Search the web
Sign In
New User? Sign Up
wmlprogramming · WML,XHTML,WURFL & Mobile-related stuff
? Already a member? Sign in to Yahoo!

Yahoo! Groups Tips

Did you know...
Hear how Yahoo! Groups has changed the lives of others. Take me there.

Best of Y! Groups

   Check them out and nominate your group.
Having problems with message search? Fill out this form to ensure your group is one of the first to be migrated to the new message search system.

Messages

  Messages Help
Advanced
W3C fuckers in action   Message List  
Reply | Forward Message #28956 of 31751 |
Re: [wmlprogramming] W3C freakers in action

Tom Hume wrote:
> On 29 Oct 2008, at 17:16, Luca Passani wrote:
>
>
>> "explicitly" is a way too weak defense against abuse. They will abuse
>> and start arguing that those who complain have a different
>> perception of
>> "explicitly". It's as simple as that.
>>
>>
> Do you have a suggestion for stronger wording of that sentence -
> retaining the meaning but removing the loophole you see there (which
> I'm not sure I see btw)?
>

yes. Remove the clause that enables UA spoofing when the user requests
it. One possibility (which is also contemplated by the Manifesto) is to
issue a request with unaltered HTTP headers. If the response is not
"mobile-friendly" for any definition of mobile friendly, then you can
re-issue with spoofed headers.

BTW, I know that 4.1.5.1 says that "contest tasting" (i.e. duplicate
requests) are not OK, but the reason for it ("The theoretical
idempotency of GET requests") is bogus, so the problem could be solved
there.



>>> If you can point me to an email or fwd me one (off-list if you like)
>>> I'll make sure it gets raised.
>>>
>> look at the links I posted. There I ask why they do not make CTG only
>> apply to opt-in, and nobody took up the suggestion (and Sean Owen
>> said:
>> "I think that's a reasonable position to take. It's not the one I
>> would
>> take, nor apparently people here")
>>
>>
> What's the difference between requiring a user to explicitly ask for
> transcoding, and making transcoding opt-in? To me, they're the same
> thing: the user has to ask for it, rather than being given it and told
> to opt out.
>

the difference is that most users won't know/understand that a
transcoder has been introduced, let alone that they can opt-out of it.
Look at Novarra/VodaUK, they were claiming that their service was opt-in
simply because users were given a chance to log-out.

>>> I can't see any mention of APNs or handling certain mobile APNs
>>> differently from others in any of the links you've posted. All I can
>>> see are your opinions on the UA string and HTTPS?
>>>
>> look at the links in my previous email. I did not use the term APN,
>> but
>> the point was the same. Devices ship with an APN. If you place your
>> transcoder there, then it's not an opt-in transcoder. People get it by
>> default. So, everything I wrote about making CTG apply to opt-in
>> transcoders was about not placing the transcoder in the middle of
>> connections going through the main/default APN.
>>
>>
> Ah OK. But isn't the definition of "default APN" open to
> interpretation (certainly more so than the word "explicitly" IMHO)?
> After all, different applications or browsers on a device may be
> configured to use different APNs; and what is the default anyway -
> Vodafone WAP or Vodafone Internet, say?
>

right. So we should talk of main APNs, since an operator may have many.
In general, no APN that comes pre-configured with a phone.

> Just to check I've understood your point though: you're suggesting
> that transcoding should be opt-in for the default mobile APN?
>

I am suggesting that transcoding should happen in a way that
knowledgeable users will decide that a certain favorite web site of
theirs should be reached through transcoding, and explicitly access a
transcoding portal where they can type the URL or their
transcoder-managed bookmarks.

Luca


> --
> Future Platforms Ltd
> e: Tom.Hume@...
> t: +44 (0) 1273 819038
> m: +44 (0) 7971 781422
> company: www.futureplatforms.com
> personal: tomhume.org
>
>
>
>
> ------------------------------------
>
> As of July 14 2005, it's much easier to be banned from WMLProgramming!
> Please fail to read http://groups.yahoo.com/group/wmlprogramming/ before you
post.Yahoo! Groups Links
>
>
>
>
>




Fri Oct 31, 2008 2:12 pm

luca_passani
Offline Offline
Send Email Send Email

Forward
Message #28956 of 31751 |
Expand Messages Author Sort by Date

... Do you have a suggestion for stronger wording of that sentence - retaining the meaning but removing the loophole you see there (which I'm not sure I see...
Tom Hume
twhume
Offline Send Email
Oct 30, 2008
11:01 pm

... yes. Remove the clause that enables UA spoofing when the user requests it. One possibility (which is also contemplated by the Manifesto) is to issue a...
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
2:12 pm

... I'd disagree with you there, from my own personal experience. We had a service which allowed users to download a given JAR file a specific number of times,...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
2:27 pm

... You disagree wrong. First off, if you do the first request with unaltered headers and the response is mobile, you DO NOT need to dusplicate the request....
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
2:51 pm

... That's one for my .sig :) ... Right. The instance I was talking about wasn't transcoding, come to think of it. It was (I suspect) an adult verification...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
3:06 pm

