4 ms·

I've said this for years now. This is an old exploit that could be 100% preventable with ASCII-only URLs. I remember, the last time I said this here I got downv

by Kenji 10y ago

I've said this for years now. This is an old exploit that could be 100% preventable with ASCII-only URLs. I remember, the last time I said this here I got downvoted to oblivion for stating the true and obvious.

edent 10y ago
Yes, why should people from outside of a narrow few countries be able to use the web in their native language? Everyone should learn to speak English like normal people, is that what you're trying to say?
- Kenji 10y ago
  As a non-native English speaker: Yes (English is my 3rd language). There is a set of simple, clearly defined symbols (ASCII) that make up the URL. It must be like that for URLs to be ever secure. If the URL can be made of tens of thousands of symbols, some of which are completely identical, the URL will never be secure.
  - csydas 10y ago
    It also really changes how naming goes though for a lot of sites and limits the non-English speaking world to have to compete for website names in English when perfectly equivalent words exist in the native language. If a Russian upstart wants to have a simple site like зоомагазин.com or .рф they shouldn't have to compete for the name petstore.com, competing for a name that they don't use, isn't in their country even, and can't possibly be competition. Plenty of shops and and businesses here use .рф addresses alongside those that transliterate Russian to English. Limiting to just ascii characters removes options and artificially inflates the value of common and simple domain names, forcing a bidding war where there doesn't have to be one. Simple sanity checks for mixed character urls by the browser easily remedies this.
    - userbinator 10y ago
      One only has to look at things like passports, where internationally-significant naming is important, to see that English (and thus transliterated names) is the norm: https://en.wikipedia.org/wiki/Passport#Languages https://en.wikipedia.org/wiki/Passport#Languages Simple sanity checks for mixed character urls by the browser easily remedies this. Except this particular example, the name 'epic' is written entirely with Cyrillic characters. One could argue whether a Russian company has the right to use such a name (with all-Cyrillic characters), or how it would be input --- and if you want it to be easy to input for those who don't completely have IDN support and matching ways to input those characters, you'd have to also display the punycoded version, at which point a transliterated name would be better anyway.
      - deleted 10y ago
        [deleted]
      - csydas 10y ago
        I'm not sure that there really are that many full word collisions across two different alphabets. Epic versus Ерис is certainly a nice example, but how many others are there? (Also, I know there is a character that can be used to look like the latin Ii, but every time I see the и character or sound, it's always Ии, but that's not really what this is about) And honestly, I do think that Ерис.com has every right to be a site as Eric.com - it would be trivial for a browser to know whether the url was provided in latin characters or cyrillic. My point/question is more "is the issue actually words in two different character sets creating a collision or mixed alphabet collisions?" If it's the former, I'd like to see more examples to show this is a prevalent issue that wouldn't be caught by a sanity check that catches URLs with mixed character sets. (That is, how many unique words across languages are there that actually get a hit this way, in the same way Epic/Ерис do?) As for passports, I understand your point on the universal nature of English, but International passports serve a completely different purpose than a domain name. So much of the web is non-english, save the domain name for some of them, and I'm not sure why it has to be this way. If the owners want it that way, great. If they want a domain in the local language, I'm not sure why they shouldn't be allowed to. A passport is meant for a very specific set of people (border guards, law enforcement, airline and other travel employees) to be able to verify your identity. A domain name just needs to resonate with its audience. I just don't see why every business across the planet needs to compete for the same flowers.com address, or petstore.com, or cars.com. There are plenty of unique words and ways to communicate the same idea, I'm not certain why we need to restrict ourselves to English here. It just makes already expensive domain names even more expensive. If I have a club in San Francisco that I wanna call White Nights, there's no reason that a club in St. Petersburg should have to compete with me for the same name when they have their own term for White Nights, especially when the issue seems to not be about foreign character sets, but mixing character sets in the domain name. All ascii does work, but it's a grenade for an anthill. Edit: an aside, I didn't realize that Safari translates to punycode. Very cool.
- Prego 10y ago
  I'm a native Hebrew speaker. It's OK to me if internet names were all constrained to the English ASCII character set. Having a set of 10,000 characters to distinguish when your bank account is at stake is more offensive than having one line in your computer browser be in a different language.

by Kenji 10y ago

edent 10y ago

Yes, why should people from outside of a narrow few countries be able to use the web in their native language? Everyone should learn to speak English like normal people, is that what you're trying to say?

