• 0 Posts
  • 81 Comments
Joined 1 year ago
cake
Cake day: July 15th, 2023

help-circle







  • That’s correct, it is just plain text and it can easily be spoofed. You should never perform an auth check of any kind with the user agent.

    In the above examples, it wouldn’t really matter if someone spoofed the header as there generally isn’t a benefit to the malicious agent.

    Where some sites get into trouble though is if they have an implicit auth check using user agents. An example could be a paywalled recipe site. They want the recipe to be indexed by Google. If I spoof my user agent to be Googlebot, I’ll get to view the recipe content they want indexed, bypassing the paywall.

    But, an example of a more reasonable use for checking user agent strings for bots might be regional redirects. If a new user comes to my site, maybe I want to redirect to a localized version at a different URL based on their country. However, I probably don’t want to do that if the agent is a bot, since the bot might be indexing a given URL from anywhere. If someone spoofed their user agent and they aren’t redirected, no big deal.


  • User agents are useful for checking if the request was made by a (legitimate self-identifying) bot, such as Googlebot.

    It could also be used in some specific scenarios where you control the client and want to easily identify your client traffic in request logs.

    Or maybe you offer a download on your site and you want to reorder your list to highlight the most likely correct binary for the platform in the user agent.

    There are plenty of reasonable uses for user agent that have nothing to do with feature detection.



  • I’m not sure how true this perception is in more recent years. Many popular sites, with enormous traffic volumes that could drive digital impression ad revenue, are instead pushing subscriptions or other monetization models.

    For instance, the New York Times makes — by far — more money on digital subscriptions than digital advertising. Digital advertising revenues are also declining for them.

    Another example is Spotify, where ad revenue from their ad-supported tier did not cover their operational costs and now represents around only a tenth of their revenue compared to subscriptions.

    The exceptions to this are generally search and social media sites, where the product for sale on these sites are the users themselves. They’re just advertising platforms, which of course make their money from digital advertising.

    So I’d say one issue with digital advertising is that it often does not pay the bills for the site owner. Its value is tied to its ability to convert visitors to buyers, but it has to be ramped up to such an extreme level it instead only creates bad experiences.


  • elrik@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    14
    ·
    2 months ago

    I go through significant efforts to block digital advertising at multiple levels. Yet, I do not find it difficult to discover new things to buy (from both small and large businesses).

    For myself, I suspect most of that is supported through online communities related to my interests and hobbies. Those purchases feel more informed and often more intentional too.


  • elrik@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    49
    arrow-down
    2
    ·
    2 months ago

    What if we just got rid of digital advertising altogether in the US? How many issues of privacy, health and personal finance would disappear or be greatly reduced?

    It’s hard for me to imagine what that would look like or the downsides other than to the digital advertising industry itself.


  • With good charging options, 50kwh should be enough for most people.

    Using my Model Y effective range for comparison, this would drop the range in ideal conditions to about 200mi. In cold weather this would probably look more like 150mi or less. With the recommended 80% limit for regular charging, that could be as low as 120mi. That’s also assuming it’s always plugged in at home which isn’t the case for everyone, and harder to do when you have two EVs sharing a home charger.

    The other significant tradeoff is the time it will take to charge on a longer trip. You’ll be charging more frequently, a smaller battery may charge slower, and you’ll need to charge to a higher percentage in order to continue your trip. It may take 20 min to get that first 80% charge at an L3 station but if you need the last 15-20% it could take an additional 25 min. This is also ignoring the increased utilization of busy charging locations, where two vehicles at a single stall will each charge slower.

    I’m a huge advocate for EVs but I would not be comfortable with that range or happy with the experience on longer trips, and these are top concerns for potential buyers.


  • JSON Problem Details

    https://datatracker.ietf.org/doc/html/rfc9457

    • It has a specification, so a consumer of the API can immediately know what to expect.
    • It has a content type, so a client sdk can intelligently handle the response.
    • It supports commonly needed members which are a superset of all of the above JSON examples, including type for code and repeating the http status code in the body if desired.
    • It is extensible if needed.
    • It has been defined since at least 2016.

    This specification’s aim is to define common error formats for applications that need one so that they aren’t required to define their own …

    So why aren’t you using problem details?



  • elrik@lemmy.worldtoFuck AI@lemmy.worldAI phishing is going to end email
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    3 months ago

    simplified and decentralized as it was meant to be

    The protocols behind email are extremely simple. You can open a terminal, connect to an smtp server, and send an email by typing literally plain English commands.

    Its simplicity and decentralization is exactly why spam and phishing is such a problem. Anyone can send an email as anyone else. Protocols for authentication were later introduced to at least mitigate impersonation, but those too are very simple and decentralized.

    Maybe you should learn how email works today before trying to reinvent it.