13 ms·
Buying a single character domain – and 3 character FQDN – for £15
- beeforpork 6y agoWhat about ﷺ ? Arabic letters in domains should be OK, right? It decomposes into a lot(!) of characters.
- edent 6y agoIt does - but DNS is still limited to ASCII. So those characters would go through Punycode. I'm not sure if the browser would decompose it though.
- sp332 6y agoHere are the rules for the .sa TLD https://www.iana.org/domains/idn-tables/tables/man_ar_1.0.txt https://www.iana.org/domains/idn-tables/tables/man_ar_1.0.tx... I suppose other TLDs could have different rules. But in general you'd want to have a canonicalization step so you don't have two domains that are just different ways of composing the same thing.
- deleted 6y ago[deleted]
- jpxw 6y agoIs the other character you hint at ㎉?
- edent 6y agoYes!
- as1mov 6y agoThe more I learn about text representation and Unicode, the more it looks like a complete clusterfuck, and it boggles my mind that somehow all this works almost perfectly while hiding all the complexities from the end user. I suppose this is inevitable when you tasked with representing literally every symbol in existence. You couldn't pay me enough to touch this problem with a ten foot pole (this and text rendering).
- x3haloed 6y agoUsually it works perfectly. Sometimes it doesn’t. I’m occasionally stunned by how such a fundamental thing as text representation can be ruined by obscure encoding issues. For example, there is absolutely no way to be certain of the character encoding scheme of binary string data unless it is stored as metadata somewhere. Unicode attempts to solve this with the Byte Order Marker. If present, we can know that a string is unicode-encoded, and whether it’s big-endian or little-endian. However, the BOM is optional, and so it’s not known for sure if a string is Unicode. One example of how this is a huge clusterfuck is that until recently, Windows Notepad opened and saved everything with the Win-1252 encoding scheme (labeled as ASCII in the app). The web, and the other popular OSes, on the other hand, are standardized around UTF-8. So if you download a txt file from the web or OS without a BOM, and you open it in Notepad, you can get characters that looked right in your browser, but not in Notepad. There are smart algorithms out there that can detect character encoding pretty well, but none of them are perfect (as far as I know). The Win-1252 default and the fact that most computer users have no idea about character encoding have caused all sorts of headaches for me with the reporting software I work on.
- FabHK 6y agoI wouldn't call that an obscure encoding issue, but an absolutely fundamental one. Absent meta information, you can never be sure that some text (or actually any data) is in a specific encoding (at best, you can be sure that it is not in some specific encoding). As an (indirect) illustration, see polyglots (programs that are valid programs in multiple programming languages simultaneously): https://en.wikipedia.org/wiki/Polyglot_(computing) https://en.wikipedia.org/wiki/Polyglot_(computing)
- JimWestergren 6y agoI own n.nu - is that the shortest domain possible?
- exlurker 6y agoIsn't i.nu a little narrower, at least?
- nacs 6y agoWe only use monospace fonts around these parts
- shakna 6y agohttps://dk https://dk I think there might be one or two other domains that have a host as well. But beating two letters is difficult.
- jsjohnst 6y agoI also own a four character domain too, but the domain part is a single Unicode character and HN seems to strip it from text here. The punycode version is xn—x6h.ws
- XaspR8d 6y agoIronically, something has autosubstituted an em dash "—" for your original double hyphens...
- Thorrez 6y agohttp://xn--x6h.ws http://xn--x6h.ws Recycling Symbol for Type-4 Plastics
- jsjohnst 6y agoYep! I chose it as the domain’s total character length is 4 (when visible in a browser obviously, not in punycode form) and the recycling symbol felt appropriate for url shortening. I hosted it on Bitly (hence you see a Bitly landing page if the short url doesn’t exist). I don’t use it as much anymore because of the previously mentioned Unicode filtering some sites use, like HN.
- jpxw 6y agoTechnically, the shortest domain name is 2 letters: http://dk http://dk
- deleted 6y ago[deleted]
- RyJones 6y ago.va used to have an SMTP server.
- wincent 6y agoChrome won't load that without the trailing dot: http://dk http://dk.
- AnssiH 6y agoLoads fine for me without dot in Chrome (tested on Linux and Android).
- edent 6y agoOh! Now that's nifty. How long have they had that?
- keb_ 6y agoDONKEY KONG
- aapeli 6y agoAlso http://ai./ http://ai./ which doesn't redirect you anywhere.
- snthd 6y agoIs http:// http://. possible?
