agent - Dave's Blog


Changing the User Agent string in UWP WebView

2018 Oct 23, 9:32

There's no perfect way to change the user agent string for the UWP WebView (x-ms-webview in HTML, Windows.UI.Xaml.Controls.WebView in XAML, and Windows.Web.UI.Interop.WebViewControl in Win32) but there are two imperfect methods folks end up using.

The first is to call UrlMkSetSessionOption. This is an old public API that allows you to configure various arcane options including one that is the default user agent string for requests running through urlmon. This API is allowed by the Microsoft Store for UWP apps. The change it applies is process wide which has two potential drawbacks. If you want to be able to have different UA strings set for different requests from a WebView that's not really possible with this solution. The other drawback is if you're using out of process WebView, you need to ensure you're calling into UrlMkSetSessionOption in the WebView's process. You'll need to write third party WinRT that calls UrlMkSetSessionOption, create the out of proc WebView, navigate it to some trusted local page, use AddWebAllowedObject or provide that URI WinRT access, and call into your third party WinRT. You'll need to do that for any new WebView process you create.

The second less generally applicable solution is to use NavigateWithHttpRequestMessage and set the User-Agent HTTP header. In this case you get to control the scope of the user agent string changes but has the limitations that not all sub resource downloads will use this user agent string and for navigations you don't initiate you have to manually intercept and re-request being careful to transfer over all POST body state and HTTP headers correctly. That last part is not actually possible for iframes.

PermalinkCommentsuser-agent uwp webview

Tweet from David_Risney

2015 Oct 23, 1:52
"Children of Magenta" '97 talk for pilots on how to better use (and not use) flight automation …

The Interview ending interpretation

2014 Dec 25, 2:29

As the title suggests, spoilers for The Interview follow.

Towards the end of the movie, after Dave Skylark is shot, he miraculously has a bullet proof vest, blows up Kim Jong-un, finds a random tunnel and is picked up by Seal Team Six. These are the same details of the unbelievable scenario that Dave Skylark describes to Agent Lacey at the beginning of the movie.

This isn't a coincidence. Everything after Dave is shot is his fantasizing about how things should have gone as he dies in the interview chair. Unsurprisingly his fantasy closely matches his original ridiculous thoughts about how he would assassinate and escape.

This is similar to movies like Brazil in which the later fourth of the movie is the main character’s romantic fantasy as he is tortured and killed in real life. Or Total Recall where the end of the movie matches the description of the memories that the main character will have implanted at the beginning.

Its safe to assume that after Dave is killed, Aaron and Sook are captured and also killed.


Subtleties of postMessage

2013 Jul 15, 1:00

In IE10 and other new browsers one may create MessageChannel objects that have two MessagePorts each connected (w3c spec calls it entangled) to one another such that postMessage on one port results in the message event firing on the other. You can pass an array of ports as the last parameter to postMessage and they show up in the ports property of the message event arg.


The postMessage here is like the worker postMessage and unlike the window and iframe postMessage in that it applies no origin checking:

  1. No origin postMessage in workers and MessagePorts: postMessage(messageData, ports)
  2. Origin postMessage in windows and iframes: postMessage(messageData, targetOrigin, ports)

Unfortunately the origin isn't an optional parameter at the end to make the two postMessages have the same signature.

On the event handler side, the event arg always has an origin property. But in the no origin case it is always the empty string.


There is also a source property on the message event arg which if set is an object that has a postMessage property allowing you to post back to your caller. It is set for the origin case, however, in the no origin case this property is null. This is somewhat reasonable because in the case of MessagePort and Workers there are only two endpoints so you always know the source of a message implicitly. Unlike the origin case in which any iframe or window can be calling postMessage on any other iframe or window and the caller is unknown. So not unreasonable but it would be nice if the source property was always set for consistency.

MessageChannel start

When a MessageChannel is created it has two MessagePorts, but until those ports are started they will queue up any messages they receive. Once started they will dispatch all queued messages. Ports don't have to be started to send messages.

A port may be started in two ways, either by explicitly calling the start method on the port, or by setting the onmessage callback property on the port. However, adding an event listener via addEventListener("message", does not start the port. It works this way in IE and Chrome and the spec states this as well.

The justification is that since you can have only one callback via onmessage that once set you must implicitly be ready to receive messages and its fine to start the port. As opposed to the addEventListener in which case the user agent cannot start implicitly because it doesn't know how many event listeners will be added.  I found Hixie stating this justification in geoloc meeting notes.


