Mozilla Browser identification problems

How do I know it's plain Mozilla?

[fischermx]

Hi,

I'm developing a modest analytics applications and I'm facing a problem with identifying the plain Mozilla/SeaMonkey browser.
I mean, I can easily recognize Microsoft Internet Explorer, cause it says MSIE in the UA. Firefox says firefox/x.x and Opera says Opera x.x

But what about Mozilla? Some newer string says "SeaMonkey" on it, but older versions says nothing special to be identified.

How would you do it?

[jdMorgan]

If NOT (Camino¦Firefox¦Netscape¦SeaMonkey)
Then Mozilla Suite

Jim

[Samizdata]

I don't have a comprehensive answer but testing for the presence of "Gecko/" (with the slash) and
then the absence of Firefox or Netscape should narrow the field down quite a lot.

The slash is important to exclude browsers (Chrome, Safari, Camino) that use "like Gecko" in the UA string.

The old Mozilla browsers are no longer supported and must be pretty rare. Here's one:

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.13) Gecko/20060414

...

[jdMorgan]

Yes, and rv:1.7.13 should be the highest Mozilla Suite version number you ever see.

Jim

[Samizdata]

Oops... I will try to be more accurate with my obscure lizards.

Camino and Flock contain "Firefox":

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en; rv:1.8.1.16) Gecko/20080803 Camino/1.6.3 (like Firefox/2.0.0.16)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12) Gecko/20080211 Firefox/2.0.0.12 Flock/1.0.9

The "like Gecko" browsers generally reference WebKit:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.29 Safari/525.13
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_4_11; en) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.2 Safari/525.22
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/125.4 (KHTML, like Gecko, Safari) OmniWeb/v563.66
Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en-us) AppleWebKit/525.18 (KHTML, like Gecko) iCab/4.2.1

Netscape usually declared itself:

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2

I don't suppose anyone uses Mozilla for Mac OS9 anymore:

Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:1.1) Gecko/20020826

I wouldn't be surprised if there are others - but I'd be surprised if they visited much.

...

[GaryK]

Jim, I hope I'm not picking at nits, but I can cite over two dozen Gecko-based user agents less than rv:1.7.13 that aren't Camino, Firefox, Netscape or SeaMonkey. Granted they aren't all widely used, some are alpha/beta versions of Firefox, but I see all of them in my log files every couple of weeks. I'm only pointing this out because the OP could run into problems if relying only on weeding out the browsers already mentioned. :)

Firebird
Granpadadiso
Minefield
Phoenix

ACommunicator
Amico Alpha
Chimera
Danger hiptop
Desktop/LX Amethyst
Epiphany
FireCat
Firevulture
Foxybird
Galeon
IceSquirrel
Ideal Browser
Lightninglemur
Mnenhy
Moongoat
Moonphoenix
NetFront
OpenVMS
Seawolf
Spaceoyster
Superchipmunk
Superkoala
Superpig
Sylera
Thunderbird
Waterbaboon
Waterunicorn
Waterworm

ADDED: Samizdata, I was posting while you were saving. :)

[edited by: GaryK at 9:13 pm (utc) on Nov. 9, 2008]

[jdMorgan]

No, no nits, you've just got a longer list... Which data I have now added to my list... :)

Thanks,
Jim

[Samizdata]

Firesomething. This extension will give Firefox an identity crisis by generating a new randomized browser name every time you open a new window.

I think you will find that accounts for some of the list (though Galeon and Chimera are real enough).

I have never seen NetFront (a moble browser) claiming to be Gecko, likewise Hiptop (aka Sidekick).

I am posting this with a UA of "This is not a real Gecko either".

...

[jdMorgan]

GaryK,

Do we need to add Deerpark and BonEcho to this list?

Jim

[GaryK]

Yes, it's probably a good idea to include all Firefox-related user agents.

I did a very loose DB query that returned 1200 results, some dupes, and may have missed a few. I'll go back and spend more time weeding through the results after I get back from dinner. :)

[jdMorgan]

Assuming that we do, and discounting the "silly-attribute/silly-animal-constructed UAs likely due to that very foolish plug-in, as well as a few plug-ins such as "Mnenhy" which could be installed on Mozilla Suite, my list ends up as:

Camino¦Firefox¦Netscape¦SeaMonkey¦Thunderbird¦Galeon¦Phoenix¦Firebird¦BonEcho¦Deerpark¦Granparadiso¦Minefield¦ACommunicator¦Amico Alpha¦Chimera¦Desktop/LX Amethyst¦Epiphany¦Ideal Browser¦Sylera

Jim

[GaryK]

I am posting this with a UA of "This is not a real Gecko either".

I see those kinds of user agents every week. This week brought the one below. ;)
Mozilla (compatible; Undisclosed browser but not MSIE; certainly not Windows 6.0 nor other version)

Firesomething. This extension will give Firefox an identity crisis by generating a new randomized browser name every time you open a new window.

Thanks, looks like I've got some research to do.

I have never seen NetFront (a moble browser) claiming to be Gecko, likewise Hiptop (aka Sidekick)

Mozilla/5.0 (Symbian OS; U; Symbian OS-Series60; en; rv:1.7.12) Gecko/20020823 NetFront/3.2

Mozilla/5.0 (Danger hiptop 4.7; U; rv:1.7.12) Gecko/20050920

[GaryK]

Jim, sorry for double-posting. I didn't see your reply earlier.

