 2008, 03:40

andi writes:

Surely Opera X makes most sense?

Anonymous # 19. December 2008, 03:47

Mike writes:

...and what about opera 11??...back to the two digit issue again.

Anonymous # 19. December 2008, 04:02

Anonymous writes:

@Mike:
We'll use hexadecimal! ...and then unicode glyphs!

Anonymous # 19. December 2008, 04:15

Poltras writes:

Why not Opera/010.0 ? No one is going to detect Opera 0.

And I second the feature detection, although to be fair if you're using Opera/1 your JScript will probably choke on feature detection code...

Jere # 19. December 2008, 04:29

How about a compromised user agent string...

Opera/9.99 [10.00] (Windows NT 5.1; U; en) Presto/2.2.0

or something thereabouts

Anonymous # 19. December 2008, 05:09

Anonymous writes:

Poltras, leading zeroes often signify octal (base-8), so 010 would actually be version 8.

Anonymous # 19. December 2008, 06:09

J. Pablo Fernández writes:

If I were you, I would reverse-sniff. I would build up a centralized list of web sites that do it, with the important strings "You are using an old browser", "Please update" and make Opera download that list and recognize when that is happening. When it is, I would make an unobtrusive pop-up (Firefox remember-password style) saying: "The site you are viewing is very badly built and that's why you probably are getting a message that your newly shiny browser is too old, do you want to trick it? Yes, trick it; No, it's fine" and when the user chooses tricking I would change the user agent to "Opera/9.99 [1X.XX, because you don't know how to count!".

As an added bonus you can search for any email addresses in the page and if one is found ask the user "Do you want to notify the owner of the website about their problem" and when "Yes", I would send them an email.

DD32 # 19. December 2008, 06:55

@J. Pablo Fernández writes:

Opera allready has such a list, And its used to force Opera to switch into "Identify as blah" or "Mask as blah" as needed for stupid websites, It also modifies a lot of websites via Javascript so that it works correctly for you, Of course, It can also be used to fix Opera errors in released versions.

see http://www.opera.com/docs/browserjs/

Anonymous # 19. December 2008, 08:32

Nick writes:

People use Opera?

xErath # 19. December 2008, 09:00

I liked Jere's suggestion a lot !

Anonymous # 19. December 2008, 09:06

Anonymous writes:

You ever wondered why windows 7 is version 6.1, or xp 5.1?

tarquinwj # 19. December 2008, 09:45

We can't use X or A or anything like it. The trouble is how sites do their sniffing. The number of approaches is quite diverse - and this is just on the client side:

* /Opera[\/ ][1-6]/ -> "Version is too low" but it matches "Opera 10"

* UA.chatAt(6) > 6 -> "Version is high enough" but it fails to match "Opera 10", "Opera X", "Opera A".

* UA.substring(6,7) > 6 -> "Version is high enough" but it fails to match "Opera 10", "Opera X", "Opera A".

We see all sorts of sniffers based on these patterns, and most make some arithmetic check using the > or < operators. Both implicitly cast to a number, but always return false when working with NaN. We can't break the way arithmethic operators work just to force sniffers to work

The idea of fudging the UA string to contain two version numbers has been done plenty of times before. IE still claims to be Mozilla/4.0. Firefox still claims to be Mozilla/5.0. But they were doing that to be compatible with another browser's UA string. We are trying to be compatible with our own.

Our UA string patterm means that Opera/10 is the next logical step. We could hack it like Jere suggested, and we did look into that. But it forces sites to jump through ridiculous hoops just to get Opera's version number for legitimate uses (there aren't too many, but stats are a common usecase). And then we might have to do it again when sites start relying on the hack approach:
Opera/9.99 [10.00][really 11.00] (Windows NT 5.1; U; en) Presto/2.2.0
Opera/9.99 [10.00][really 11.00][actually 12.00] (Windows NT 5.1; U; en) Presto/2.2.0
Opera/9.99 [10.00][really 11.00][actually 12.00][OK_I_lied_it's 13.00] (Windows NT 5.1; U; en) Presto/2.2.0

At some point, someone has to bite the bullet. And it looks like we are biting. We still have to change to version 10 soon, because it is the next logical step. So we have to work with the consequences. This comes down to our Open The Web project, who contact these sites, pointing out their mistakes, and suggesting alternatives. For example, those that like to use this:
UA.substring(6,7) > 6
Can just use this:
UA.substring(6) > 6
Or:
parseFloat(UA.substring(6)) > 6

This is partly what alphas are for - to give Web sites a chance to see what's on the horizon, and prepare for it. Maybe this will clear a path for the future, when others reach the magic two-digit numbers, but I doubt it.

Cover us, we're going in!

Anonymous # 19. December 2008, 10:05

Anonymous writes:

This is a problem which is common for Flash as well - once Flash 10 was launched, they started running into precisely these issues.

