9 ms·
The Big List of Naughty Strings
- dhosek 6y agoI encountered an amusing instance of this recently watching my six-year-old son playing music on the kitchen Alexa. Alexa felt it was necessary to censor the name of a children’s song entitled, “Pussy Cat, Pussy Cat.”
- folkhack 6y agoSolid list for a quick SQL injection and XSS reference with lots of examples. Even unicode/accents/two-byte characters etc are super useful to check handling on all the way from the front-end to the persistent storage solution (DB, etc). Lost it laughing at "Human Injection" section: > # Strings which may cause human to reinterpret worldview > If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.
- ancarda 6y agoI know I first came across BLNS about 5 years ago because I was 20 years old when I first saw that. Suffice to say it scared the shit out of me!
- yosito 6y agoI would wake up if I could, but I opened this string in vim and I can remember how to exit.
- foresto 6y ago> Please wake up, we miss you. I think that sentence gives itself away as modern. Were comma splices in common use 20 years ago?
- frank2 6y agoYes they were. IIRC at least one of the major manuals of style endorsed them at least in some situations.
- maxfan8 6y agoThat’s interesting. Maybe it’s considered hyper correct? Which style manual are you referring to?
- frank2 6y agoDon't remember. This was 30 or 35 years ago. There was a long tradition in English and maybe also in other European languages of choosing punctuation depending on how long a pause a speaker would take at the point, with a comma denoting a shorter pause than a semicolon, which in turn denoted a shorter pause than a colon, which in turn denoted a shorter pause than a period -- instead of using punctuation to convey some semantic distinction as most writers do today. The comma splice might be a vestige of that tradition.
- gnramires 6y agoBut the pauses are semantic in a way. Those concepts cannot be well separated. Not a linguist, but I can tell pauses are used by speakers and listeners for a variety of reasons, linked with both semantics and delivery -- to separate parts, to give and demarcate "processing time" for speakers and listeners, to create and satisfy expectation, etc. The cadence of speech is semantic (though its semantics are not of a simple propositional logic type).
- cperrine 6y agoI've been curious about this sort of thing, but I haven't been able to find good info on it. For example, it seems to me that the format of "It's not x, it's y" is widely accepted. I'm not sure if that's by simple common use or by way of some nuance that I'm not aware of. Certainly in some cases it can be difficult to avoid both comma splices and sounding stilted. I'd love to know more -- I don't seem to recall anything about it from when I had a copy of the Chicago Manual of Style.
- niklasbuschmann 6y agoThis messes with my mind
- Konohamaru 6y agoThat was a bastardization of the original one on 4chan's /x/. This one is the real one: > It has been reported that some victims of torture, during the act, would retreat into a fantasy world from which they could not WAKE UP. In this catatonic state, the victim lived in a world just like their normal one, except they weren’t being tortured. The only way that they realized they needed to WAKE UP was a note they found in their fantasy world. It would tell them about their condition, and tell them to WAKE UP. Even then, it would often take months until they were ready to discard their fantasy world and PLEASE WAKE UP.
- yakshaving_jgt 6y ago> This one is the real one Are you sure? I think this idea has been explored in several novels and films over the past several decades.
- dejj 6y agoNever seen it before on film. The Manchurian Candidate isn't it. Can you give me some pointers?
- yakshaving_jgt 6y agoDoesn’t The Matrix explore this idea?
- rsecora 6y agoWake up, Neo... The Matrix has you...
- deleted 6y ago[deleted]
- james-skemp 6y agoSee also Ghost in the Shell 2: Innocence. There's a lot of hacking going on in that one leading to some very interesting scenes. Granted, they're not comatose, but the sensations their minds are receiving do not match reality.
- Timpy 6y agoIm reading Permutation City right now and that message is really messing with my head
- monax 6y agoYup, can't view the file using the GitHub app for Android
- minimaxir 6y agoOut of curiosity, what happens when you try to do so?
- Johnjonjoan 6y agoSomething went wrong <button>TRY AGAIN<button> Edit: as far as I could see it's only opening blns.txt that causes this error the other files are fine in the app.
- toolslive 6y agohttps://github.com/minimaxir/big-list-of-naughty-strings/blob/master/naughtystrings/internal/resource.go#L1228 https://github.com/minimaxir/big-list-of-naughty-strings/blo... just lovely ;)
- duggable 6y agoThis one got me: > "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you." Strangely terrifying....
- willismichael 6y agoThe question is, which one of us is the message meant for?
- was_boring 6y agoWho says it's only meant for one?
- bryanrasmussen 6y agothe real question is: Inception. Can it be done?
