[Bug 22835] New: window.navigator.language should not return "en" for privacy protection

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
12 messages Options
Reply | Threaded
Open this post in threaded view
|

[Bug 22835] New: window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

            Bug ID: 22835
           Summary: window.navigator.language should not return "en" for
                    privacy protection
    Classification: Unclassified
           Product: HTML WG
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P3
         Component: HTML5 spec
          Assignee: [hidden email]
          Reporter: [hidden email]
        QA Contact: [hidden email]
                CC: [hidden email], [hidden email],
                    [hidden email],
                    [hidden email]

Section 6.5.1.2 Language preferences has the recommendation "user agent
implementors are encouraged to return 'en' unless the user has explicitly
indicated that the site in question is allowed access to the information."

"en" is the wrong value to recommend here. "en" is a valid language tag, but
not the preferred language of the majority of internet users. If user agents
started following the recommendation to return "en" for users whose preferred
language is not English, then applications would have to treat "en" as meaning
"undefined", i.e., stop providing English-speaking users with their preferred
language.

If a user agent wants to protect the user's privacy by not providing the user's
real preferred language, then it should simply return |undefined|.

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Boris Zbarsky <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--- Comment #1 from Boris Zbarsky <[hidden email]> ---
Returning undefined is very likely to break pages that use string methods on
the return value (e.g. navigator.language.charAt(0) or whatnot).  We want a
default value that's a string; perhaps ""?

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

--- Comment #2 from Norbert Lindenberg <[hidden email]> ---
Internet Explorer up to at least version 10 doesn't have navigator.language, so
at this point applications have to deal with it being undefined.

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

--- Comment #3 from Boris Zbarsky <[hidden email]> ---
Except to the extent that they do sniffing and take different codepaths in
different browsers, of course...

We've been bitten far too many times by making something undefined that was
already undefined in some one browser and pages suddenly breaking.

But more importantly, think about the situation a few years from now when all
UAs return strings except the ones that are implementing the encouragement from
the spec (which I expect to be minority UAs).  At that point, those UAs would
almost certainly have to return "" (violating this spec) due to compat
concerns, assuming the property gets used at all.

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Steven R. Loomis <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--- Comment #4 from Steven R. Loomis <[hidden email]> ---
(In reply to comment #0)
> If a user agent wants to protect the user's privacy by not providing the
> user's real preferred language, then it should simply return |undefined|.

How about "und" = Undetermined ?
http://www.loc.gov/standards/iso639-2/php/code_list.php

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Martin Dürst <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--- Comment #5 from Martin Dürst <[hidden email]> ---
"und" would work, and so would "" (which is used in XML and HTML to "switch
off" outer lang/xml:lang settings for inner structure). I'd personally prefer
"".

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

--- Comment #6 from Norbert Lindenberg <[hidden email]> ---
If the concern is that applications use the value of navigator.language without
any checking, then "und" is better than "". "" is not a valid BCP 47 language
tag and will result in exceptions when passed to methods in the ECMAScript
Internationalization API.

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Mounir Lamouri <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--- Comment #7 from Mounir Lamouri <[hidden email]> ---
Why do we need to make navigator.language return a fake value while we already
provide more information in the HTTP headers?

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Henri Sivonen <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--- Comment #8 from Henri Sivonen <[hidden email]> ---
(In reply to comment #0)
> If a user agent wants to protect the user's privacy by not providing the
> user's real preferred language, then it should simply return |undefined|.

This makes the user more special (i.e. trackable) than if the user was hiding
in the "en" crowd.

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Robin Berjon <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--- Comment #9 from Robin Berjon <[hidden email]> ---
Is it common for browsers to return "en" currently? I don't believe I ever
configured any of mine for this, but they all return either en-US or en-GB.

Is there really an "en" crowd to hide in?

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Michael[tm] Smith <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

--
You are receiving this mail because:
You are on the CC list for the bug.

Reply | Threaded
Open this post in threaded view
|

[Bug 22835] window.navigator.language should not return "en" for privacy protection

Bugzilla from bugzilla@jessica.w3.org
In reply to this post by Bugzilla from bugzilla@jessica.w3.org
https://www.w3.org/Bugs/Public/show_bug.cgi?id=22835

Travis Leithead [MSFT] <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |[hidden email]
         Resolution|---                         |WORKSFORME

--- Comment #10 from Travis Leithead [MSFT] <[hidden email]> ---
HTML5.1 Bugzilla Bug Triage: Works for me. Spec currently gives this advice:

> If the user is using an anonymizing service, then the value "en-US" is suggested; if all users of the service use that same value, that reduces the possibility of distinguishing the users from each other.

Are folks still interested in returning the empty string?

If this resolution is not satisfactory, please copy the relevant bug
details/proposal into a new issue at the W3C HTML5 Issue tracker:
https://github.com/w3c/html/issues/new where it will be re-triaged. Thanks!

--
You are receiving this mail because:
You are on the CC list for the bug.