- unicodepepper 6y agoApparently it is possible to do it with local DNS resolution, using your hosts file Not sure how possible it would be on a remote DNS server, or whose authority you'd need to actually do it. [root@host ~]$ curl -v http:// http://. * About to connect() to . port 80 (#0) * Trying 127.0.0.1... * Connected to . (127.0.0.1) port 80 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.29.0 > Host: . > Accept: / > < HTTP/1.1 400 Bad Request < Date: Sat, 15 Aug 2020 15:38:54 GMT < Server: Apache < Content-Length: 347 < Connection: close < Content-Type: text/html; charset=iso-8859-1 < <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>400 Bad Request</title> </head><body> <h1>Bad Request</h1> <p>Your browser sent a request that this server could not understand.<br /> </p> <p>Additionally, a 400 Bad Request error was encountered while trying to use an ErrorDocument to handle the request.</p> </body></html> * Closing connection 0
- mcherm 6y agoCongratulations -- that's a really clever hack. Exactly the kind of thing I love to read about on this site.
- Arkdy 6y agoYou can use emoji with a .to domain. Does that count?
- he991z 6y agoI tried opening viii.fi (no special characters), and that also directs to this website. How did that happen?
- dmd 6y agoThat browser behavior is literally the entire point of the article!
- 1f60c 6y agoPlease keep the guidelines[0] in mind when posting and commenting. Thanks. [0]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- jrochkind1 6y agoCause `viii.fi` is indeed what OP registered. They are counting on browsers to turn `Ⅷ.fi` into `viii.fi` before resolving, by running `Ⅷ.fi` through a unicode denormalization routine first. That may be a standard thing to do with unicode in domain names, run it through the standard unicode denormalization first? Understanding what browsers are "supposed" to do with unicode in domain names (and URLs generally) is very confusing for me. I would be curious to learn more about what standards govern how browsers handle unicode in domain names, the history of it, how compliant browsers are, etc. I also don't entirely understand the goal here -- the original `Ⅷ.fi` isn't actually only two bytes in any encoding... what is the value of having something that shows up as two "glyphs" even though it's more bytes and denormalizes to something else with a yet different number of bytes?
- JoshTriplett 6y agoSome sites limit the number of bytes of input. Some sites limit the number of Unicode characters of input. For instance, Twitter's 280-character (formerly 140-character) limit is Unicode characters, not bytes.
- jfk13 6y agoFor your weekend reading pleasure: Internationalized Domain Names (IDN) FAQ (https://unicode.org/faq/idn.html https://unicode.org/faq/idn.html) Unicode® Technical Standard #46: UNICODE IDNA COMPATIBILITY PROCESSING (https://www.unicode.org/reports/tr46/ https://www.unicode.org/reports/tr46/) Internationalized Domain Names for Applications (IDNA): Background, Explanation, and Rationale (http://tools.ietf.org/html/rfc5894 http://tools.ietf.org/html/rfc5894) Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework (http://tools.ietf.org/html/rfc5890 http://tools.ietf.org/html/rfc5890) Internationalized Domain Names in Applications (IDNA) Protocol (http://tools.ietf.org/html/rfc5891 http://tools.ietf.org/html/rfc5891) The Unicode Code Points and Internationalized Domain Names for Applications (IDNA) (http://tools.ietf.org/html/rfc5892 http://tools.ietf.org/html/rfc5892) Right-to-Left Scripts for Internationalized Domain Names for Applications (IDNA) (http://tools.ietf.org/html/rfc5893 http://tools.ietf.org/html/rfc5893)
- wyxuan 6y agospeaking more maliciously about unicode, I know that there are ways to attack the domain names, for example replacing the o in Google with a cyrillic o or some other character that looks like o for the purposes of phishing.
- dahfizz 6y agoYou seem to use "character" and "codepoint" interchangeably, but its important to note that you are not saving on bytes. You mention this can be used to avoid filters, so I guess this is specifically to trick "string".length?
- edent 6y agoYou are quite right. Ⅷ in UTF-8 is 0xE2 0x85 0xA7 That's still shorter than V I I I though.
- tyrion 6y agoIt's not as hard or expensive as you say to find two characters domains on two characters TLDs. You may want to do some better research. Hint: search on hn.algolia for "short domain names" :)
- bugmen0t 6y agoIf you go search regularly, there are some cheap two-dot-two you’ll find that are ascii. Bit longer in string length but shorter on the wire. I own 0e.vc, which is on GitHub as a general purpose xss domain if you need it. Iirc it does eval(window.name), or location.hash. Whatever works for you. It’s also on the public suffix list which makes it almost like a top level domain for security purposes. So I can have subdomains that can’t ever share cookies :-))
- zjs 6y ago> It’s also on the public suffix list A bit of a tangent, but: how and why?
- bugmen0t 6y agoHow: File an issue at https://github.com/publicsuffix/ https://github.com/publicsuffix/ Why: It's fun. Also, web Security testing gets easier when you have can make pages for all likely and unlikely scenarios (cross-site/domain/origin).