W3C Spec

Opera introduction

PermalinkCommentsDOM html javascript postMessage technical web-worker worker

Clippy.JS - Add Clippy and friends to any website (

2012 May 29, 6:15

A great JS API to add Clippy or other agents to your website!  Make them talk, dance, gesture, etc

PermalinkCommentshumor microsoft js javascript web

"Unified User-Agent String (UUAS)" - Mateusz Karcz

2012 Jan 27, 7:29

IETF draft on the contents of the User Agent HTTP header.

PermalinkCommentstechnical ietf http user-agent http-header

Indicating Character Encoding and Language for HTTP Header Field Parameters

2011 Nov 24, 7:45

From the document: ‘Appendix B. Implementation Report: The encoding defined in this document currently is used for two different HTTP header fields: “Content-Disposition”, defined in [RFC6266], and “Link”, defined in [RFC5988]. As the encoding is a profile/clarification of the one defined in [RFC2231] in 1997, many user agents already supported it for use in “Content-Disposition” when [RFC5987] got published.

Since the publication of [RFC5987], two more popular desktop user agents have added support for this encoding; see
   NET/http/content-disposition-tests#encoding-2231-char for details. At this time, only one major desktop user agent (Safari) does not support it.

Note that the implementation in Internet Explorer 9 does not support the ISO-8859-1 encoding; this document revision acknowledges that UTF-8 is sufficient for expressing all code points, and removes the requirement to support ISO-8859-1.’

Yay for UTF-8!

PermalinkCommentstechnical http http-headers ie9 internationalization utf-8 encoding

URI Empty Path Segments Matter

2011 Nov 23, 11:00

Shortly after joining the Internet Explorer team I got a bug from a PM on a popular Microsoft web server product that I'll leave unnamed (from now on UWS). The bug said that IE was handling empty path segments incorrectly by not removing them before resolving dotted path segments. For example UWS would do the following:

In step 1 they are given a URI with dotted path segment and an empty path segment. In step 2 they remove the empty path segment, and in step 3 they resolve the dotted path segment. Whereas, given the same initial URI, IE would do the following:
IE simply resolves the dotted path segment against the empty path segment and removes them both. So, how did I resolve this bug? As "By Design" of course!

The URI RFC allows path segments of zero length and does not assign them any special meaning. So generic user agents that intend to work on the web must not treat an empty path segment any different from a path segment with some text in it. In the case above IE is doing the correct thing.

That's the case for generic user agents, however servers may decide that a URI with an empty path segment returns the same resource as a the same URI without that empty path segment. Essentially they can decide to ignore empty path segments. Both IIS and Apache work this way and thus return the same resource for the following URIs:
The issue for UWS is that it removes empty path segments before resolving dotted path segments. It must follow normal URI procedure before applying its own additional rules for empty path segments. Not doing that means they end up violating URI equivalency rules: URIs (A.1) and (B.2) are equivalent but UWS will not return the same resource for them.
PermalinkCommentsuser agent url ie uri technical web browser

draft-ietf-websec-origin-01 - The Web Origin Concept

2011 Jun 21, 1:22"This document defines the concept of an "origin", which is often used
as the scope of authority or privilege by user agents. Typically,
user agents isolate content retrieved from different origins to
prevent malicious web site operators from interfering with the
operation of benign web sites. In addition to outlining the
principles that underly the origin concept, this document defines how
to determine the origin of a URI, how to serialize an origin into a
string, and an HTTP header, named "Origin", that indicates which
origins are associated with an HTTP request."PermalinkCommentsietf reference technical web browser user-agent webbrowser origin

[whatwg] Proposal for IsSearchProviderInstalled / AddSearchProvider

2011 Feb 23, 2:17Proposal to standardize on the function to add search providers in user agents.PermalinkCommentstechnical search-provider browser webbrowser web whatwg

Peer-to-peer tech now powers Wikipedia's videos

2010 Sep 27, 3:15This is awesome and similar to something I got a cube for. Wikipedia runs its videos through a service that sets up torrents for arbitrary URLs. So awesome! Now if only this were built into the user agent rather than requiring hardcoding the sites to use it...PermalinkCommentstechnical p2p wikipedia network networking torrent web

RFC 5849 - The OAuth 1.0 Protocol

2010 Apr 21, 6:49"OAuth provides a method for clients to access server resources on behalf of a resource owner (such as a different client or an end-user). It also provides a process for end-users to authorize third-party access to their server resources without sharing their credentials (typically, a username and password pair), using user-agent redirections."PermalinkCommentsoauth authorization security privacy internet web rfc standard technical