- naniwaduni 6y agoWhy would there be more than one of you?
- chris_wot 6y agoStrongly advise not using cat on the list, you will get beeped at.
- fareesh 6y agowould that be considered animal abuse :D
- afandian 6y agoThis is deiciously ironic: > Also, do not send a null character (U+0000) string, as it changes the file format on GitHub to binary and renders it unreadable in pull requests.
- Seb-C 6y agoFor long I had the same problem with Japanese language files being shown as binary in the GitHub diffs, and it is solved by having something like this in the .gitattributes file *.php diff Overall I am amazed that everything shows properly in GitHub. https://github.com/minimaxir/big-list-of-naughty-strings/blob/master/blns.json https://github.com/minimaxir/big-list-of-naughty-strings/blo...
- 13415 6y agoI don't quite understand the purpose of this list. It contains potentially malicious input, but also emoticons based on Unicode characters that are completely harmless and used in every second post on Reddit.
- kube-system 6y agoI think the purpose is to run these strings through your inputs and make sure it doesn’t behave in unexpected ways.
- minimaxir 6y agoI made the list while I was a Software QA Engineer at Apple, since there were a bunch of fun Unicode strings causing particular issues there, which gave me the idea.
- Dylan16807 6y agoThere's a lot of ways to mishandle unicode. Checking that non-BMP characters work, that emojis in various sections work, and that emojis with modifiers work are all good tests.
- MauranKilom 6y agoIt's essentially a test suite for character encoding all throughout your application. If you input all those strings (e.g. send chat message) and they arrive incorrectly at some other end (e.g. other user receiving chat message) then there's a problem somewhere.
- 13415 6y agoThat makes sense. Thanks a lot! Of course, it's very useful for testing. I erroneously assumed it was for input validation.
- toomanybeersies 6y agoIt's useful for testing a variety of things that take text/string inputs, such as forms in web applications. It's a handy tool for testing a site (preferably one you have permission to test) for XSS or SQL injection, character encoding problems, or even just form length problems.
- harunurhan 6y agoOK, seeing "﷽" [1] was unexpected :). For those who does not know, it's very important for muslims and It's all over the Quran [1] https://github.com/minimaxir/big-list-of-naughty-strings/blob/9c25300f66fd968ad863412608025908c8aa5efd/naughtystrings/internal/resource.go#L899 https://github.com/minimaxir/big-list-of-naughty-strings/blo...
- cheez 6y agowhat does it mean?
- ctdonath 6y agohttps://www.urbandictionary.com/define.php?term=%EF%B7%BD https://www.urbandictionary.com/define.php?term=%EF%B7%BD Fun fact: it’s a single Unicode character.
- atomwaffel 6y agoYup, you can put 280 of it into a single tweet.
- robinhouston 6y agoI don’t think that’s right. I looked into the way Twitter counts characters when I was trying to work out the largest prime number that could be written out in full, in base ten, in a single tweet[1]; the rules are more complicated than you might expect, and have changed several times. The current rule seems to be that all Unicode characters count as two, except for the ranges 0–4351, 8192–8205, 8208–8223 and 8242–8247 which count as one. [1] In case you’re wondering, I think it’s, arguably: https://twitter.com/robinhouston/status/1197294154738544641 https://twitter.com/robinhouston/status/1197294154738544641
- atomwaffel 6y agoGood point! Still, I could swear I saw someone (@FakeUnicode?) do exactly this once, but of course I can’t find that tweet any more, partly because it turns out that search engines don’t handle ﷽ well at all, and I don’t feel like testing it on my own followers somehow. Edit: it looks like it might count it as two characters, so that’s only 140 per tweet.
- montroser 6y agoAlmost related: https://github.com/LDNOOBW/List-of-Dirty-Naughty-Obscene-and-Otherwise-Bad-Words https://github.com/LDNOOBW/List-of-Dirty-Naughty-Obscene-and...
- jzl 6y agoHilarious, but also important!
- dorgo 6y agoWhat? only 151 russian words? The russians have an own dedicated sub-language which consists solely out of bad words. No idea or concept is too complicated to be expressed in bad words alone. They switch from normal russian to bad words russian as soon as the situation allowes it.
