164280 - marksandspencer.com - denies access to Mozilla

Status: VERIFIED FIXED

(Tech Evangelism Graveyard :: English Other, defect, P2)

Description

[Ian Neal]

Going to the above URL using BuildID 2002082008 on WinXP comes up with a pop box
saying:

Javascript Application
http://uk.siteat.com/marksandspencer/marksandspencer/s?disallowed

clicking ok then produces a page saying:

To provide you with the most fulfilling and up to date online experience, this
web site has been optimised for use with the most popular browsers - Internet
Explorer (version 5 and above), Netscape 6.1 and AOL browser version 5.0 and above.

Comment 1

[Mathieu Pillard [:mat]]

Ian, could you test with mozilla identified as something else, see if that works
? if it does, then its only a sniffing issue and need to be marked as
[sniffing][havefix] ...

Comment 2

[Egon Face]

Not sure what [sniffing][havefix] mean but it certainly is a case of redirecting
to forbidden if the browser type is not IE NS or AOL since the same behaviour is
seen in Opera 6 on XP until you identify as IE5 then everything works fine. I
wonder how their security 'experts' will resolve this workaround since
http://www.marksandspencer.com/disallowed.html warns:

To protect you from certain usability and/or security issues we currently do not
support Opera, Mozilla, earlier versions of Netscape or IE. 

Comment 3

[Mathieu Pillard [:mat]]

[sniffing][havefix] just mean that we have a fix for this problem, and in this
particular case, that it is sniffing related :)


the fact is, they claim to support netscape 6.1, so it should work in any gecko
browser imho. we need to check this (spoof the user agent using the user agent
toolbar or the uabar - see http://mozilla-evangelism.bclary.com/sidebars/ - ,
and report here).

Comment 4

[Egon Face]

I tried setting different user agents in the UAbar but it does not seem to
change anything - perhaps just as well since leaving it without default state
allegedly crashes the start up. Perhaps there is more to be changed in prefs.js
in addition to adding user_pref("signed.applets.codebase_principal_support",
true); since http://mozilla-evangelism.bclary.com/sidebars/ mentions enabling
agent override in preferences, it's not clear if that single line added will
allow this.

Comment 5

[Ian Neal]

Tested with UA string set to Netscape 6.1 and everthing appears to work, so
adding necessary keywords. As Egan Face mentions though they may be delibrately
excluding mozilla as per line on disallowed page that is displayed.

Comment 6

[Pete Harlow]

FWIW, build 1.1 under Linux is also rejected. According to my wife, this is
recent behaviour - she said last time she looked (using NS 4.7 Linux) - it was OK.

Comment 7

[Alex Hosking]

I might be about o get a job there if I do i will assign it to me.

Comment 8

[Egon Face]

----- Original Message -----
From: <[e-mail]>
To: <[e-mail]>
Sent: Monday, September 02, 2002 1:49 PM
Subject: Marks & Spencer


Dear Tom

Thank you for contacting us.

I'm sorry that you are unable to access www.marksandspencer.com at the
moment as we do not support the browser you are using. To protect from
usability and security issues we currently do not support Opera, Mozilla,
certain versions of Netscape or versions of Internet Explorer earlier than
IE 5.

We are currently working to provide an enjoyable browser experience on a
wider range of client side applications, however, we currently recommend
co-installing a later version of the IE browser family. Please accept our
apologies for any inconvenience this may cause you but rest assured we have
every intention of enabling access for all major browsers in the near
future.

Kind regards

Kari Andersen
Website Manager - Customer Service & Operations
E-Commerce Team

Comment 9

[Egon Face]

Hi Kari

Thanks for the answer. Unfortunately I cannot use internet explorer as it
does not run on UNIX. I have found that your site works perfectly using
opera and mozilla, but only after I change the user agent identity to
pretend that I am using your approved browsers.

While I have heard many instances of security problems using the browsers
you support, I have not heard of any that I can remember that affect the
browsers that you prohibit which makes me wonder why you mention security as
the reason for limiting your audience to certain clients.

best wishes
Tom

Comment 10

[Egon Face]

Dear Tom,

Sorry for the delay in getting back to you, I have been out of the office on
holiday.  

