5 ms·

This is an awful idea that conflates country and language and adds another place where governments can marginalise minorities. Should administrators of north A

This is an awful idea that conflates country and language and adds another place where governments can marginalise minorities. Should administrators of north African tlds be empowered to forbid Tifinagh characters? Which character sets should be permitted in the .US tld? The general principal of all ascii or all something else is not bad though. It would prevent certain homograph spoofs.

vostok 9y ago
I'm not sure it would help that much. For example pop.ru and рор.ru look identical to my eyes in my current font.
- baby 9y ago
  same thing with google.com and google.com
- frobozz 9y ago
  Yes it's not bad but not great either. It would only help in certain situations (hello vs Ꮒello). It also becomes tricky if you permit Turkish, as you would have to allow mixing of ascii and the dotted vs dotless i. There are also good reasons to mix language in a name. US state abbreviations might be used to distinguish (e.g.) a diaspora community in Texas from their equivalent in Alaska.
  - rspeer 9y ago
    Dotted and dotless i is a different issue, related to capitalization. Those are still Latin letters. Of course to support most European languages you have to be able to use ASCII and non-ASCII Latin letters together. That's not unique to Turkish. Think of the Spanish word "cañon", for example. It's not four English letters and one Spanish letter, it's just five Latin letters (four of which are in ASCII).
    - frobozz 9y ago
      There is a difference between ı and i in both cases. I don't know what you mean by 'related to capitalisation' The reason I raise Turkish specifically is that the similarity between the characters presents a potential homograph for a phishing attack in non-Turkish domains. (e.g. mıcrosoft.com). Characters with apparent diacritics are less vulnerable (e.g. öracle.com).
- rspeer 9y ago
  There was an example where еріс.com (whose domain is in the Ukrainian Cyrillic alphabet, and I think would be pronounced like "eris dot com") once got a security certificate that would be visually indistinguishable from one for epic.com. This was, thankfully, intended by its creator to demonstrate the vulnerability. The certificate has expired now, and additionally, browsers now show it as https://www.xn--e1awd7f.com/ https://www.xn--e1awd7f.com/ . Even HN rewrites it if I type it as a full URL in Unicode, actually.
jgalt212 9y ago
I would say yes, otherwise we're stuck with enumerating and testing innumerable edge cases.
mandelbulb 9y ago
Uh, you can just do two things. Prohibit mixing of character blocks. That is sane and would prevent many incidents. Edit: As for homoglyph bundles, you just have to do it like EURid and create tables. But the main protective layer would be the user interface, similar to how HTTPS is handled, either descriptively, with warning colors or both.

vostok 9y ago

I'm not sure it would help that much. For example pop.ru and рор.ru look identical to my eyes in my current font.

baby 9y ago
same thing with google.com and google.com
frobozz 9y ago
Yes it's not bad but not great either. It would only help in certain situations (hello vs Ꮒello). It also becomes tricky if you permit Turkish, as you would have to allow mixing of ascii and the dotted vs dotless i. There are also good reasons to mix language in a name. US state abbreviations might be used to distinguish (e.g.) a diaspora community in Texas from their equivalent in Alaska.
- rspeer 9y ago
  Dotted and dotless i is a different issue, related to capitalization. Those are still Latin letters. Of course to support most European languages you have to be able to use ASCII and non-ASCII Latin letters together. That's not unique to Turkish. Think of the Spanish word "cañon", for example. It's not four English letters and one Spanish letter, it's just five Latin letters (four of which are in ASCII).
  - frobozz 9y ago
    There is a difference between ı and i in both cases. I don't know what you mean by 'related to capitalisation' The reason I raise Turkish specifically is that the similarity between the characters presents a potential homograph for a phishing attack in non-Turkish domains. (e.g. mıcrosoft.com). Characters with apparent diacritics are less vulnerable (e.g. öracle.com).
rspeer 9y ago
There was an example where еріс.com (whose domain is in the Ukrainian Cyrillic alphabet, and I think would be pronounced like "eris dot com") once got a security certificate that would be visually indistinguishable from one for epic.com. This was, thankfully, intended by its creator to demonstrate the vulnerability. The certificate has expired now, and additionally, browsers now show it as https://www.xn--e1awd7f.com/ https://www.xn--e1awd7f.com/ . Even HN rewrites it if I type it as a full URL in Unicode, actually.

jgalt212 9y ago

I would say yes, otherwise we're stuck with enumerating and testing innumerable edge cases.

mandelbulb 9y ago

Uh, you can just do two things. Prohibit mixing of character blocks. That is sane and would prevent many incidents. Edit: As for homoglyph bundles, you just have to do it like EURid and create tables. But the main protective layer would be the user interface, similar to how HTTPS is handled, either descriptively, with warning colors or both.