7 ms·

The first ad I saw for Crypto was an ad for Bitmain -- it flashed through my ad blocker enough for me to turn off the blocker to see it. It was Bitmain, adverti

The first ad I saw for Crypto was an ad for Bitmain -- it flashed through my ad blocker enough for me to turn off the blocker to see it. It was Bitmain, advertising a miner back in stock. Clicked it, saw it in stock, then thankfully went back to the fb comments to see someone mention it was a Punycode domain -- was a complete phishing site. There was an 'a' that was actually some other glyph that had a small, nearly pixel-sized dot that made it something other than an 'a'. I am flabbergasted at why fb would allow punycode domains (especially when the domain listed under the ad was the 'real' domain).

caust1c 9y ago
Google does the same: https://twitter.com/Caust1c/status/948680008112816128 https://twitter.com/Caust1c/status/948680008112816128
SahAssar 9y ago
If they would have the same rules as browsers this basically wouldn't be an issue. Those rules are along the lines of "don't mix character sets unless under a ccTLD for that character set". See here: https://www.chromium.org/developers/design-documents/idn-in-google-chrome https://www.chromium.org/developers/design-documents/idn-in-...
fancyfacebook 9y ago
You have pretty garbage ad blocker if it loads the ad then hides it instead of just never wasting resources to load the ad in the first place.
- y4mi 9y ago
  Some blockers are specifically created like that. Their rational is a combination of letting the website owners (who embedded the ads) get their money and hiding that they're using a blocker.
  - aclatuts 9y ago
    Do you have any examples of these types of blockers? I couldn't find any.
    - simcop2387 9y ago
      You can actually configure uBlock Origin to block like this, https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-cosmetic-filtering https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-...
  - chipperyman573 9y ago
    FWIW most (but certainly not all) ads are sold in a pay-per-click model, increasing the number of delivered ads only lines the ad network's pockets (who sells them to advertisers as pay-per-view).
  - Yizahi 9y ago
    I never was in that line of business but afaik websites pay to AD platforms per banners displayed. So looking at AD and not interacting with it in any way is a net loss for a website who placed that AD.
Faaak 9y ago
Learning dvorak and playing around with its compose key, I was amazed by the vast characters that there actually exists. For a, you also have: äāȧą I would fall for a domain like that. Sadly, you can't blacklist all punycode domains as some are legits in languages where accents are used
- cstejerean 9y ago
  So allow those for the TLDs where it makes sense. Keeping them out of .com seems like a reasonable trade off.
  - tialaramex 9y ago
    Each TLD registry is able to choose their own policy for IDN. Responsible ones all have homograph rules to avoid this issue. But what you're missing is that .com is not Main Street or the big Mall, .com is that sketchy market where you can buy anything and the operators just take a fixed fee for each stall and turn a blind eye. So the policies for .com are deliberately as lax as possible to get the most people possible paying a fee. Thus, any policies about protecting consumers, avoiding security problems, anything like that, won't come from .com and indeed it's operators will fight such things because they mean less income.
  - lmm 9y ago
    .com is supposed to be international. US-only content belongs in .us.
- viraptor 9y ago
  The decorated letters are in the easy to spot side. Check some texts on http://unicode.org/cldr/utility/confusables.jsp http://unicode.org/cldr/utility/confusables.jsp to see more extreme examples.
  - quietbritishjim 9y ago
    Wow: paypal vs 𝗉𝖺𝗒𝗉𝖺𝗅.
kuschku 9y ago
> I am flabbergasted at why fb would allow punycode domains (especially when the domain listed under the ad was the 'real' domain). The problem is that there are actual, real sites that advertise on Facebook that use Punycode domains. e.g. Bücher.de for a while did so, although now their punycode domain redirects to buecher.de they still use the brandname "Bücher.de" everywhere in their advertising. And then there's sites like Flüge.de where a competitor of them owns the non-punycode domain Fluege.de, so of course they can't stop using the punycode domain, but you also wouldn't want visitors to see the ugly punycode domain and get confused. Requiring non-punycode domains is a very anglomerican view of the web. It's as arbitrary as restricting domains to be only in hexadecimal. EDIT: I originally included links to the sites in this comment, but every time I try to edit them in, HN just responds with Error 502 - if I don't include them, everything works fine. So you'll need to copy-paste them to the URL bar

caust1c 9y ago

Google does the same: https://twitter.com/Caust1c/status/948680008112816128 https://twitter.com/Caust1c/status/948680008112816128