I can certainly appreciate the inconvenience that our current browser
support policy may cause users of Linux and Unix.  However, as I mentioned
in my last mail, our technical teams are working on rectifying the situation
and hope to implement a "fix" shortly. As you are aware, we did not take the
decision to exclude certain browser groups lightly, however we felt that the
quality of the online experience afforded was not in keeping with the
desired customer service levels.  Sadly, in the same way that we close a
high street store to the public whilst refurbishment's are under way, we
must also act to protect the online shopping experience.

May I assure you, once again that we have every intention of supporting as
many browsers as is commercially viable, and we hope that your patience in
this matter is rewarded shortly.

Best regards

Kari Andersen
Website Manager - Customer Service & Operations 
E-Commerce Team 

Comment 11

[Egon Face]

Dear Kari

No problem for the delayed answer! I am impressed that you not only answer at
all but that you are doing your best to find out how to resolve this issue.

Perhaps I could point out what I see as some possible misconceptions from your
side. Firstly this issue does not just affect Linux/UNIX users, but anyone on
any platform that is not "Wintel" or anyone who uses "Wintel" but who chooses
not to use IE or NS to view your site. While I agree this may be a minority at
the moment, I cannot see why you are blocking access to this group. To use your
shop analogy, I am sure that you would not purposely remove access for the
disabled even if they do not represent the majority of your customers. 

Secondly I can't see why you need to fix anything. When I set the user agent in
my browser to spoof your server into believing I am using approved software,
your site renders perfectly well, so I cannot see why you fear opening your site
to everyone would have any impact on your desired customer service levels. In
fact all you need to do is to ensure that your site complies with the standards
provided by the W3C and this will automatically ensure that all browsers on all
platforms can see you site, even if they have physical disabilities.

Finally I admit I can use Internet Explorer, but for reasons of security and
because I want to use what I perceive to be the best featured browser I choose
not to.

I look forward to viewing your site without having to change my user agent identity.

best wishes
Tom

Comment 12

[Egon Face]

This bug has now been reported in the news! See the end of this article:
http://www.theregister.co.uk/content/23/27756.html

Comment 13

[Simon Montagu :smontagu]

The oddest part of this, IMO, is that they *do* support Netscape 7.0.

Comment 14

[Tristan Nitot]

sending this letter. Accepting bug.

----
Dear Kari,

AOL is now using the Netscape Gecko embedded browser in various versions of its
AOL client software. (Beta version for Windows and a released version for Mac
OSX). To prepare the roll-out of this new technology, my team is testing top
sites in various standards-compliant web browsers. We found the following issues
on your site when using these browsers. http://www.marksandspencer.com/ denies
access to the AOL client for MacOSX and Mozilla.

Netscape has a team of engineers that can help you at no cost so that your
visitors, who are also our customers, can experience fully what your service
offers. In fact, we already have a recommended solution we would like to share
with your development team. I can see that you already offer access to Netscape
6.1 and 7 users. The AOL client for Mac OSX and Mozilla I used for testing are
based on exactly the same technology used in Netscape 6/7 (the technology name
is Netscape Gecko). The solution is not to sniff for Netscape 6.1 and 7, but
rather to sniff for the "Gecko" string in the user agent string. Some sniffing
techniques are detailed on our developer web site :
http://devedge.netscape.com/viewsource/2002/browser-detection/#introgecko

you may also be interested in this article :
http://www.mozilla.org/build/revised-user-agent-strings.html

Feedback from the press for these two products is extremely favorable, and new
users are adopting them more and more on all platforms, including Windows,
Macintosh and Linux.

However, this is just part of a larger picture, as:

- the Compuserve brand (an AOL property) now offers a new Netscape Gecko-based
client software to its 3 million users

- AOL, the largest Internet Provider in the world (65 million users and 34
million members, not including the Compuserve brand) is now publicly testing
beta versions of a new AOL client based on Netscape Gecko on Windows and has
relased a final version for the OSX Macintosh platform. The current non-beta
version of the software currently embeds MS Internet Explorer.

- new open-source browsers such as Galeon, Skipstone, Beonex, OEone , K-meleon,
Phoenix and Chimera also use Netscape Gecko.

