Mozilla Browser identification problems

How do I know it's plain Mozilla?

[fischermx]

Hi,

I'm developing a modest analytics applications and I'm facing a problem with identifying the plain Mozilla/SeaMonkey browser.
I mean, I can easily recognize Microsoft Internet Explorer, cause it says MSIE in the UA. Firefox says firefox/x.x and Opera says Opera x.x

But what about Mozilla? Some newer string says "SeaMonkey" on it, but older versions says nothing special to be identified.

How would you do it?

[JAB Creations]

Firefox
Minefield
Iceweasel
Epiphany
Kazehakase
Skipstone
BonEcho
SeaMonkey
Flock
Songbird
Netscape
GranParadiso
Phoenix
K-Meleon
Swiftweasel
Beonex

Safari developers thought it was genius to declare their browser as like "Gecko".

Then Google jumped in to the mess and thought it'd be genius to declare Chrome as Safari.

Also I may have missed one or two so I'd recommend creating a pattern sequencer that determines if there is a new user agent.

Lastly some genius thought making an extension for Firefox to spoof the user agent (based on the fact that Firefox's name has been changed) throws even more dirt in to the mess.

- John

[Samizdata]

Safari developers thought it was genius to declare their browser as like "Gecko"

My assumption was that they simply copied it from Konqueror (upon which it was based).

Mozilla/5.0 (compatible; Konqueror/3.5) KHTML/3.5.9 (like Gecko)

As always, I am happy to be educated.

As I said earlier, testing for "Gecko/" should eliminate the KHTML browsers.

Thanks for the additions, researching them should keep me out of mischief for a while - though I found that some of the earlier list were unavailable for download (where references to them could be found at all).

...

[GaryK]

Which ones? I've got links to most of them and would be happy to share. I can Sticky them to you cause I probably can't post 'em here.

[Samizdata]

No problem Gary, I am not engaged in compiling a comprehensive list of user-agents, my interest is mostly about what is currently available and likely to be used.

I don't keep logs for all my sites but I have had a visit from Kazehakase:

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.1) Gecko Kazehakase/0.5.4 Debian/0.5.4-2.1

Note the lack of slash and build date.

...

[caribguy]

Perhaps the botsvsbrowsers website could be useful too

[amznVibe]

awstats is GPL and has a very complete list of UA patterns inside which you can probably use as long as your own software remains GPL too. It can detect several variations of Mozilla across different OS platforms. Why reinvent the wheel?

[GaryK]

Perhaps the botsvsbrowsers website could be useful too

There are several websites that offer valuable resources for finding user agents. The one you mentioned, with over 200,000 user agent strings in its database, is perhaps the best. UserAgentStrings is also a good resource because, unlike botsvsbrowsers, it shows when the last visit was. That's very helpful in determining if a user agent is still active because these things frequently come and go like the wind.

[tangor]

I'd be interested, but it seems easier to exclude "browsers" ripping through 600 pages in 2 minutes than attempting to identify a Mozilla Gecko Safari Opera kind of agent...

[jdMorgan]

Unless you're developing an analytics package and want to report browsers by "family," like the original poster to this thread is...

Jim

[Samizdata]

I'd be interested

OK I'll give have a shot at summing up:

No Gecko

Opera declares itself as Opera, or Opera Mini for the mobile version. No lizard mentioned.

We are not concerned with strings containing Mozilla unless they also contain Gecko.

Like Gecko

Safari (desktop or mobile) and Konqueror say they are also KHTML (like Gecko).

Chrome, Android and Omniweb say they are also KHTML (like Gecko) and Safari.

iCab for OSX says it is also KHTML (like Gecko). The OS9 version is simply iCab.

NetFront is a mobile browser occasionally containing "like Gecko".

Real Gecko

Firebird and Phoenix are old versions of Firefox, and all three admit to being Gecko.

Firefox says it is Firefox except when it is Deerpark, Minefield, Granparadiso or BonEcho (often a Yahoo bot).

Flock and Camino say they are Gecko and also contain Firefox in their string.

Seamonkey, Netscape, Epiphany, K-Meleon, Galeon, Iceweasel, Iceape, Webzebu, Thunderbird, Chimera, Amethyst, Ideal Browser, Sylera, ACommunicator, Amico Alpha, Foxybird, Kazehakase, Beonex, Skipstone, Songbird, Swiftweasel and OpenVMS all identify themselves and mention Gecko.

Anything else containing "Gecko/" and a version less than or equal to 1.7.13 is probably plain Mozilla.

Maybe

Except that Mnenhy and (in some cases) Firesomething may be mentioned, indicating possible tampering.

And there could still be some exotic and obscure reptiles lurking in the undergrowth.

And anyone can change their user-agent easily, be they human or robot.

And the IP was from Websense, so UA was definitely spoofed anyway.

...

[GaryK]

Good summary. Thanks. :)

[jdMorgan]

Mnenhy [mnenhy.mozdev.org] is just an add-on to enable certain kinds of mail/news headers to be displayed. Presence of its UA sub-string in Mozilla Suite, SeaMonkey, or Firefox UAs can be ignored for the purposes of identifying Mozilla Suite.

Jim

[Samizdata]

Thanks Jim, and apologies to Mnenhy. I'm from the "never download or eat what you can't pronounce" school.

In reparation, here's a rare sighting of an undisguised Firesomething found in the wild:

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.8.1.14) Gecko/20080404 Thunderlion/2.0.0.14
(All your Firefox/2.0.0.14 are belong to Firesomething)

...