5 ms·

I know this too well. Some pages will tell me that my name or address is 'invalid' because it contains spaces or forbidden characters. I'm sorry, but 'ñ', apos

by ergl 10y ago

I know this too well. Some pages will tell me that my name or address is 'invalid' because it contains spaces or forbidden characters. I'm sorry, but 'ñ', apostrophes and accent marks are not forbidden, and no name should be ever 'invalid'. How can a name even be 'invalid'? Sometimes I think too many sites assume (wrongly) that all customers will be an average english-speaking, US-resident person.

lmm 10y ago
Sites don't (or at least shouldn't) have any obligation to serve everyone. Most people are content to render their name in plain ASCII. How much extra are you willing to pay to be able to use those symbols? Or do you expect everyone else to subsidize you?
- atomwaffel 10y ago
  Certainly, most websites have no obligation to serve me as a customer, but if they tell me that my name is "invalid", they shouldn't be surprised if I take my custom to a competitor who isn't quite so rude. But you seem to be missing the fact that "Gijs in 't Veld" is perfectly valid Ascii, as would be names like "O'Leary" or "O'Reilly" that are perhaps more common in the English-speaking world.
  - candu 10y ago
    And some websites, such as government portals to various departments and services, do have implicit (and often even explicit) obligations to serve everyone. I wonder how well GP would take it if, say, the IRS webpay or DMV sites (or their equivalent wherever GP happens to live) balked at their name.
    - atomwaffel 10y ago
      Yes, government services was what I thought of when I wrote "most websites". Then again, I feel like those tend to be the worst user experience offenders (which is what this comes down to). It took me several attempts to mangle my home address into something the US visa application form would accept and I've seen ö turned into Ã¶ on my own country's official websites so many times that I can remember the mojibake. I wonder why that is. I guess part of the reason is that government doesn't need to invest heavily in UX because there is no threat of people going elsewhere – when you need a passport, you need a passport, and you're not going to order one from Amazon. In fact, there's probably a disincentive for government to continuously improve their UX precisely because any changes to a system that's in place and working well enough only cost them money. Are there any counterexamples of government websites that offer good user experience?
      - bzbarsky 10y ago
        The tax e-filing system in Massachusetts is a government website that offers a quite good user experience. It could be a bit better (e.g. it could save your general W-2 info from year to year on the assumption that you probably didn't change employers), but it's fairly nice in most ways; the W-2 thing is the only problem I've run into with it, and it has a fairly clear UI. Especially given the complexity of the actual paper MA tax forms. On the other hand, the MA website where you pay things like unemployment insurance for your employees is terrible, complete with being offline outside of normal business hours (because afaict they take it offline while they do batch imports from physical media that companies send them). Note that this is not as much of a "voter-facing" website, of course. ;)
    - bzbarsky 10y ago
      The DMV in Massachusetts can't handle a space in a last name. They convert it to a dash instead. As a result, I know several people who have different names on their passport and their driver's license, simply because the computer system at the DMV is broken.
- dguaraglia 10y ago
  Actually, most 'injection' issues happen because of poor programming practices (not sanitizing input, not escaping SQL parameters, etc.) and not because databases don't support Unicode characters. It's not the OP or the grandparent's fault for not having a "nice-to-shitty-programs" name.
  - lmm 10y ago
    Sure, but poor programming practices come down to cost like anything else - whether they're due to low-quality programmers, lack of training, poor management or whatever. No-one is deliberately choosing to make their site worse.
