> Here's a survey of how it's described in passwd(5) manual pages:
>
> Linux: GECOS -- This field (sometimes called the "comment field") is
> optional and used only for informational purposes. Usually, it contains
> the full username. Some programs (for example, finger(1)) display
> information from this field.
>
> MacOS: gecos -- User's full name. The gecos field normally contains the
> user's full name.  Note that Mac OS X differs from some other operating
> systems, where the gecos field may contain other comma-separated
> information about the user.
>
> FreeBSD: gecos -- General information about the user. The gecos field
> normally contains comma (`,') separated subfields as follows:
> - name     user's full name
> - office  user's office number
> - wphone  user's work phone number
> - hphone  user's home phone number
> The full name may contain an ampersand (`&') which will be replaced by
> the capitalized login name when the gecos field is displayed or used by
> various programs such as finger(1), sendmail(8), etc. The office and
> phone number subfields are used by the finger(1) program, and possibly
> other applications.
>
> DragonFly BSD: ditto
>
> OpenBSD: ditto
>
> NetBSD: ditto
>
> Solaris: gcos-field -- is the user's real name, along with information
> to pass along in a mail-message heading. (It is called the gcos-field
> for historical reasons.) An ``&'' (ampersand) in this field stands for
> the login name (in cases where the login name appears in a user's real
> name).
>
> Minix: The gecos field can be set by the user. It is expected to be a
> comma separated list of personal data where the first item is the full
> name of the user.
>
> AIX: GECOS -- Full name of the user
>
> HP-UX: reserved gecos ID -- The gecos field may contain the following
> identification: user's full name, office location, extension, and home
> phone. The gecos field can be set by use of the chfn command and is
> displayed by the finger command (see chfn(1) and finger(1)). These two
> commands assume the information in this field is in the order listed
> above. A portion of the user's real name can be represented in the gecos
> field by an & character, which some utilities (including finger) expand
> by substituting the login name for it and shifting the first letter of
> the login name to uppercase.

And here's a survey about the use of ampersands and commas in the
default /etc/passwd file of each system:

MacOS             no ampersands, no commas
BeOS (Haiku)      no ampersands, no commas
Solaris (OmniOS)  no ampersands, no commas
Minix             no ampersands, no commas
Linux (Alpine)    no ampersands, uses commas
Linux (Debian)    no ampersands, uses commas
FreeBSD           uses ampersand, no commas
OpenBSD           uses ampersand, no commas
NetBSD            uses ampersand, no commas
DragonFly BSD     uses ampersand, no commas

Conclusion: We should care about both ampersands and commas when parsing.