- egypturnash 6y ago[citation needed], please, I wanna read about this beautiful gem of a sub-language! All I can find with some quick searching is Wikipedia's page on 'mat'[1], which seems to be pretty similar to Carlin's list of Seven Words You Can't Say On TV[2] rather than an entire language of vulgarity. 1: https://en.wikipedia.org/wiki/Mat_(Russian_profanity) https://en.wikipedia.org/wiki/Mat_(Russian_profanity) 2: https://en.wikipedia.org/wiki/Seven_dirty_words https://en.wikipedia.org/wiki/Seven_dirty_words
- owl57 6y agoUnusual richness of bad Russian words is, I believe, mostly a myth from our stand-up comedians based on the loose facts that (1) there's not one central f-word, but several equally important roots, and (2) technically a lot of Russian words can correspond to one English word due to heavier use of prefixes ("fuck off" is written without whitespace in Russian).
- egypturnash 6y agoDamn, I was suspecting something like that was the case from reading the WP pages I linked to and some of the ones they reference! Handing my SO an article about the intricate sub-language of Russian invective would have been a PERFECT piece of flirtation. (Yes we are nerds.)
- Udik 6y ago. . . . . . ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ Wow, what's this? :)
- EvanAnderson 6y agoIt reminds me a little bit of Feynman diagrams.
- majewsky 6y agoLayers upon layers of combining diacritics.
- nwallin 6y agoHave you tried using regular expressions to parse HTML? https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454 https://stackoverflow.com/questions/1732348/regex-match-open...
- peteretep 6y agoThai tone marks. On my browser they’re spaced out using a dotted circle, as you should really only ever have one per character
- jzl 6y agoAlso tangentially related: the big list of usernames that should be disallowed in any online system: https://github.com/forwardemail/reserved-email-addresses-list https://github.com/forwardemail/reserved-email-addresses-lis...
- DominikPeters 6y agoUgh, that list might be why my email address mail@[personal domain] is forbidden more and more often.
- Mandatum 6y agoI use a catch-all and mark some handles as spam once a website has been hacked, or the email has been caught by spammers. I trust you've probably adopted a similar workaround for problem websites. For throwaway websites (where I use a password I have no intention of keeping track of), I often sign up as "spam@domain".. This is surprisingly blocked in a lot of instances.
- owenmarshall 6y agoThis looks overly opinionated: I can’t have co-op but I could have accounting? I’d rather see a list with justifications.
- chucksmash 6y agoInteresting that "zuck" is disallowed.
- CGamesPlay 6y agoWhy would they disallow every language name? This list says it's for "security concerns"... are they trying to curb social engineering by just disallowing words? [append] Hmm, I guess this list should be declared as "should not be allowed to be created by users of SHARED email hosts".
- dang 6y agoSee also: 2018 https://news.ycombinator.com/item?id=18466787 https://news.ycombinator.com/item?id=18466787 2017 https://news.ycombinator.com/item?id=13406119 https://news.ycombinator.com/item?id=13406119 Show HN from 2015: https://news.ycombinator.com/item?id=10035008 https://news.ycombinator.com/item?id=10035008
- gerdesj 6y agoJimmy Clitheroe - the Clitheroe Kid. That brings back some memories. It's also nice to see that England is suitably represented in the place names, obviously Scunthorpe is the classic. I'll tender Somerset for first amongst equals for daft and downright odd place names.
- gitnewbie 6y agoThe latest commit message of README is "Merge branch 'master' into master" [1]. As someone who doesn't do git, what does that even mean? Does git allows multiple branches with same names? [1]: https://github.com/minimaxir/big-list-of-naughty-strings/commit/84c8b77529dfdfaf3d28d597681dff5f633aa91b https://github.com/minimaxir/big-list-of-naughty-strings/com...
- kenhwang 6y agoUsually it means they merged 'origin/master' with their local 'master'. Git is distributed, so everyone can have their own copy of the same branch.
- colinchartier 6y agoThe GitHub flavor of git essentially has two parts: Repository (i.e., minimaxir/big-list-of-naughty-strings), and branch (i.e., master) In this case, someone merged eliabieri/big-list-of-naughty-strings at master to minimaxir/big-list-of-naughty-strings at master via a pull request [1]. [1] https://github.com/minimaxir/big-list-of-naughty-strings/commit/eec4732aac0d42107e1cc3701cc4a8be7ff351de https://github.com/minimaxir/big-list-of-naughty-strings/com...
- hunter2_ 6y agoNeat. I recently found that googling the Japanese Post Office emoji results in a totally borked SERP (cross-browser, desktop, including desktop mode on Android Chrome). I assume there are other characters as well.
- bloody-crow 6y agoWe need a similar list of weird unconventional emails to make sure every new registration form won't erroneously reject a valid email. The number of times I get validation errors or some unexpected crashes when I enter my fairly pedestrian email with + sign in it... Jeez.
- bullen 6y agoI just do: .matches("[a-zA-Z0-9.\\-]+") And prepared statements or my own NoSQL.