... it still is, but at least now it would not affect mobile sites. (only websites, but minimally compared to the regular web traffic they experience) Anyway,...
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
3:20 pm

... Sure. It's good to have agreement that there are some situations where this is OK. ... Can any document not be used to this effect? ... Ah, I see. So...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
4:34 pm

... No! No! No! Spoofing the UA is *never* OK. The situation is that some arrogant bastard comnpanies have paid W3C to pass recommendations which fit their...
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
5:44 pm

... Err... you just gave an instance of a situation where it was OK, "content tasting" - where I note the CTG takes a different stance in saying this shouldn't...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
7:55 pm

... it takes this stance necause Novarra prefers to do UA spoofing: 1) it's closer to how their product works 2) it makes them more money (fewer web sites...
Luca Passani
luca_passani
Offline Send Email
Nov 1, 2008
7:40 am

... [blah blah] OK, so ua-spoofing is evil and no-one should do it - except in the instance when Luca says it's OK: for content tasting, something the CTG is...
Tom Hume
twhume
Offline Send Email
Nov 1, 2008
12:30 pm

... Is my english so bad that you cannot understand what I wrote or are you trying to irritate me by playing dumb again? UA spoofing is NOT OK, not even for...
Luca Passani
luca_passani
Offline Send Email
Nov 1, 2008
2:24 pm

... I'm not playing dumb, Luca. I'm afraid I must *really* be this stupid :) ... Then I must have misunderstood you when you said "If you realise the response...
Tom Hume
twhume
Offline Send Email
Nov 1, 2008
2:46 pm

... serve its ... string, ... are ... it ... something ... should ... Several weeks ago I posted a message with an exhaustive discussion of servers handling...
casays
Offline Send Email
Oct 29, 2008
4:26 pm

... OK. So: 1. In the case of a transcoder not changing the user-agent header, all is well. The mobile device receives no content. 2. In the case of a...
Tom Hume
twhume
Offline Send Email
Oct 29, 2008
5:05 pm

... all ... Correct. ... after ... use ... Yes, but this is not the point: the server wants to avoid any content to be sent at all -- transcoded or not -- to a...
casays
Offline Send Email
Oct 29, 2008
7:51 pm

... because of its adulterations. I expect Web (fixed and mobile) applications to rely increasingly on x-device-user-agent, and utilize user-agent only as a...
James Pearce
kuriuskat2001
Offline Send Email
Oct 29, 2008
11:22 pm

... worst case scenario is actually an escalation of "if then else": check for via header, spoofed UA, request IP-range....and so on. ... maybe you can still...
Luca Passani
luca_passani
Offline Send Email
Oct 29, 2008
11:34 pm

... mobile sites too? What vendors want to do and what standards constrain can easily be two different things. To me, the most important part of the CTG work...
James Pearce
kuriuskat2001
Offline Send Email
Oct 31, 2008
8:07 am

... Sure, but this was not my question. My question is: what is your personal opinion about a company that feels entitled to reformat someone else's mobile...
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
2:20 pm

... wrote: [...] I agree wholeheartedly with your characterization of transcoded vs. original mobile applications, and with your call to continue resolutely...
casays
Offline Send Email
Oct 30, 2008
7:43 am

... OK... how is this situation dealt with elsewhere in HTTP outside of the world of mobile and transcoding? What mechanisms exist for an HTTP server to insist...
Tom Hume
twhume
Offline Send Email
Oct 30, 2008
11:27 pm

... By providing such resources only over HTTPS would be the general case, for banking, etc. I don't think there is a general case for HTTP-only, except...
Russ Ferriday
rferriday
Offline Send Email
Oct 30, 2008
11:43 pm

Russ How does retaining the user agent guarantee that a server is talking direct to a client, but not through a a proxy? ... -- Future Platforms Ltd e:...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
8:34 am

... Well, you are quite right. There is no such guarantee. --r....
rferriday
Offline Send Email
Oct 31, 2008
9:13 am

... Technically, you are right on this one, but I think I understand what Russ find confusing. Proxy have always existed, but they have generally been well...
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
2:24 pm

... I think the fact that we were using the word "user agent" to refer to the HTTP client and the user-agent header might also have contributed to the...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
2:30 pm

... I think the answer is that the responsibility lies in how you deploy it. Everything can be misused after all. Not by coincidence, the Manifesto does not...
Luca Passani
luca_passani
Offline Send Email
Oct 31, 2008
3:10 pm

... to ... contributed ... I agree with you, Tom. The user agent, the user agent id, and the HTTP User-agent header field are three distinct things (the last...
casays
Offline Send Email
Oct 31, 2008
5:49 pm

... A little birdie tells me the CTG currently concentrates on the latter ... Do you think the former has much value? I'm not sure what's useful in a product...
Tom Hume
twhume
Offline Send Email
Oct 31, 2008
7:55 pm
 First  |  |  Next > Last 
Advanced

Copyright © 2009 Yahoo! Inc. All rights reserved.
Privacy Policy - Terms of Service - Guidelines - Help