Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser

We have already seen how unsatisfactory Bernard Klatt's testimony about the Cools matter has been. One of his most serious mistakes involves the only evidence that we have about 90sAREover: the logs of his post of Sept. 5, 2003. Here is the entry in which "90sAREover" registered his username:

66.185.84.204 chat.freedomsite.org 90sAREover [05/Sep/2003:19:49:10 -0500] "POST /~Freedom/login HTTP/1.0" 200 1386 "http://chat.freedomsite.org:8080~Freedom"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi·Speed Internet; (R1 1.3))"

This log entry includes both the referring IP (in red) and the user-agent string (in blue), which shows that this is in the Combined Log Format, a fact that Klatt missed.

The interpretation of the user-agent also presented Klatt with difficulties. If you surf over to www.useragentstring.com, you can see what your own user agent string is and what it means.

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser

If at that same site you type in 90AREover's user agent string (blue above), you'll find a table like the one to the right (I've added the blue and truncated it slightly). It gives the items of the string with an explanation for each element. As you can see, R1 1.3 refers to RealOne Player, a free media player that has a built in browser. R1 obviously abbreviates "RealOne"; 1.3 was version 2.0.

If you don't believe me, you can download your own copy from oldversion.com and visit useragentstring.com to experiment. Or you can look at the long list of user agent strings in which we find some version of the RealOne Player over at botsvsbrowsers.com.

What did Klatt make of "R1 1.3"? Below and to the right (from pp. 1634-5 of the transcripts of Warman v. Lemire) is Klatt's attempt to explain it.  

It is painfully obvious that he has no clue. The tip-off: statements like "the best explanation I've been able to determine" (lines 9-10), "the best of my ability" (lines 14-15), "the best explanation" (lines 19-20) betray his lack of confidence in his own answer. You never say this about what you know; you only say this when your guessing.  And his guess is a bad one -- embarrassingly bad. Instead of recognizing that this was the RealOne browser, Klatt embarks on a series of accumulated conjectures: Rogers used a 15660 Cisco router, and "R1 1.3" was a firmware release, and the update took place in few weeks between 90sAREover's visit in September and Warman's visits in November. (Or, as we know now, but Klatt seems to have missed, October.)

Clearly he has no clue. What is worse is that he does not even know where to look for the correct answer. He did some "research on the internet", but where this led him is a bit of a mystery, since there seems to be no Cisco product with the designation CXC 15660, and no Cisco firmware update with this number. (Perhaps he has the 15600 CXC in mind?)

Trying to figure out what was his exact error is in any case unlikely to be productive. The more important point is that Klatt has failed to recognize that 90sAREover was using the browser built into the RealOne Player, which invalidates paragraphs 36 and 64 of his sworn affidavit (which you can see here), and (as I have argued here) is exculpatory for Warman.

Other posts in the Klatt's clunkers series:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close on proxies
• Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

90sAREover's browser: RealOne with customized Explorer

Commenter "freemarkets" discovered an important fact when he pointed out (here) that the notorious Cools post was made by someone using RealPlayer, which has a built-in browser.  As it turns out, it was RealOne Player, version 2 (see here). Here is a screen shot in which I use this version of RealOne Player (downloaded from oldversion.com) to go the site useragentstring.com:

The tell-tale sign is the string "R1 1.3" at the end, which signals this specific version of the RealOne player.  

Another noteworthy fact, however, is "MSIE 6.0" earlier in the sting. This stands for Microsoft Internet Explorer 6.0. Explorer wasn't open when I took this screen capture, but these details are reported anyway. Why? As it turns out, although the RealOne browser seems perfectly adequate as a browser, it was not completely independent technologically, but depended on Internet Explorer for some of its functionality. In Jan. 2002 someone had complained to Real, Inc., that his RealOne browser wouldn't work after he had removed Internet Explorer from his system. Here is the answer he received from Real (which he then shared with the world through google groups):

"Please note that it is necessary to install MSIE 5.0x (Internet Explorer) or higher versions of the browser installed on your system for the RealOne Player to function properly. RealOne Player uses some components of Internet Explorer browser. I suggest you install Internet Explorer browser on your computer, then install RealOne Player again on your computer to resolve the problem. Please visit the Microsoft's web site (http://www.microsoft.com) to download the latest version of the MSIE browser."

