Comment on Trend of websites blocking old versions of Chrome -- is this sensible?
frongt@lemmy.zip 1 day agoIf your point is transparency, and the given justification is to block scrapers, then it makes sense they wouldn’t be transparent about it. You don’t want to give your adversary instructions about how to bypass your security.
daveyOsborn@infosec.pub 1 day ago
That could be a plausible reason for opacity if it were true, but I don’t think it’s true because blocking Tor (for example) is trivially discovered and the non-transparency only frustrates legit users. The opacity of an anti-tor policy has no effect on adversaries. Yet a vast majority of tor-hostile sites are sloppy about informing legit users.
Infosec that relies on secrecy is already out on a limb in despiration. And in this situation, the collateral damage to friendlies based on arbitrary factors creates a heightened need to inform the legit users. An AI scraper bot is not going to be coded to know where to look for such announcements because that’s actually more effort for the attacker than manual trial and error. Note as well we are talking about relatively unsophisticated adversaries considering they were too lazy to code the user-agent header to dynamically blend better in the first place. (They will fix that in the future).
Nonetheless, your point cannot be disregarded because those who take the crude approach of blocking on the basis of UA string are likely not thinking all this through.