SahAssar 9y ago

If they would have the same rules as browsers this basically wouldn't be an issue. Those rules are along the lines of "don't mix character sets unless under a ccTLD for that character set". See here: https://www.chromium.org/developers/design-documents/idn-in-google-chrome https://www.chromium.org/developers/design-documents/idn-in-...

fancyfacebook 9y ago

You have pretty garbage ad blocker if it loads the ad then hides it instead of just never wasting resources to load the ad in the first place.

y4mi 9y ago
Some blockers are specifically created like that. Their rational is a combination of letting the website owners (who embedded the ads) get their money and hiding that they're using a blocker.
- aclatuts 9y ago
  Do you have any examples of these types of blockers? I couldn't find any.
  - simcop2387 9y ago
    You can actually configure uBlock Origin to block like this, https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-cosmetic-filtering https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-...
- chipperyman573 9y ago
  FWIW most (but certainly not all) ads are sold in a pay-per-click model, increasing the number of delivered ads only lines the ad network's pockets (who sells them to advertisers as pay-per-view).
- Yizahi 9y ago
  I never was in that line of business but afaik websites pay to AD platforms per banners displayed. So looking at AD and not interacting with it in any way is a net loss for a website who placed that AD.

Faaak 9y ago

Learning dvorak and playing around with its compose key, I was amazed by the vast characters that there actually exists. For a, you also have: äāȧą I would fall for a domain like that. Sadly, you can't blacklist all punycode domains as some are legits in languages where accents are used

cstejerean 9y ago
So allow those for the TLDs where it makes sense. Keeping them out of .com seems like a reasonable trade off.
- tialaramex 9y ago
  Each TLD registry is able to choose their own policy for IDN. Responsible ones all have homograph rules to avoid this issue. But what you're missing is that .com is not Main Street or the big Mall, .com is that sketchy market where you can buy anything and the operators just take a fixed fee for each stall and turn a blind eye. So the policies for .com are deliberately as lax as possible to get the most people possible paying a fee. Thus, any policies about protecting consumers, avoiding security problems, anything like that, won't come from .com and indeed it's operators will fight such things because they mean less income.
- lmm 9y ago
  .com is supposed to be international. US-only content belongs in .us.
viraptor 9y ago
The decorated letters are in the easy to spot side. Check some texts on http://unicode.org/cldr/utility/confusables.jsp http://unicode.org/cldr/utility/confusables.jsp to see more extreme examples.
- quietbritishjim 9y ago
  Wow: paypal vs 𝗉𝖺𝗒𝗉𝖺𝗅.

kuschku 9y ago

> I am flabbergasted at why fb would allow punycode domains (especially when the domain listed under the ad was the 'real' domain). The problem is that there are actual, real sites that advertise on Facebook that use Punycode domains. e.g. Bücher.de for a while did so, although now their punycode domain redirects to buecher.de they still use the brandname "Bücher.de" everywhere in their advertising. And then there's sites like Flüge.de where a competitor of them owns the non-punycode domain Fluege.de, so of course they can't stop using the punycode domain, but you also wouldn't want visitors to see the ugly punycode domain and get confused. Requiring non-punycode domains is a very anglomerican view of the web. It's as arbitrary as restricting domains to be only in hexadecimal. EDIT: I originally included links to the sites in this comment, but every time I try to edit them in, HN just responds with Error 502 - if I don't include them, everything works fine. So you'll need to copy-paste them to the URL bar