Remove GREASE

[jwrosewell]

This component makes the information harder to use and does not align with the problem statement related to making the information about the user’s agent more structured.

See this pull request which incorporates experiment feedback and review from interested users and other stakeholders for proposed text changes.

[yoavweiss]

This component makes the information harder to use and does not align with the problem statement related to making the information about the user’s agent more structured.

The component's goal is to make users of the information rely on standardized parsing of the headers, and don't engage in harmful UA sniffing practices (e.g. allow lists). The notion of GREASE is a well known one in the network protocol world, aiming to prevent protocol ossification, preventing future extensibility and future compatibility issues.

[jwrosewell]

UA sniffing is not harmful and is widely used, including by your employer Google. See the following screen shot obtained from Google search when accessing Google search from the latest version of Microsoft’s Edge in private browsing mode.

The User-Agent value is being used to identify the request is coming from a Microsoft browser and encourage the user to change to Chrome.

If it is the intention of the specification to prevent the practice popularly referred to as "UA sniffing" then this needs to be expanded on as it’s far from clear this is the problem being solved, what techniques constitute "UA sniffing", or even if this solution does solve that problem.

The GREASE document is an IETF informational document, and not a W3C one. The W3C is concerned with a wide set of principles including making the web available to "Do-it-yourself developers". GREASE Is a layer of complexity that makes the consumption of the data more complex and less available to lower skilled developers wishing to use the information.

Defining rules around the construction and use of the data contained in the new fields is an important activity to ensure consistency and avoid repeating the complexity mistakes made in relation to the current User-Agent field value in practice.

In any case I’m unclear how GREASE will prevent compatibility issues and protocol ossification. During the UACH TPAC session last week @yoavweiss acknowledged that the regex based parsers used extensively today would not be impacted by the benefits of GREASE. i.e. a regex looking for the word "Edge" will work when GREASE is applied to the field values.

[miketaylr]

Thanks for the feedback, but we do not intend to remove GREASE from the draft spec at this time. Please let us know if you run into any bugs related to GREASE, however. We're open to striking a balance between its intended purpose and compatibility with the existing web.

[jwrosewell]

GREASE adds a lot of characters that aren't needed thus is not very efficient and therefore environmentally friendly, and increases the complexity of the web for authors which isn't very friendly. An analysis of the extra bloat associated with this specification was provided in #200, which you and the chairs ignored.

We are hearing reports of GREASE breaking some services and have encouraged others to report them as we don't have sufficient detail.

[miketaylr]

We are hearing reports of GREASE breaking some services and have encouraged others to report them as we don't have sufficient detail.

Thank you for encouraging folks - this would be really useful info to have.

[kprivate22]

We had an issue with Chrome 103 switching to GREASE. The story sounds like a sad joke. We switched the device detection to work with UA client hints. And there was a requirement to make this information available for our payment gateway that runs on another domain, The payment gateway didn't want to change anything on his side to collect al the UA CH, so we sent all the parameters as simple input parameters to the payment GW. During the weekend we started to receive complaints that the payment page stopped loading. It took us some time to correlate that the issue comes from latest Chrome version, and then to pinpoint the issue on the changed client hint:
sec-ch-ua: ".Not/A)Brand";v="99", "Google Chrome";v="103", "Chromium";v="103"
The reason for it was a new closing bracket ) in Not/A)Brand. GW made some sanitization of the input parameters and decided that when there're more closing brackets than opening it's incorrect input, and failed the whole page.
And that, kids, is how I met your GREASE.

[miketaylr]

@kprivate22 thanks for the info, and sorry for the fire drill. In the future, filing bugs at crbug.com is super helpful if you run into issues like this.