Please note that if your web site already supports Netscape Communicator /
Navigator 4.x, it does not mean it is compatible with more recent
standards-compliant browsers based on Gecko. In fact, Netscape Gecko is more
similar to Internet Explorer 6.  Sites often can serve content developed for IE
to Netscape Gecko browsers. (See more information on
http://devedge.netscape.com/central/gecko/ )

Please contact me (by e-mail, phone or mail) so we can work together on how we
can prepare your web site to support millions of people that use a
standards-based browser, and offer them with the best experience, and also
provide an appropriate response to this article:
http://www.theregister.co.uk/content/23/27756.html

Hoping to hear from you very soon,

Best regards,



--Tristan Nitot

Comment 15

[Tristan Nitot]

Got a reply from Steve Wind-Mozley, Channel Development Manager, E-commerce Team, 
Marks & Spencer. <[e-mail]> Started discussing
his issues. I liked the subject of his message: "Marks and Spencer do not want
to go lizard hunting" :-)

Comment 16

[Alex Hosking]

I work for these people can I help?

Comment 17

[Steve Manning]

I was about to report a dupe of this  - any sign of progress?

Comment 18

[Egon Face]

I have not had an answer to my letter and I assume that Tristan has heard
nothing as well. If Alex is still working there he may be in a good position to
provide some feedback about the status of this bug.

Comment 19

[Steve Manning]

I had the following reply from M&S today:

-----Forwarded Message-----

From: [e-mail]
To: [e-mail]
Subject: RE: Website Access
Date: 01 Dec 2002 10:58:20 +0000

Dear Mr Manning

I regret that the website, www.marksandspencer.com, does not currently allow
access from Mozilla and Opera browsers.  We continue to work with our
development teams to offer a wider range of browser support and are pleased
to announce that Netscape 6 and 7 have been unblocked and may be used to
access the site.

I do appreciate that it is frustrating to be denied access to a site purely
on the basis of the browser application you have selected and can assure you
that the decision to take such action was made for valid reasons.  As a
retailer, Marks & Spencer has a vested interest in solving these issues and
we will strive to do so to the satisfaction of our users.

I further regret, that for policy reasons, we are unable to elucidate the
nature of the issue.

Kind regards

The Marks & Spencer Online Team
-----------------------------------------------------

Aren't we the lucky ones! They are letting us in to their site if we use NS7
(and promise to be good ;-). So I changed my Galeon useragent to spoof
Netscape/7.0 and sure enough I can access the site. I have written back to them
to point out how ridiculous this is - I will let you know the outcome if any.

Comment 20

[Chris Puttick]

This site is still a problem. I would recommend raising the issue to board level
as the M&S web team (seemingly an outsourced one?) comments are clearly
incorrect and ill-informed and M&S as an organisation do not deserve to be this
badly served. I would be happy to take this on.

Comment 21

[Tristan Nitot]

> I would be happy to take this on.

Please do and keep us posted.

Comment 22

[Chris Puttick]

Have brought the glaring inaccuracy of the "Supports Mozilla (Netscape 6+) but
not Mozilla" to the Press Office (terribly bad PR, don'tcha know) - I now have a
contact there who is investigating and has left messages with the department
head to call me on Monday (030428). If I get no joy, I'll go after Alice Avis
(Marketing and E-commerce Director) and/or Stuart Senior (IT Director). See

http://www2.marksandspencer.com/thecompany/whoweare/ukretailboard/index.shtml#biogs

(which works fine with default user agent, as do the other group websites!)

Comment 23

[Gilles Durys]

*** Bug 206063 has been marked as a duplicate of this bug. ***

Comment 24

[Mathieu Pillard [:mat]]

-> english other.

Comment 25

[Richard Rutter]

For what it's worth, Marks and Spencer are still blocking Mozilla (as of writing
18 Jun 2003). I emailed to complain and received the stock reply that has been
posted here twice.

Comment 26

[Tim Jackson]

I managed, after a fairly strongly-worded response to one of their standard form
letters, to actually get a human response a while back from Steve Wind-Mozley,
promising he was "pressure testing" and he would "unblock" Mozilla.