Anonymous # 19. December 2008, 10:47

Anonymous writes:

Banksa is in the past.
Cheap fees sure, but I moved away from them.

Anonymous # 19. December 2008, 10:53

Anonymous writes:

We use this:

Opera/([0-9]+)(\.([0-9]+))?

Anonymous # 19. December 2008, 11:00

Anonymous writes:

This is furthers my belief that web devs are, mostly, retarded. Web dev is the Special Olympics of programming.

Anonymous # 19. December 2008, 11:04

Ben writes:

My vote for "Opera MX" (the "X" is for "extreme").

Alternatively, you could go with the dewey decimal system.

Andrew Gregory # 19. December 2008, 12:03

@tarquinwj: I've got your back

There's some good news, too! The site that started it (for me, anyway) has just advised me that they have updated their code to handle two-digit version numbers, and I've just confirmed that. Yay!

And it only took six months.

One down, far too many to go...

Anonymous # 19. December 2008, 12:21

Anonymous writes:

Opera 90 would work up to version 99, it should be long enough for IE and firefoxto get there and then all the websites have to make the change.

Anonymous # 19. December 2008, 13:27

Jubal writes:

Well, it's obviously your fault for sticking with the same naming system for an entire 10 versions - a preposterous course of action in today's modern, dynamic and ever-changing internet.

MTKnight # 19. December 2008, 13:46

Are you kidding, Jubal? If a simple digit "overflow" causes this much trouble, I can't even fathom what a complete change of scheme would do. You're probably kidding. I hope.

d4n3 # 19. December 2008, 14:04

You're on the frontpage of reddit

Anonymous # 19. December 2008, 14:24

Anonymous writes:

Take the TeX approach. The version number of TeX approaches Pi and with every release they add another digit.
Maybe 9.9 = 10, 9.99 = 11, 9.999 = 12, etc ...

Anonymous # 19. December 2008, 14:25

Anton writes:

I'm having the same issue with Flash 10 on a few sites. Most of them seem to be using a string compare since they identify my flash version as 10 and suggest I upgrade to at least flash 7.

Anonymous # 19. December 2008, 14:26

Jeremy writes:

How about 9+1, 9+2, and so on.

Anonymous # 19. December 2008, 14:40

Anony mouse writes:

I can't even log into my other websites with Opera:

sprint.com
uboc.com

Anonymous # 19. December 2008, 15:06

Frankie writes:

How about Opera X ?

Anonymous # 19. December 2008, 16:25

Anonymous writes:

How about you call it opera x?

d4n3 # 19. December 2008, 17:13

Originally posted by Anonymous:

How about you call it opera x?

http://my.opera.com/hallvors/blog/show.dml/2834389#comment6622253

TreeGo # 19. December 2008, 18:04

Again, what is the big deal about a version number from Opera's standpoint? Do Opera users care if you call yourself version 10 or 9.64 or 9.635 or 9.7 or whatever? I doubt it. So why make your consumers suffer by putting out an arbitrary number like 10 that you know will cause a problem with numerous websites which will not be resolved for several months (years)? It would be far easier to just accommodate the users of Opera by choosing a version number that fits the programming of websites worldwide in a much smoother/more_compatible way than forcing the web authors to react to a loyal/rabid Opera-using audience which are such a small minority of web viewers. These web authors by-and-large are not in a rush to react to Opera's version numbering system.

FataL # 19. December 2008, 18:32

What Opera should have are two additional options:

Identify as Opera 9.99
Mask as Opera 9.99

I just want to quote myself:

Originally posted by FataL:

Seems that it may be even worse than "Year 2000".

Anonymous # 19. December 2008, 18:44

re: TreeGo writes:

"Do Opera users care if you call yourself version 10 or 9.64 or 9.635 or 9.7 or whatever?"

If you noticed from the cookie, it detected 9.62 as 9.2, so yes, it matters. They can't do 9.635 or even 9.63. They already can't do 9.62, but it hasn't mattered yet as site operators aren't selecting based on minor version number. But we're already at x.6, so that leaves only 3 versions of Opera before they hit 10.0 anyway.

Websites need to allow multiple digits for both major and minor version numbers. Period. Opera's going to hit this problem soon enough, it may as well be now. Someone has to drive "innovation" even if by innovation we only mean "doing it right."

Anonymous # 19. December 2008, 19:01

Anonymous writes:

Would Opera X work?

Anonymous # 19. December 2008, 20:08

Anonymous writes:

Opera X - but then again, you'll probably get sued by Apple.

Now, a serious suggestion: Name it Opera Pavarotti, in honor of the greatest tenor in modern times.

Anonymous # 19. December 2008, 20:09

Anonymous writes:

Opera X - but then again, you'll probably get sued by Apple.

