You wrote “As things stand, in the mobile world, we hardly have any access, from the server to the capabilities of the device”.

In a few weeks I hope you will be able to change your opinion. Right now we’re able to send any device capability to the server. On Windows Mobile you can access ANY device side data from inside the browser using JavaScript – On Blackberry we simply send you the data via the outgoing HTTP request headers.

Totally agree with you on BONDI. It’s years away from being able to do anything. You could try Google Gears, (doesn’t work on BB) but they still can’t do what you need.

The problem is really simple to define – the server needs to know more about the device and terminal capabilities of the mobile device “in real time”. Apart from writing a full blown mobile app to send that data via a socket the ONLY other way to do it is via the browser.

I’ll be interested to see what you think of 5o9Me when we release it. I think you’re going to be surprised at what you can see.

Only dependency is that it works on either BB or WM and requires that you use the default browser (which is also free)

Cheers,

Peter

On to your questions, I can only agree partly with you.

UAProf was born to describe the “User-Agent” so that should be only about the browser. We all know that up until 1-2 years ago the browser was actually PART of the device so even though probably not perfect it made sense to ALSO describe the device.

I agree with you that it is appropriate for the User-Agent string to describe the User-Agent only (i.e. the browser), in a perfect world.
As things stand, in the mobile world, we hardly have any access, from the server to the capabilities of the device. In the PC/Windows/Linux/Mac world we have access to those details via Javascript and we know that computers will be able to handle plugins and “strange” contents very well. In the mobile world it’s not like that and even the iPhone that is usually considered the best you can get is actually very poor to deal with contents that are not video and MP3. We need an alternative and today it does not exist. BONDI could be an alternative, but it is still far from coming, I mean we are talking about 1-2 years from now (and that will only happen for high end devices initially, so mainstream is a few years)!

I think this is a complex topic and needs careful thinking, but let’s just say that today, I would rather keep everything that was there and add something instead of replacing. So if I was developing a new device with a powerful browser that supports BONDI and lets the server interact with the GPS and contacts, etc, I would still provide the UAProf AND provide access to the new stuff. You can’t just drop stuff in one device and expect that it works and that everyone implements and supports new features.

I know how much you like headers so I thought I would post a link to some really cool headers. You will know exactly what they are when you see them. You will also know exactly what it means you can now do if you can see them.

Enjoy. Here’s the link: http://petercranstone.blogspot.com/2009/04/whats-in-your-http-headers.html

Cheers,

Peter

I’m with you on the Meh though. The kind of developers that are aware of these obscure new headers are the kind of people who develop sites which are not vulnerable to CSRF attacks in the first place.

Great post. Like you we believe in the power of headers. So we're going to do something about it. In June we're releasing a product for Windows Mobile & Blackberry into the public domain. It will allow you to add ANY header you want to the outgoing request header. In addition it will come with it's own set of standard headers. If you have a GPS on board your mobile device you can chose an option that will automatically include that data as you navigate to a web site.

You shouldn't have to link to any external site when it comes to DEVCAP and TERMCAP – the device should tell you in real time what it's capable of doing. And if it doesn't then there should be a way of adding your own data to the outgoing request headers.

We've solved that problem.

Local GPS enabled search anyone?

Cheers,

Peter

http://people.mozilla.org/~bsterne/content-security-policy/origin-header-proposal.htmlhttp://www.ietf.org/internet-drafts/draft-abarth-origin-00.txt