Background: I’m using Ungoogled Chromium, which I do not keep up to date because non-Debian packages are a big hassle to maintain. I expect this risk to be mine alone.
Since websites are secretive¹ about their reasons for blocking, it has been quite painful (as a Tor user) that many services are not blocking Tor, but in fact blocking old versions of Chrome. WTF? Why does a website block old Chrome versions? My gut thought was the website wants to nanny users, to try to force users to secure themselves (“for the user’s own protection”), because surely a user with old chrome does not realistically threaten the server’s security.
The answer: it turns out that AI bots are strangely using old Chrome versions for a user-agent header. So webmasters are reacting by blocking old versions of Chrome. What I don’t understand is why devs of AI bots would try to masquerade as old Chrome versions.
And to a lesser extent I wonder why webmasters are reckless enough to take this collective-punishment-is-ok stance. It would be like a store owner banning customers wearing blue hats from their shop because some shoplifters were caught wearing blue hats.
¹ Exceptionally, codeberg.org actually respects our dignity enough to preduce an error message that says they are blocking old chrome. But they are the exception.
That could be a plausible reason for opacity if it were true, but I don’t think it’s true because blocking Tor (for example) is trivially discovered and the non-transparency only frustrates legit users. The opacity of an anti-tor policy has no effect on adversaries. Yet a vast majority of tor-hostile sites are sloppy about informing legit users.
Infosec that relies on secrecy is already out on a limb in despiration. And in this situation, the collateral damage to friendlies based on arbitrary factors creates a heightened need to inform the legit users. An AI scraper bot is not going to be coded to know where to look for such announcements because that’s actually more effort for the attacker than manual trial and error. Note as well we are talking about relatively unsophisticated adversaries considering they were too lazy to code the user-agent header to dynamically blend better in the first place. (They will fix that in the future).
Nonetheless, your point cannot be disregarded because those who take the crude approach of blocking on the basis of UA string are likely not thinking all this through. Perhaps some have consciously made the decision to not inform the legit users, but considering the widespread pattern of not informing users, it’s sloppy disregard for the most part.