Now, a serious suggestion: Name it Opera Pavarotti, in honor of the greatest tenor in modern times.

qwo # 19. December 2008, 20:40

Looks like opera's browser.js has the same mistake

// line 984 - Opera 9.60 version
// line 919 - Opera 10 version:
document.addEventListener((parseInt(opera.version())>9?'DOMContentLoaded':'load'), function()
{
/* .... */
}, false);

Anonymous # 19. December 2008, 21:46

vitty writes:

what increase the version of Opera to 90.0 ? ;-)

_Grey_ # 19. December 2008, 23:37

@MTKnight: Jubal was kidding. But "naming scheme" means they stuck to one name (imho). Everything gets a new name before they run into two-digit version numbers. Can't think of any examples OTOH, but that was what he meant, I think.

@qwo: I think you misunderstood. The problem was not using parseInt or parseFloat, but rather what you use it on. In the examples Tarquin posted above that would be a substring of the UA string (in the cases where it breaks Opera 10 this substring is only one digit long).

Kelson # 20. December 2008, 00:45

I remember commenting on the double-digit renaming thing a while back. Mac OS, Windows, Red Hat Linux, Photoshop, Mandrake Linux, Conectiva Linux...all projects that either renamed themselves (Red Hat to Fedora) or moved to another versioning scheme (XP/Vista and Tiger/Leopard, yearly vintages, CS1/2/3, etc.).

Off the top of my head, I can think of the following software products that have gone to 11 and haven't (yet) changed to another scheme or name:

OpenSuSE Linux.
Windows Media Player.
Some long-running video game series.

I'm trying to think of any others...

Jere # 20. December 2008, 04:38

Tarquin:

I beg to differ from your view of a slippery slope. A hackish UA string such as the one I proposed will indeed require accommodation by everyone who (legitimately) wants to know the version number. However, I theorize that sniffers will learn to parse – if not an unlimited sequence of digits – at least a two-digit (plus decimals) version number from the given location, and thus increments to the version number should be safe up to version 99.

I understand that Opera Software sticks to their principles about an open Web rather obstinately, and while that is a sincerely good intention, this problem really is self-induced. It would be naïve to assume that the problematic browser-sniffing can be gotten rid of during the alpha/beta phase – new problem children might (and will) keep popping up, and the problems they cause could have been avoided.

Browser sniffing and website incompatibility in general has always been one of the biggest reasons people choose not to use Opera. browser.js and override_downloaded.ini are a great aid, but their cure comes with a significant latency. For many years, Opera defaulted to the fake MSIE user agent string, which meant that stat generators had to learn how to detect Opera. You realized that usability was a bigger priority than legitimate uses of browser sniffing. Please don't alter your stance.

Andrew Gregory # 20. December 2008, 06:42

@Jere: I just don't understand how you can consider a site failing to handle two-digit version numbers an "Opera self-induced" problem?

The basic problem, IMO, is that the average web developer is careless and poorly trained. Things really need to be made simpler for them. Adding multiple different version numbers to the UA string won't help. Opera's addition of MSIE to their version string was criticized by quite a few people as simply muddying the waters and making it more difficult to correctly handle Opera.

I think this two-digit version issue affects relatively few sites, and tends to be a trivial fix for the site. I don't believe it's worth making a mess of the UA string again. There are bigger issues for Opera to work on.

BTW, the number of people who have made suggestions like "Opera X" and "Opera A" (here, on my blog, on reddit, etc) really highlight the typical thought processes going on in web design.

Which is at the bottom of an awful lot of Opera's "problems".

Anonymous # 20. December 2008, 07:27

David writes:

User-Agent: Opera/9.6*1.042 (Windows NT 5.1; U; en) Presto/2.2.0

Jere # 20. December 2008, 09:08

Andrew, the problem...

didn't exist before.

It is not a result of changes to rendering in a more/less spec-compliant direction.

It is the result of changing a header value that bears no significance to the user, as long as everything works as intended. This is an initiative by the browser's vendor.

Loss of acclaim by a handful of makers of legitimate browser-sniffing code should weigh far less than uncountable end users who might become victims of failed detection. Besides, criticizing the spoofed MSIE UA string is rather pathetic. You still need to find how the UA string is formatted by each browser you want to detect, and the only additional thing Opera's fake identification demands is that you search the string for Opera before MSIE. Agreed, my proposal would not be quite as simple to handle, but maybe it could if done in the same fashion:

Opera/9.99 (Windows NT 5.1; U; en) Presto/2.2.0 Opera/10.00

After years of detachment from web dev I can't think sharply enough to conceive something more elegant. There is not much more I can add, you've seen my suggestion and that's all I have to offer.

1 2 Next »

Showing comments 1 - 50 of 83.