Background: I’m using Ungoogled Chromium, which I do not keep up to date because non-Debian packages are a big hassle to maintain. I expect this risk to be mine alone.

Since websites are secretive¹ about their reasons for blocking, it has been quite painful (as a Tor user) that many services are not blocking Tor, but in fact blocking old versions of Chrome. WTF? Why does a website block old Chrome versions? My gut thought was the website wants to nanny users, to try to force users to secure themselves (“for the user’s own protection”), because surely a user with old chrome does not realistically threaten the server’s security.

The answer: it turns out that AI bots are strangely using old Chrome versions for a user-agent header. So webmasters are reacting by blocking old versions of Chrome. What I don’t understand is why devs of AI bots would try to masquerade as old Chrome versions.

And to a lesser extent I wonder why webmasters are reckless enough to take this collective-punishment-is-ok stance. It would be like a store owner banning customers wearing blue hats from their shop because some shoplifters were caught wearing blue hats.

¹ Exceptionally, codeberg.org actually respects our dignity enough to preduce an error message that says they are blocking old chrome. But they are the exception.

  • JRaccoon@discuss.tchncs.de
    3·
    4 days ago

    Probably not what you’re asking but sometimes companies are required to block insecure browser versions due to governmental certification requirements, and also because they could be held responsible if they allowed users to access their services with known insecure browsers and something then happened.

    What we used to do at my job was to display a big red warning banner to users with outdated or unsupported browsers, without strictly preventing them from using the site. This resulted in some users (who apparently couldn’t read) submitting support tickets when the site didn’t work with their three year old browser, then getting angry when we wouldn’t “fix” the bug. More importantly tho, this led to a failure in an external audit. I won’t go into the details, but basically the only sensible way to meet that specific requirement was to block all outdated browsers (by user-agent matching)