Consider removing "Mozilla/5.0" from the User-Agent string?

[jobbautista9]

Or at least as an option besides "Native" in the User Agent Mode setting in Preferences, like an "Experimental Native" or "Cleaner Native"...

I've been thinking about this because I found out that the reason why Danbooru always throws a Cloudflare CAPTCHA at me when I force the browser to only use HTTP/1.1 is that they don't like HTTP1 clients using Mozilla/5.0 in their user-agent string. This made me wonder how useful this legacy slice still is, especially when bad scrapers and crawlers pretend to be browsers by including the Mozilla string... It seems websites trying to target Firefox and Chrome via user-agent string only care about the number besides the Firefox/ and Chrome/ anyway.

Something like PaleMoon/33.9.1 would be cleanest, but I'm fine with something like PaleMoon/33.9.1 Goanna/20251016 (rv: 6.8) or PaleMoon/33.9.1 Goanna/20251016 (Windows NT 10.0; Win64; x64; rv:6.8)

[vannilla]

Because I've seen it used in practice, in actual code I've read included in relatively popular projects, I can say the Mozilla/5.0 part is either directly checked or is used to extract the important part by order, for example the user agent checker might use a regex to match Mozilla/5.0 (group1) (group 2) (group 3) and then the rest of the code will do id1 = regex group 1; id2 = regex group 3; and use it.
This is not only used by sites to detect features but also by loggers and analytics to show pretty graphs.

Removing that part will likely make the browser trip on a number of pointless pitfalls.

[Moonchild]

The Mozilla/* token, while pretty much just historical, does generally indicate the application is a browser or browser-class user agent. That is the reason e.g. Chrome has carried it from the start, while not actually being a Mozilla product.

If removed, you will likely be treated like a crawler or bot, with all of the drawbacks that come with being classified as such. It's just not wise and would be a pretty pointless footgun to incorporate.

[frostknight]

Why is it even called 5.0 still? ITS WAY... past that now.

Its at least 140+ even on ESR. lol

[moonbat]

Why is it even called 5.0 still? ITS WAY... past that now.

Its at least 140+ even on ESR. lol

That was the last sensible version before they jumped on the Chrome bandwagon of meaningless major version updates.

[RealityRipple]

All covered in the wiki article on User-Agent headers.

[frostknight]

That was the last sensible version before they jumped on the Chrome bandwagon of meaningless major version updates.

Very strange...

[moonbat]

It's just a side effect of their deciding to completely ape Chrome to the detriment of everything that made Firefox unique instead of fixing the problems that it had then (memory leaks and slowness, again due to misbehaving extensions which again goes to the absolute moth eaten state of their documentation). The existence of Pale Moon rebuts the idea that you have to have multi-process for 'security' (and it does squat other than increasing the attack surface, as Moonchild has highlighted before); and is probably why it gets so much hate from Mozilla fanboys.

[laki2]

Why is it even called 5.0 still? ITS WAY... past that now.

Its at least 140+ even on ESR. lol

That was the last sensible version before they jumped on the Chrome bandwagon of meaningless major version updates.

Firefox version 210339 coming soon???

[UCyborg]

What happened to the idea of deprecating user agent header altogether?

[Moonchild]

What happened to the idea of deprecating user agent header altogether?

Google wanted to replace it with "Client Hints", however it became painfully apparent what Google was trying to do, which is introducing a Web API that would directly and pretty much transparently give them the tools to track everyone by exfiltration of user agent data to third parties via JS.

From the Client Hints Wikipedia page (with my emphasis):

Since the adoption of Client Hints by major browsers like Google Chrome and Microsoft Edge, privacy researchers have raised concerns over their real-world use for tracking.[15] A 2023 study by researchers from KU Leuven and Radboud University found that out of the top 100,000 websites, 60% of JavaScript files loaded by web pages accessed the Client Hints JavaScript APIs, with most being tracking and advertising scripts, many of which came from Google. Over 90% of these script files exfiltrated the obtained data to tracking domains.[16] A subsequent study in May 2024 by researchers from the Hochschule Bonn-Rhein-Sieg University of Applied Sciences noted that while overall adoption of Client Hints amongst websites on the internet was low, a significant number of third-party domains known for tracking accessed HTTP Client Hints data.[17]

No user-respecting browser should expose this API as it's clearly only being adopted by trackers and ad companies with the biggest culprit being the company that proposed the API to begin with.