That was February; it's June now. Hmm. Reply reproduced below as I think they've
had more than a fair chance to fix this.

From: [e-mail]
To: me
Cc: [e-mail]
Subject: RE: [Case 1124600] Web site problems
Date: Tue, 25 Feb 2003 09:34:23 -0000

Tim,

It's time for me to stand up and be counted.  I am sorry my wider team was
unable to answer all your queries to your satisfaction, however your
responses have been most stimulating.  With you permission I would like to
include them in my web-dev induction guide for all new coders to M&S.

On a more pertinent note, we are aware that Mozilla is the code base for
Netscape 7 and you will  know that the Gecko rendering engine can cause some
issues with some forms of client/server message exchange.

All this means that we know we have an issue and will fix it as soon as we
have available bandwidth.  Currently my web dev team is working on some
exciting projects to meet the needs of another group of our core customer
base.  When this is complete, they will be set to work on freeing up all
cross browser/platform accessibility and usability issues.  However I must
re-iterate, whilst we intend to serve as many combinations as possible, I
must balance the cost of "fixing" with the possible benefits of increased
trade. But hey, you don't want to hear my budgetary issues, you just want to
use your browser on the site of the UKs leading retailer.

Mozilla will be unblocked (OK it's not really blocked as you can bypass the
settings if you wish) as soon as I have finished pressure testing the new
code (yet to be delivered to the production site) as there is no point in
turning it on, only to have to withdraw it again.  Again, you don't need to
know this, so you have my word that I am working on it, it is just in a
queue at the moment.

And no, we do not presume that we have found an issue that no-one else is
clever enough to spot, we are just aware that we have seen behaviour from
these browsers that we are not happy with.  We have spoken with AOL/Netscape
and will continue to seek a solution.

If you feel the need to flame me or this response I would not be surprised,
however I hope you will allow us the time to put this issue to bed.

Best Regards

Steve W-M
Channel Developer
E-commerce Team
Marks & Spencer
DDI [phone]
GSM [phone]
Shop online @
http://www.marksandspencer.com <http://www.marksandspencer.com> 
Neutiquam erro

Comment 27

[Egon Face]

Perhaps now is a good time to "flame" Steve W-M to remind him to "put this issue
to bed"

Comment 28

[Bob Clary [:bc] (inactive)]

en other default owner

Comment 29

[Andy Sinclair]

As of yesterday the website no longer denies access to Mozilla.
I would be grateful if others could confirm this. 

Comment 30

[Emmanuel Bourg]

Confirming, we can read this in the technical FAQ :

"What's the best browser to use to shop online with Marks & Spencer?

The Marks & Spencer site is designed to be used with most popular browsers,
primarily Internet Explorer version 5 and above, Netscape version 6.1 and AOL
version 5.0"

Comment 31

[Emmanuel Bourg]

oops the FAQ hasn't changed actually ;) Opera 7 is accepted as well.

Comment 32

[GavinS]

Some of the site works OK now, but not all. Try clicking on the 'money' link. It
still says incorrect browser.

Hence, re-opening, and hoping that someone else will confirm it still has this
problem......

Comment 33

[Stefan Moebius]

I can confirm that 'Money' does not work. However, the URL looks a little
strange compared to all the others and it seems to be the only one not working.

Comment 34

[bugzilla]

Money appears to be a different server, though. I'd guess it's done by 
different people...

Comment 35

[lsof]

I've been e-mailing M&S Money about them not letting me use their website.
They tell me they "don't support open source web browsers".

I pointed out Netscape 7 is Mozilla.
I suggested not blocking, but popping up a window telling me that the website
may not work as expected. Still no luck.

Comment 36

[Marek Stępień [:marcoos, inactive]]

The Money section doesn't block Firefox 0.8 nor Mozilla 1.7 RC 1 anymore.

Comment 37

[Thomas]

the moneys ections seems to work for me...
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040421

Comment 38

[lsof]

This works now. Please can someone close this?

Comment 39

[GavinS]

Closing, as per comments, and checking again myself. Apologies if I get the wrong resolution, or 
someone else should do this

Comment 40

[Alex Hosking]

v