So, Explorer is needed to run RealOne.

It is probably for this reason that whenever RealOne visited a site, its user agent communicated not only its own details in its user agent string, but also details about the version of Internet Explorer on the host computer. A long list of user agent strings in which we find some version of the RealOne Player can be at botsvsbrowsers.com.

But more can be said about this. As we saw, 90sAREover's user-agent string read something like this: "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))". Just as above, "R1 1.3" refers to the RealOne Player, and MSIE 6.0 refers to the browser that the RealOne used to help it surf the net. But this wasn't just any version of that browser, but one customized by Rogers and distributed to its customers: hence the "Rogers Hi-Speed Internet" tag (here).

The user agent string from Warman's visit shows that he had no such set-up: his version of Explorer was un-customized, and as I've shown (here), this argues against identifying him as the 90sAREover poster.

More on R1 1.3 as the user agent string in the Cools post of 90sAREover

We have already seen that the user agent string of 90sAREover (who posted a nasty racist screed against Anne Cools on Sept. 5, 2003) was "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))".

The reference to Rogers here is to a special version of Rogers' browser distributed to its subscribers.

In a user agent string, R1 1.3, refers to Real Player, and we can now state definitively what the specific version was: RealOne Player, version 2, and as you can see here (red arrow for the RealOne version; violet arrow for the user agent string):

The difficulty, as commentator freemarkets pointed out in the comments to an earlier thread, is that we can only get the RealOne Player to show up in the user agent string if it is actually the browser that is being used. That is, Real Player versions for Windows, at least since RealOne, have a browser built into them, so that you can surf the web using Real Player.

It seems that the only possible explanation is that the Cools poster 90sAREover was using RealOne as his browser. But an important question remains outstanding. How is it that "Rogers Hi-Speed Internet" found its way into the user agent string. Was there a special Rogers version of RealOne Player?

Why Warman is probably innocent, part 2: Rogers Hi-Speed Internet

Whenever you visit a site on the internet, you leave details behind about where you are coming from and information about your computer configuration. These details are included in your user-agent string. (For a tutorial to user-agent strings, see here.) As we have seen, the user-agent string of the Cools poster will have been this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"

I have already argued that the "R1 1.3" (blue) means that the Cools poster had Real Player (version 1.3) installed. Commenter "freemarkets", however, points out in the comments of that post that in order to register in a user string, Real Player must be running, which weakens its exculpatory value.

But what about the entry "Rogers Hi-Speed Internet" in red? Clearly it identifies the poster as a Rogers subscriber, but that cannot the whole story, since it is not found in the user agent string of all Rogers' customers. Indeed, most don't. Take, for example, the thirty or so visits the proxy 66.185.84.204 made to the site ArcticCircle.ca in 2002 and 2003 that I have presented here. The user-agent data is listed for these visits, but only four of them include "Rogers Hi-Speed Internet". The same impression arises from the logs here, where over 3000 visits from various Rogers IPs were recorded from mid-2002 to mid-2005, and fewer than 50 have "Rogers Hi-Speed Internet" in their user agent string.

So what is happening here? In fact, this designation is mostly about the browser being used. If you've ever seen a version of Internet Explorer dedicated to a specific company (Yahoo!, Rogers, Bell, etc.), you'll have encountered browser customization, a process Microsoft describes at length here. The relevant section:

Customization Examples for ICPs

To showcase your organization's information and services on the Internet, you might want to consider the following customization options: Add links to your organization's Web sites. For example, if your organization is a radio station, you could add links to Web pages that highlight playlists and composers' biographies. Update the browser with your organization's logo and appropriate graphics. You can add your organization's name to the title bar and your organization's logo seen in Windows Update Setup for Internet Explorer and Internet Tools. In addition, you can replace the browser logo with your organization's logo or other graphics. Track information about your customized browser by using a user agent string, which is a string of characters that a Web browser sends when it visits an Internet site. The custom string that you append to the user agent string enables Web sites to compile statistics about how many of your customers are using your browser to view those sites.

