Paul Jakma's Blog

As part of my progression to grumpy old githood, I present what may well be the first in an irregular series of letters of complaints to large, hard-of-hearing organisations. It might not change anything, but it makes me feel better.

Dear RBS,

This is at least the 3rd time in a number of years where I have had to email you to tell you that your policy of white-listing browsers by their user-agents strings is somewhat less than conducive to both my financial interests AND my security. To remind ourselves of when I first encountered this problem. I also emailed you earlier this year on the 10th march, and I think I have suffered this issue on other, unreported occasions.

Some general issues with your policy:

• You think you know your users’ security needs better than they do.
• To this end, you white-list browsers, and deny access to any browsers you don’t know about.
• For some small subset of your user-base, you are in fact completely and utterly wrong on point 1.
• Across  all of your user-base, you probably do generally know much more about security than your users, However, for some small subset even of such users, your superior general knowledge does not apply to the situation that user is in, and increases security risks.

For some less than terribly brilliant reason you choose to make your white-list restricted to specific major version numbers. While there may be sense in requiring a certain minimum level of browser, if older ones are known to be insecure (e.g. Internet Explorer), this is a somewhat ill-conceived policy when it comes to disallowing new versions of browsers that are already deemed acceptable. It is not likely that a browser upgrade will carry significant security risks, indeed it is far more likely that browser upgrades address security issues

Your policy has the following practical effects:

1. If a browser upgrade fixes security issues, and it bumps the major version (e.g. imagine a design flaw whose fix breaks backward compatibility) then users will be unable to avail of that new version until you get around to approving and white-listing it – potentially with the user being left exposed to some major security issue
2. Users are routinely subjected to inconvenience when browsers routinely upgrade their major versions (e.g. Google Chrome/Chromium), thanks to your less than useful security policy.
3. Users, when away from their regular computer, e.g. when traveling, may find that they can not use trusted personal, mobile computer devices (e.g. smartphones) because of your security policy, just because you happen not to have been able to keep abreast of the large numbers of such devices on the market, thus requiring perhaps to have to turn to highly untrustworthy shared PCs at their nearest internet cafe. Not ideal.

I have, yet again, had to suffer from problem 2 above. Worse, I’ve now been locked out for about a week or so – ever since Chromium builds for Fedora upgraded from major version 5 to 6.

Could you please, please rethink your less-than-lustrous policy.

Yours in ever growing frustration,

Paul Jakma.