    - dguaraglia 10y ago
      True. Hiring better programmers is more expensive, but in the case of vulnerabilities the long-term cost of not doing the right thing are probably higher than the upfront cost of hiring someone more qualified. The original tweet, for example, reeked of crappy hand-crafted PHP code. Pretty much any web framework, even PHP ones, wrap bare exceptions like that into a proper 500 error with no information about the underlaying system. How long will it take for someone to put two and two together (MariaDB, no escaping of user input, a users table of some sort) and come up with a SQL injection that exposes all the password hashes for that website?
- ranko 10y ago
  "Most" people? Are you sure? There are over a billion and a quarter Chinese people for a start.
- wtetzner 10y ago
  > How much extra are you willing to pay to be able to use those symbols? It shouldn't cost anything extra to use those symbols in a name. In fact, it should be cheaper, because they won't have to do checks on the input to determine if it's "valid". Just store and display the name using UTF-8 and be done with it. No, sites don't have any obligation to serve everyone, but in the same way, potential customers have every right to criticize the site and it's poor implementation.
- markbnj 10y ago
  Oh please, that's ridiculous. It is not "extra work" to handle all the legal characters in your input, and it is also not "extra work" to handle errors server side and not blindly render them to the page. This is just amateur hour.
- sp332 10y ago
  If it's too much work to acquire a customer, your business model has already failed.
mc32 10y ago
Some trivia. "Ñ" is/was a shorthand for "nn" or "nh". Basically some lazy monks didn't want to write out a full extra letter.
- acqq 10y ago
  You can then say that all character sets are shorthand for pure binary codes. Just if your language doesn't use it it doesn't mean it's still "just a shorthand."
  - uola 10y ago
    Well, to some limit. I run into chinese form all the time that doesn't accept more than 10 characters. PS. Thank you for reposting my comment comment in an earlier thread [0], but it's not that I've been flagged, I've been hellbanned [1]. This is how "hacker" news threats it contributing members with another perspective. And yes, I do know what I'm talking about, because I'm in China. But no, not Chinese. Enjoy the timewasting. [0] https://news.ycombinator.com/item?id=11675395 https://news.ycombinator.com/item?id=11675395 [1] Turn showdead on, visit https://news.ycombinator.com/user?id=uola https://news.ycombinator.com/user?id=uola
  - 0x6c6f6c 10y ago
    But what came first? I don't believe ASCII or UTF preceded the creation of the written language.
    - acqq 10y ago
      > But what came first? Ñ existed long before USA, ASCII and UTF. So nobody should think that today "Ñ" is a shorthand. ----------- (out of topic, just for moderators: hello mods, dang, why in the world is the user "uola" "hellbanned"? just because he posted too many responses? maybe he should have been informed to slow down, I know you have that feature. Is the reason is not to let know the "bots" or malicious users when the point of "too much" starts? Please ignore my question if it's inconvenient to answer, I just hope uola gets the chance to comment from some point in time later as I haven't seen anything bad in the dead comments.)
birdman3131 10y ago
https://www.youtube.com/watch?v=0j74jcxSunY https://www.youtube.com/watch?v=0j74jcxSunY is a very well done talk on why this is a bigger and much harder issue than it appears on the surface.
- andreis_ 10y ago
  Thank you, I was wondering where I knew this guy from: https://www.youtube.com/watch?v=mCSUmwP02T8 https://www.youtube.com/watch?v=mCSUmwP02T8 To be sorta on topic, I lived in many countries and I had to get used to people mangling my name in the most creative ways. As long as there is some form of ID or customer reference, I don't care.
- Sean1708 10y ago
  But specifically in the case of entering a name into a form, shouldn't a SQL database be able to handle arbitrary UTF-8 text when used correctly?