Kenji 10y ago
As a non-native English speaker: Yes (English is my 3rd language). There is a set of simple, clearly defined symbols (ASCII) that make up the URL. It must be like that for URLs to be ever secure. If the URL can be made of tens of thousands of symbols, some of which are completely identical, the URL will never be secure.
- csydas 10y ago
  It also really changes how naming goes though for a lot of sites and limits the non-English speaking world to have to compete for website names in English when perfectly equivalent words exist in the native language. If a Russian upstart wants to have a simple site like зоомагазин.com or .рф they shouldn't have to compete for the name petstore.com, competing for a name that they don't use, isn't in their country even, and can't possibly be competition. Plenty of shops and and businesses here use .рф addresses alongside those that transliterate Russian to English. Limiting to just ascii characters removes options and artificially inflates the value of common and simple domain names, forcing a bidding war where there doesn't have to be one. Simple sanity checks for mixed character urls by the browser easily remedies this.
  - userbinator 10y ago
    One only has to look at things like passports, where internationally-significant naming is important, to see that English (and thus transliterated names) is the norm: https://en.wikipedia.org/wiki/Passport#Languages https://en.wikipedia.org/wiki/Passport#Languages Simple sanity checks for mixed character urls by the browser easily remedies this. Except this particular example, the name 'epic' is written entirely with Cyrillic characters. One could argue whether a Russian company has the right to use such a name (with all-Cyrillic characters), or how it would be input --- and if you want it to be easy to input for those who don't completely have IDN support and matching ways to input those characters, you'd have to also display the punycoded version, at which point a transliterated name would be better anyway.
    - deleted 10y ago
      [deleted]
    - csydas 10y ago
      I'm not sure that there really are that many full word collisions across two different alphabets. Epic versus Ерис is certainly a nice example, but how many others are there? (Also, I know there is a character that can be used to look like the latin Ii, but every time I see the и character or sound, it's always Ии, but that's not really what this is about) And honestly, I do think that Ерис.com has every right to be a site as Eric.com - it would be trivial for a browser to know whether the url was provided in latin characters or cyrillic. My point/question is more "is the issue actually words in two different character sets creating a collision or mixed alphabet collisions?" If it's the former, I'd like to see more examples to show this is a prevalent issue that wouldn't be caught by a sanity check that catches URLs with mixed character sets. (That is, how many unique words across languages are there that actually get a hit this way, in the same way Epic/Ерис do?) As for passports, I understand your point on the universal nature of English, but International passports serve a completely different purpose than a domain name. So much of the web is non-english, save the domain name for some of them, and I'm not sure why it has to be this way. If the owners want it that way, great. If they want a domain in the local language, I'm not sure why they shouldn't be allowed to. A passport is meant for a very specific set of people (border guards, law enforcement, airline and other travel employees) to be able to verify your identity. A domain name just needs to resonate with its audience. I just don't see why every business across the planet needs to compete for the same flowers.com address, or petstore.com, or cars.com. There are plenty of unique words and ways to communicate the same idea, I'm not certain why we need to restrict ourselves to English here. It just makes already expensive domain names even more expensive. If I have a club in San Francisco that I wanna call White Nights, there's no reason that a club in St. Petersburg should have to compete with me for the same name when they have their own term for White Nights, especially when the issue seems to not be about foreign character sets, but mixing character sets in the domain name. All ascii does work, but it's a grenade for an anthill. Edit: an aside, I didn't realize that Safari translates to punycode. Very cool.
Prego 10y ago
I'm a native Hebrew speaker. It's OK to me if internet names were all constrained to the English ASCII character set. Having a set of 10,000 characters to distinguish when your bank account is at stake is more offensive than having one line in your computer browser be in a different language.