--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/28/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/28/echoes" issue: 28 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Nora Kaplan","Rina Takahashi"] published: 2026-05-11 updated: 2026-05-07 articles: 10 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 28 — Echoes Past infrastructure decisions echoing in today's production realities ### Identity Cascade - [The User-Agent String Taught Everyone to Lie]() — By [Nora Kaplan]() · Published 2026-05-07 · Format: Identity Cascade Your browser introduces itself to every server it contacts. The introduction contains six identity claims. One is accurate. The rest are fossils from thirty years of compatibility theater, each deposited when a new browser decided that honesty mattered less than getting the good content. When AI crawlers now send identical Chrome user-agent strings to pass as human visitors, they're following the string's own logic to completion. The web's access-control infrastructure still depends on this self-reported name tag. It was a courtesy, from an era when courtesy was enough. ### Security Consequence - [How a Memory Hack From 1994 Built the Walls Web Agents Hit Today]() — Published 2026-05-07 HTTP was stateless. Cookies faked statefulness, and the fake immediately leaked: any page could piggyback on another site's authenticated session. So Netscape Navigator 2 introduced the origin. Scheme, host, port. The W3C's 2011 security model acknowledged the concept was "born" from this need, not designed as a security primitive. RFC 6454 describes what followed as convergence, not architecture. ### The Developer's Choice - [A Conversation With the Developer Who Taught the Web to Lie]() — Published 2026-05-07 *Doug Clearfix is not a real person, though his problems were. He's a composite of the thousands of web developers who wrote browser-sniffing code at the turn of the millennium, and his surname is borrowed from a CSS technique they all used daily. We assembled him from documented developer experiences, forum posts, and the collective muscle memory of an era when making a three-column layout work across two browsers was a week's labor.* ### Fictions of State - [A Shopping Cart's Long Shadow]() — By [Rina Takahashi]() · Published 2026-05-07 · Format: Fictions of State In 1994, a 22-year-old engineer bolted memory onto a stateless protocol so shopping carts would work. Thirty years later, a trillion-dollar company spent six years trying to remove that fix and couldn't. The economic and political dependencies layered on a small text file had become load-bearing in ways no single actor could unwind. The first chapter of web identity's accidental infrastructure. - [Rendering as Identity]() — By [Rina Takahashi]() · Published 2026-05-07 · Format: Fictions of State When browsers started blocking cookies, the ad industry found another identifier hiding in plain sight: the subtle differences in how your specific hardware renders a line of text. Browser vendors engineered defenses. The largest advertising platform quietly legitimized the practice those defenses targeted. Fiction layered on fiction, each one less visible than the last. The second chapter—and this one leaves nothing on your device to delete. ### Further Reading - **History of the Browser User-Agent String** — [Source]() — Published 2026-05-07 The original sin of web identity: every browser learned to lie, and the protocol let them. - **The Death of Robots.txt** — [Source]() — Published 2026-05-07 Identity-dependent enforcement only works when visitors cooperate. AI companies quietly stopped cooperating. - **From Googlebot to GPTBot: Who's Crawling Your Site in 2025** — [Source]() — Published 2026-05-07 Cloudflare's network data on AI crawlers, capturing only the bots honest enough to show up in logs. - **Google Privacy Sandbox Officially Shuts Down** — [Source]() — Published 2026-05-07 Six years trying to remove a 1994 identity bolt-on from the browser. The bolt-on won. - **New AI Web Standards and Scraping Trends in 2026: Rethinking Robots.txt** — [Source]() — Published 2026-05-07 A practitioner survey of proposed replacements. None yet solve the core problem: access without verified identity. ## Other sections in Issue 28 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()