Firesomething is only available for v2 and older. It's buggy as heck when you modify it to work with 3.x. Still, I downloaded it and checked the various names it uses. It works by selecting a prefix and suffix from a string. There are far too many suffixes to include here. The prefixes seem to make it easy to decide which of the above "browser names" are just Firefox with this worthless add-on installed.

Fire
Hyper
Hypno
Jungle
Lightning
Moon
Power
Sea
Space
Sun
Super
Thunder
Turbo
Water
Web

Still, I would suggest that since these things are in the wild and used often it's important to check for them.

[edited by: GaryK at 10:25 pm (utc) on Nov. 9, 2008]

[Samizdata]

So I installed the Firefox extension I mentioned earlier and my browser identified itself as Hypnomoth, Seadingo, Powerscorpion, Firegazelle and Turbocicada in quick succession - it works by combining a prefix and suffix from built-in lists at random, with a very low probabilty of ever combining "Fire" with "fox".

I would say that several of the "browsers" in Gary's list are generated in this way, and I could easily provide hundreds more.

Do you guys seriously want to add them to a list?

EDIT: OK I see you are on top of the situation.

...

[edited by: Samizdata at 10:29 pm (utc) on Nov. 9, 2008]

[GaryK]

Ack, you're too quick for me! :)

I think since they're in the wild and I see them very often it's important to check for them.

ADDED: BTW, just cause the default list contains these items doesn't stop someone from adding their own names to the firesomething-defaults.js file.

[edited by: GaryK at 10:28 pm (utc) on Nov. 9, 2008]

[Samizdata]

I see them very often

Gary, you mentioned in another thread that you are running a "user-agent project" of some sort.

I would suggest that you are being deliberately targeted.

...

[GaryK]

Yep, that I am. In a way it's a good thing. Thanks to you at least I now know to scrutinize more closely UA strings that start with the above prefixes and make sure they're identified as Firefox. I'm sure that'll piss off a few people who think they're being sneaky. Thanks. :)

[fischermx]

Could you please post a few FULL user agent string generated with these weird names?

[Samizdata]

Could you please post a few FULL user agent string generated with these weird names?

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.17) Gecko/20080829 Junglemouse/2.0.0.17
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.17) Gecko/20080829 Supermantis/2.0.0.17
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.17) Gecko/20080829 Lightningseal/2.0.0.17

---

I daresay you are wishing that can of worms had stayed shut.

Jim's final list is probably as good as it gets, and I would hope that the number of puerile extension users would be insignificant in the great scheme of things - we all know that user-agent sniffing can never be 100% reliable anyway.

As a footnote here's a (genuine) "like Gecko" browser that doesn't reference "WebKit":

Mozilla/5.0 (compatible; Konqueror/3.5) KHTML/3.5.9 (like Gecko)

...

[fischermx]

Could we assume that if the UA matches "Gecko/"+some numbers + space + word + "/"+version number, then it is Firefox? :)

[Samizdata]

Could we assume

From the examples I have available Netscape seems to be the only exception to that.

The idiotic plug-in merely substitutes the word Firefox and changes nothing else.

I confess I have never heard of some of the other genuine browsers Gary and Jim provided.

...

[encyclo]

The nearest thing to an official guide to how the Gecko user agent string should look like can be found here:

[developer.mozilla.org...]

[GaryK]

Could we assume

I don't think you can assume that. Here's one example where that assumption fails:

Mozilla/5.0 (X11; U; Linux ppc; en-US; rv:1.6) Gecko/20040414 Epiphany/1.0.8

Epiphany is a popular browser for GNOME, a desktop for GNU/Linux and UNIX.

[jdMorgan]

The Mnenhy plug-in mentioned in GaryK's list puts its name between the Gecko/<date> string and the browser name, so IIRC, it might look like:

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.17) Gecko/20080829 Mnenhy Firefox/2.0.0.17  

Basically, User-agent strings are a mess... :)

Jim

[GaryK]

Jim, there are two variations on that user agent. I've never seen the one you posted, but I suppose it could exist. I'm curious where you saw it please?

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040803 Mnenhy/0.6.0.104

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0 Mnenhy/0.6.0.104

Yes, UA strings are a mess. Always have been. :)

[edited by: GaryK at 1:31 am (utc) on Nov. 10, 2008]

[fischermx]

Oh, well, I will have to learn to live with that.

BTW, why are you guys, jdMorgan, Samizdata, GaryK, interested/knowledgeable in user agent strings?
I already stated my reasons..... what about you!? :)

[GaryK]

I run a project that lets people download various files for identifying user agents including browscap.ini.

[Samizdata]

My interest is about technique - ars gratia artis - and I describe myself as a "virtual dilettante".

I have been making websites for ten years and keep finding new things to learn, which suits me fine.

I am not constrained by commercial imperatives, which suits me even better.

I am not necessarily brilliant at what I do (especially compared to some here) but I love to do it.

Others might say I am just a control freak...

...

[Samizdata]

Here are a few more exotic lizards that didn't make Jim's list:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080406 K-Meleon/1.1.5
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.14) Gecko/20080404 Iceweasel/2.0.0.14 (Debian-2.0.0.14-2)
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.13) Gecko/20080313 Iceape/1.1.9 (Debian-1.1.9-5)
Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.14) Gecko/20080404 Webzebu/2.0.0.14 (Debian-2.0.0.14-2)

...

[GaryK]

SeaMonkey, IceWeasel and Iceape both started at 1.8.*. Webzebu started at 1.7.3. Jim mentioned not including anything greater than 1.7.13 so I didn't. :) You're right about forgetting K-Meleon. It started at 1.2b. Sorry about that. I do have it in my database, but completely overlooked it. :o