Note especially the red. Custom versions of Explorer were typically signalled in the user agent string. And this is what Rogers did: create a customized version and distribute it their clients. It looked a little different, reminded their subscribers they were (joy!) Rogers' customers, set the default web-page to Rogers' site, etc. Also -- and this is the important point here -- this special customized edition of Rogers left its mark at every web-site they ever visited, with the "Rogers Hi-Speed Internet" tag in the user agent string.

Of course, not all Rogers customers used the special Rogers version. Indeed, the vast majority seem to have opted for the one that came with their machine, or that they downloaded themselves. This group -- who may have been over 90% of Rogers customers -- did not have the "Rogers Hi-Speed" tag in their user-agent string. (Indeed, as you can see here and here, the user agent string might continue even after a change of ISP -- it's about the browser being used, not the ISP.)

So, what does this have to do with our present inquiry?

We have already seen that the Cools-poster (90sAREover) had Real Player installed on his computer and (as "freemarkets points out) had it open when he visited freedomsite.org. We now also know that his visit was completed using a version of Internet Explorer that had been customized by Rogers.

And Richard Warman? His visit to freedomsite.org on Oct. 15, 2003 (a month after the Cools post) left the following log entry (the user agent is underlined in blue):

As you can see, Warman does not have the "Rogers Hi-Speed" tag in his user agent string, therefore he was not using a customized Rogers browser. This presents an obstacle to any attempt to identify Warman as the Cools-poster.

What does "R1 1.3" mean in a user agent?

In the last post (here), we saw that Bernard Klatt, Lemire's expert witness in his ongoing CHRC hearing, revealed 90sAREover's user agent data to be this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"

Now, Klatt successfully identified the browser (Internet Explorer version 6.0) and Operating System (Windows 98). He was less successful in explaining the latter two items "Rogers Hi-Speed Internet; (R1 1.3))".

Apparently he didn't know User Agent String, a handy-dandy site that takes any user-agent and breaks it up into nice understandable parts. Entering our string yields the following table

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser
All Internet Explorer user agent strings

Now, especially to be noted is how wide of the mark is Klatt's explanation of R1 1.3. His explanation (p. 1634):

This is clearly wrong, as the useragent.com search shows. "R1 1.3" does not refer to Cisco firmware, but to the fact that the user of this computer had a Real Player installed.

The "Rogers Hi-Speed Internet" is less clear. Not all Rogers' users have it. In the thirty visits from a dozen or so users of 66.185.84.204 here, only a couple have it. (To judge from this, the Rogers-tag here means that the version of Explorer being used was one supplied by Rogers, not a generic version.)

More shortly.

Update. Commenter "freemarkets" points out that the Real Player only shows up in the string if it is being used, not installed.

Clarifications to Rogers Hi-Speed made; quote from Klatt on R113 added.

Klatt on 90sAREover's user agent

Here are pages 1633-5 of Richard Warman and the Canadian Human Rights Tribunal v. Marc Lemire (T1073/5405 vol. 9) of Feb. 8, 2007. In it, Lemire's expert witness, Bernard Klatt, is testifying about the logs of Lemire's site, and trying to make the case that "90sAREover" was identical to "lucy" (a username of Richard Warman). 

In the following passage, Klatt describes a few of the log-entries.  He has already pointed out that "90sAREover" and "lucy" share the same IP: 66.185.84.204, but as we've seen elsewhere, this does not prove they were identical: that IP is a proxy shared by hundreds of thousands of Rogers' customers.  Below Klatt describes other facts found in the entry:

p. 1633

p. 1634

p. 1635

Now, to judge from Klatt's remarks here, the log entry, which will have ended with user-agent data, must have looked something like this:

 "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"

This is something that we have paralleled in weblogs elsewhere.  This exact same configuration can be found in this log of June 4, 2004, of the Engineering School at the University of Illinois.  The date of that log rather spoils Klatt's theory that this is a firmware update from Cisco.  There is a better explanation that we'll return to in the next post.

Update As you can see from the actual logs (which can be perused in my post on the Klatt affidavit in Warman v. Lemire), the conclusion reached above is correct and 90sAREover's user agent string was follows: "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))". Since this is different from the set-up used by Warman in October and November, the posts were made from different computers.