by ergl 10y ago

lmm 10y ago

Sites don't (or at least shouldn't) have any obligation to serve everyone. Most people are content to render their name in plain ASCII. How much extra are you willing to pay to be able to use those symbols? Or do you expect everyone else to subsidize you?

atomwaffel 10y ago
Certainly, most websites have no obligation to serve me as a customer, but if they tell me that my name is "invalid", they shouldn't be surprised if I take my custom to a competitor who isn't quite so rude. But you seem to be missing the fact that "Gijs in 't Veld" is perfectly valid Ascii, as would be names like "O'Leary" or "O'Reilly" that are perhaps more common in the English-speaking world.
- candu 10y ago
  And some websites, such as government portals to various departments and services, do have implicit (and often even explicit) obligations to serve everyone. I wonder how well GP would take it if, say, the IRS webpay or DMV sites (or their equivalent wherever GP happens to live) balked at their name.
  - atomwaffel 10y ago
    Yes, government services was what I thought of when I wrote "most websites". Then again, I feel like those tend to be the worst user experience offenders (which is what this comes down to). It took me several attempts to mangle my home address into something the US visa application form would accept and I've seen ö turned into Ã¶ on my own country's official websites so many times that I can remember the mojibake. I wonder why that is. I guess part of the reason is that government doesn't need to invest heavily in UX because there is no threat of people going elsewhere – when you need a passport, you need a passport, and you're not going to order one from Amazon. In fact, there's probably a disincentive for government to continuously improve their UX precisely because any changes to a system that's in place and working well enough only cost them money. Are there any counterexamples of government websites that offer good user experience?
    - bzbarsky 10y ago
      The tax e-filing system in Massachusetts is a government website that offers a quite good user experience. It could be a bit better (e.g. it could save your general W-2 info from year to year on the assumption that you probably didn't change employers), but it's fairly nice in most ways; the W-2 thing is the only problem I've run into with it, and it has a fairly clear UI. Especially given the complexity of the actual paper MA tax forms. On the other hand, the MA website where you pay things like unemployment insurance for your employees is terrible, complete with being offline outside of normal business hours (because afaict they take it offline while they do batch imports from physical media that companies send them). Note that this is not as much of a "voter-facing" website, of course. ;)
  - bzbarsky 10y ago
    The DMV in Massachusetts can't handle a space in a last name. They convert it to a dash instead. As a result, I know several people who have different names on their passport and their driver's license, simply because the computer system at the DMV is broken.
dguaraglia 10y ago
Actually, most 'injection' issues happen because of poor programming practices (not sanitizing input, not escaping SQL parameters, etc.) and not because databases don't support Unicode characters. It's not the OP or the grandparent's fault for not having a "nice-to-shitty-programs" name.
- lmm 10y ago
  Sure, but poor programming practices come down to cost like anything else - whether they're due to low-quality programmers, lack of training, poor management or whatever. No-one is deliberately choosing to make their site worse.
  - dguaraglia 10y ago
    True. Hiring better programmers is more expensive, but in the case of vulnerabilities the long-term cost of not doing the right thing are probably higher than the upfront cost of hiring someone more qualified. The original tweet, for example, reeked of crappy hand-crafted PHP code. Pretty much any web framework, even PHP ones, wrap bare exceptions like that into a proper 500 error with no information about the underlaying system. How long will it take for someone to put two and two together (MariaDB, no escaping of user input, a users table of some sort) and come up with a SQL injection that exposes all the password hashes for that website?
ranko 10y ago
"Most" people? Are you sure? There are over a billion and a quarter Chinese people for a start.
wtetzner 10y ago
> How much extra are you willing to pay to be able to use those symbols? It shouldn't cost anything extra to use those symbols in a name. In fact, it should be cheaper, because they won't have to do checks on the input to determine if it's "valid". Just store and display the name using UTF-8 and be done with it. No, sites don't have any obligation to serve everyone, but in the same way, potential customers have every right to criticize the site and it's poor implementation.
markbnj 10y ago
Oh please, that's ridiculous. It is not "extra work" to handle all the legal characters in your input, and it is also not "extra work" to handle errors server side and not blindly render them to the page. This is just amateur hour.
sp332 10y ago
If it's too much work to acquire a customer, your business model has already failed.

mc32 10y ago

Some trivia. "Ñ" is/was a shorthand for "nn" or "nh". Basically some lazy monks didn't want to write out a full extra letter.

acqq 10y ago
You can then say that all character sets are shorthand for pure binary codes. Just if your language doesn't use it it doesn't mean it's still "just a shorthand."
- uola 10y ago
  Well, to some limit. I run into chinese form all the time that doesn't accept more than 10 characters. PS. Thank you for reposting my comment comment in an earlier thread [0], but it's not that I've been flagged, I've been hellbanned [1]. This is how "hacker" news threats it contributing members with another perspective. And yes, I do know what I'm talking about, because I'm in China. But no, not Chinese. Enjoy the timewasting. [0] https://news.ycombinator.com/item?id=11675395 https://news.ycombinator.com/item?id=11675395 [1] Turn showdead on, visit https://news.ycombinator.com/user?id=uola https://news.ycombinator.com/user?id=uola
- 0x6c6f6c 10y ago
  But what came first? I don't believe ASCII or UTF preceded the creation of the written language.
  - acqq 10y ago
    > But what came first? Ñ existed long before USA, ASCII and UTF. So nobody should think that today "Ñ" is a shorthand. ----------- (out of topic, just for moderators: hello mods, dang, why in the world is the user "uola" "hellbanned"? just because he posted too many responses? maybe he should have been informed to slow down, I know you have that feature. Is the reason is not to let know the "bots" or malicious users when the point of "too much" starts? Please ignore my question if it's inconvenient to answer, I just hope uola gets the chance to comment from some point in time later as I haven't seen anything bad in the dead comments.)

birdman3131 10y ago

https://www.youtube.com/watch?v=0j74jcxSunY https://www.youtube.com/watch?v=0j74jcxSunY is a very well done talk on why this is a bigger and much harder issue than it appears on the surface.

andreis_ 10y ago
Thank you, I was wondering where I knew this guy from: https://www.youtube.com/watch?v=mCSUmwP02T8 https://www.youtube.com/watch?v=mCSUmwP02T8 To be sorta on topic, I lived in many countries and I had to get used to people mangling my name in the most creative ways. As long as there is some form of ID or customer reference, I don't care.
Sean1708 10y ago
But specifically in the case of entering a name into a form, shouldn't a SQL database be able to handle arbitrary UTF-8 text when used correctly?