1

There has been a discussion recently (with my colleagues) on whether or not checks should be performed on client machines to check for specific software, within a web based platform, mainly because we have some requirements for certain user actions and to help diagnose certain issues we could log whether or not they actually had that software. On a users PC at an internal company this seems fairly straight forward as a lot of companies will have the same software on each machine, but this is on client machines outside of the company.

As it would be client side via a web interface (built using ASP.NET) I guess I'd use JavaScript to do the look-ups, however it occurs to me that there are potential pit-falls with this, namely:

  1. A user may have similar software to what you say is a requirement e.g. Open Office instead of MS Office

  2. A user may have installed the software in a different location to the default area

  3. A huge variety of software types on multiple different operating systems (Windows, iOS, Android, etc).

  4. Software versions can vary so that would need accounted for, especially as they can be installed in different areas (e.g. Visual Studio).

I also remember old discussions from many moons ago that checking for things like Browser version, or even Operating System, were relatively frowned upon and to me this seems semi-similar.

So my question is as follows:

Is there a best practice for, or against, checking for software on a client machine via a web browser? Be it for Adobe, or Word, or whatever other software a website may want a user to have. Ideally some reference material would be great.

To me it seems there are a lot of downsides, and it also puts a lot of onus on the webpage to ensure a user has the correct software (I’m a believer in the practice that a UI should have little to no working knowledge of its back end system or anything else).

edit just to point out, my question is not related to using JavaScript to do this, it is around best practice on whether you should attempt to do some form of check.

Improve this question
2
  • How would it be called creating a virus? I can see hacking, loosely, but not sure about virus.
    – MattR
    Mar 31, 2016 at 14:31
  • 4
    Requiring software other than a browser to be installed defeats the purpose of a browser based application.
    – GrandmasterB
    Mar 31, 2016 at 16:22

4 Answers 4

Reset to default
5

These checks invariably fail. Try to avoid tying your application to specific software, browsers or versions. Code to standards. As it appears you are Microsoft based, you may need to code around issues with different Internet Explorer versions. Try to keep these to a minimum.

From a security standpoint, you don't want to prevent users from upgrading to a supported version. You especially don't want to force them to remain on an insecure version.

I have run into numerous issues with built-in checks. Two significant version checks (both from vendors that should know better) I have had to deal with are:

  • A virus scanner Java console that was pinned to a specific patch level of Java. It failed whenever Java was updated (for security fixes).
  • A program that was configured to run on only 4 versions of Internet Explorer stopping at IE8. It works fine on IE9, if you spoof the User Agent.
Improve this answer
15

You cannot check through a browser if the user have other software like Word installed. If that was possible it would be a huge security hole.

Improve this answer
8
  • Sounds reasonable. How do sites verify you have certain things then? I understand that say nVidia uses Java applets ( if that is the correct term), is that the only way?
    – MattR
    Mar 31, 2016 at 14:32
  • An ordinary java applet will not be able to do this either. An applet running with some kind of elevated trust might be able to, I'm not sure. Otherwise you could have the user install a custom app for this purpose. Perhaps you should open a different question about how to do this.
    – JacquesB
    Mar 31, 2016 at 15:26
  • 1
    But in general web sites does not need to check if you have certain software installed. The only thing which a browser can check is the browser version itself and the OS version.
    – JacquesB
    Mar 31, 2016 at 15:45
  • 2
    “How do sites verify you have certain things then?” — They don’t. Do you have an example of this happening? For instance, what exactly is Nvidia checking for?
    – Konrad Rudolph
    Mar 31, 2016 at 16:14
  • I'm the case of nVidia they can check whether your graphics drivers are out of date, but as I said that isn't JavaScript
    – MattR
    Mar 31, 2016 at 16:23
1

Export in standard formats such as PDF, ODF, HTML, RTF, CSV, etc. XLS and DOC probably count as standard formats at this point. Then you don't have to care what they've got installed.

Improve this answer
0

I think it is OK to check the client browser version or which browser is used in order to improve your application and user experience. This can be handled easily through Javascript or the response.

But to discover what other software is installed on the client machine, this impacts the privacy of the client and won't help you, even for the purposes you mentioned above.

Try to adjust your application to more than software (MS Office, Open Office, ...) and you can always write a note on your site that it is tested to work well with the intended software.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.