[y4mi]

Some people don't spy on their customers and don't have these kinds of information available for analyses

They're admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays

[beefsack]

I completely understand where you're coming from, but the User-Agent string is included in regular HTTP requests and you don't need to resort to overbearing client-side analytics to aggregate it; it's right there in the access logs on the server.

[HalfwayToDice]

Calling aggregate anonymous analytics "spying on your customers" is absurd nonsense.

[astrodust]

It's "spying" when you're gathering data they didn't consent to give, like mining through their contacts, scanning running processes or uploading unrelated content from their computer. The browser User-Agent string is hardly classified information.

[Pherdnut]

Yeah, this is more like the used car dealership noticing that a lot of their clientele drives Toyotas. SPIES!

[TeMPOraL]

Analytics on the web are neither aggregate nor anonymous.

[jasonkostempski]

Declaring "absurd nonsense" isn't an argument.

[obstacle1]

In this case, the absurdity and nonsensical character of the 'spying' claim is fairly self-evident.

When a client voluntarily makes a request to a server, it presents a bunch of information for the server to see and consume. This information is not meant to be kept secret from the server. Among such pieces of information can be some about the characteristics of the user agent, including OS. It is disingenuous at best to call collecting such voluntarily-presented and clearly-transmitted data as "spying" on a user.

A basic requirement for spying is for a collecting party to be obtaining information that can be reasonably considered confidential or restricted. Details about the system from which you send a request are by definition of the protocol not confidential or restricted to the recipient of your request. It is not reasonable to expect a server to not look at or use information you present to it. Therefore, it isn't "spying" for the recipient to consume the information. The information might be used in ways some people(e.g., OP) don't like, but that does not make obtaining the information "spying".

[jasonkostempski]

I only posted this because it was the second time that day I saw "absurd nonsense" used as a comment with no additional content. It annoyed me enough the first time that it stuck out like a sore thumb the second time, then I noticed it was the same user and it was their last 2 comments.

[cortesoft]

You don't need an argument against absurd nonsense.

[thaumasiotes]

Better men than you have been beaten by absurd nonsense that shouldn't have needed to be argued against. ;)

[SimbaOnSteroids]

I recall a woman who recently had this experience as well.

[revelation]

Just like those anonymous taxi fare statistics, no one ever extracted meaning from those..

[dismantlethesun]

The whole point is to extract meaning from analysis but not spy on personal information. Knowing which clients support what kind of SSL isn't personal, it is part of the request transaction.

[johncolanduoni]

Mere server-side logging can pick out something like this via User-Agent. Is it spying to count the number of times a request with "Windows NT 5.1" is sent to your server?

[jlgaddis]

Mere server-side logging can include the negotiated encryption parameters (but doesn't by default, IIRC).

[johncolanduoni]

Yes, of the connection the server is party to. It's bad security to record them, but how is it spying?

[jjawssd]

Are you implying that analyzing server logs to gather aggregate user agent statistics is "spying on [your] customers?"

Because that is untrue.

[matt4077]

Aside from my personal opinion (which largely agrees with you), there are jurisdictions where a specific IP address is considered enough to make it (and the rest of the data) personal information, requiring a justification, information (or even consent), and other processes to protect privacy.

That's why Google Analytics has an option to remove the last three digits of an IP.

[mikegerwitz]

The important part is whether the data are anonymous.

You might be interested in the EFF's Best Practices for Online Service Providers:

https://www.eff.org/wp/osp

[lostboys67]

Well you can use qualsys labs tool to check your ssl and all the main search engines have said they will start flagging sites that use unsafe HTTPS or show the warning page before letting you proceed

[jameskegel]

Out of all the grey comments, this one does not deserve to be greyed out.