Content-Type Processing Model

2009 Jun 22, 3:12HTML5's mime-sniffing is getting moved to an IETF doc: "Many web servers supply incorrect Content-Type headers with their HTTP responses. In order to be compatible with these servers, user agents must consider the content of HTTP responses as well as the Content-Type header when determining the effective media type of the response. This document describes an algorithm for determining the effective media type of HTTP responses that balances security and compatibility considerations."PermalinkCommentsmime mime-sniffing ietf http w3c html5 technical

Ceci n'est pas un Bob: The Zone of Essential Risk

2009 Jun 10, 12:17"Bruce pointed out in his return email that while the fraud pattern was a good match for escrow, the transaction size wasn't: since the item exchanged in the eBay transaction he highlighted was sold for only $500, the price of an escrow agent would have been hard to justify. He's right."PermalinkCommentsblog security economics article bruce-schneier Bob-Blakley ebay

High Five Escalator at Improv Everywhere

2009 Jun 4, 11:08"For our latest mission, Agent Lathan gave out 2,000 high fives by standing next to a subway escalator during the morning rush. Five additional agents spread out along the adjacent stairs, holding signs that prepared commuters for the upcoming high five fun."PermalinkCommentshumor improv-everywhere high-five escalator video youtube nyc subway

Netflix Watch Instantly Recommendations

2009 May 3, 9:17
WeedsAvatar The Last AirbenderPaprikaGrindhouse Planet TerrorOutsourcedThe King of KongPrimer

Netflix lets you watch a subset of their movies online via their website and a subset of those movies are available to watch on the Xbox 360's Netflix app. so its not always easy to find movies to watch on Xbox 360. Yet, I regularly see my Xbox friends using the Netflix app and its a shame they didn't make an easy way to share movie recommendations with your friends. Instead we must share movie recommendations the old fashioned way. Here's the movies I've found and enjoyed on my 360.

You don't have to be a stoner to enjoy this humorous and dramatic satire featuring a widow trying to raise her children and deal pot in suburbia.
Avatar The Last Airbender
An American animated series that's an amalgamation of various Asian art, history, religion, etc. that maintains a great story line.
If you enjoyed Paranoia Agent you'll enjoy this movie in the same animation style and by the same director and writer, Satoshi Kon. Its like a feature length version of a Paranoia Agent episode in which a dream machine lets outsiders view one's dreams but eventually leads to blurring the dreams and reality.
Grindhouse Planet Terror
I didn't see either of the Grindhouse movies when they first came out, but of the two, Planet Terror is the more humorous and exciting gore filled parody.
A refreshing romantic comedy that still has a few of the over played tropes but is easy to enjoy despite that.
The King of Kong
A hilarious documentary on the struggle between the reigning champ hot-sauce salesman and the underdog Washington state high school science teacher to obtain the Donkey Kong world record high score. After watching, checkout this interview with the creators of the movie and the villain.
I've mentioned Primer before, but I put it on here again because its really good and you still haven't seen it, have you?
PermalinkCommentsmovie personal netflix

Best Funeral Ever at Improv Everywhere

2009 Apr 1, 9:48"For our latest mission, 30 Improv Everywhere agents found a random funeral in the obituary section of the newspaper and turned it into the best funeral ever... The family, especially the older couple in the middle, were seriously mourning. They seemed to be focusing on the priest and mostly ignoring us. Still, we had to be as serious as we possibly could. If anyone cracked a smile or giggled we would completely ruin the funeral for the family."PermalinkCommentshumor parody video improv-everywhere

Web addresses in HTML 5

2009 Mar 23, 11:06The HTML5 spec tells us how it is in the real world for URLs: "This specification defines various algorithms for dealing with Web addresses intended for use by HTML user agents. For historical reaons, in order to be compatible with existing Web content HTML user agents need to implement a number of processes not defined by the URI and IRI specifications [RFC3986], [RFC3987]."PermalinkCommentshtml html5 url uri reference w3c

Sam Kass's Blog

2008 Nov 17, 8:21"The organization is now five years old, and our membership is larger than ever. It is estimated that one out of every four people on Earth is now a devoted member. The secret language has been perfected-- it allows us to talk freely, and sounds just like normal small talk. Also, we have an order of special agents who are particularly dangerous, and are all disguised as normal people. Our goal is the annihilation of all paranoid people."PermalinkCommentshumor club paranoia sam-kass


2008 Oct 1, 1:08A weekly summary of the going-ons in the WHATWG usually on the topic of squabbles in HTML5 esp. what to do about the alt attribute in the img tag. Interesting stuff on charsets.PermalinkCommentsdevelopment software whatwg html5 html specification feed rss user-agent w3c
Older Entries Creative Commons License Some rights reserved.