- Y_Y 6y agoSearch manually, or is there a tool?
- Y_Y 6y agoFound one myself: https://ahreflink.com/domains/two-letter https://ahreflink.com/domains/two-letter Seems there are plenty available.
- YoureNotDang 6y agoState your authority or go out like Cartman you imposter. Shitty mod name if I have seen any. Or complete lack of distribution of time. Civil-modding is fucling retarded. I bet your browser pays you 1300$ after tax for this.
- AndyMcConachie 6y agoIt's not clear what domain he actually registered. xn--jxb.fi would appear to be unregistered. (U+2167) (U+002E) (U+FB01) is not a valid domain name. viii.fi (all ASCII) is registered, and the registrar is gandi. But so what? I don't get it.
- edent 6y agoHi Andy. I'm OP. As you spotted, I registered v i i i. fi with Gandi. When your browser see the Ⅷ character, it performs the IDNA2008 process listed in RFC5895 to normalise it. The same thing happens in OS tools like dig and ping. Hope that makes a bit more sense.
- dom96 6y agoYeah, I read the article and just now went back and read the Minimal Viable XSS article linked as well. I am also rather puzzled. This seems to be only useful if you manage to find a website with an XSS flaw and one that also limits the input to 20 characters? Are these situations really common enough to warrant this attack? It all seems rather arbitrary to me.
- edent 6y agoI'm a rather amateur bug hunter but, yes, some sites do use string length limitations as a way of filtering out dodgy code. They shouldn't - but they do. (See https://www.openbugbounty.org/researchers/edent/ https://www.openbugbounty.org/researchers/edent/)
- chrismorgan 6y agoI must quibble on points of technical precision (because otherwise the article is both amusing and interesting): the title is pretty much entirely incorrect. I’ll pick on the FQDN part first, because it’s the (only) part that is unequivocally wrong. FQDN is a very specific technical term in the domain name system. A fully qualified domain name includes a trailing dot, so Ⅷ.fi. would be four characters, even if Ⅷ and fi were the actual labels. But they’re not: DNS is strictly ASCII-only, so this normalisation is happening at a higher level (as the OP notes in another response here, tools are applying IDNA2008, per RFC5895). The FQDN is viii.fi., which is eight characters long. Next I deny the claim that it’s a single-character domain. Perhaps I’m getting petty here, but even if people do colloquially speak of example.com as a six-letter domain, counting only the label at the level you register the domain, so that I would grudgingly allow Ⅷ.fi to be considered a single character domain (per proletariat vernacular), the domain name that was “bought” was not that, but viii.fi, which is a four-letter domain. Hair splitting is fun. But my pettiness knows no bounds. Domain names aren’t bought, they’re registered for such-and-such an amount per annum. And I bet it wasn’t exactly £15.00 that was paid. :-) ——— I went thinking about other TLDs that would work, and ℡ (TEL → .tel) and № (No → .no) occurred to me off the top of my head. Haven’t seen a .tel domain name in yonks. I never did quite see the point of .tel.
- edent 6y agoI appreciate your pettiness! I have edent.tel I also have a list of tld which can be shortened by this process. https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-unicode-characters/ https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-u... And, yes, £15.30. But let's not quibble :-)
- chrismorgan 6y agoHuh! That’s probably the most serious use of .tel that I’ve ever seen. Well done. :-)
- nwellnhof 6y agoThe explanation in your blog post isn't quite correct. The conversion of "Ⅷ" to "VIII" happens when Unicode text is normalized using a "compatibility" mapping, that is normalization forms NFKC or NFKD, not when text is lowercased. While IDNA2003 required a custom mapping based on NFKC, IDNA2008 doesn't specify a mapping phase. It does allow custom mappings, though, and it seems that browsers apply NFKC at some point in the process. See https://unicode.org/reports/tr46/#Mapping https://unicode.org/reports/tr46/#Mapping
- dweekly 6y agoFor brevity and wit, the most impressive email address I ever saw was up@3.am - and the most impressive website was http://ws./ http://ws./ Sadly, ws. is not serving right now it seems - I had no idea root ccTLDs could vend an A record but there you go; I guess technically that means the root servers themselves could vend A records, which would let you have the ultimate website at http://./ http://./
- macintux 6y agoA friend of mine, Garrett Smith, has g@rre.tt, which always impressed me. I’m still waiting for someone to launch a .ux domain so I can grab macint.ux
- chrismorgan 6y agoTwo letter TLDs are reserved for country codes (ccTLD), so barring policy change and ignoring minor subtleties in the actual rules, .ux will only happen if a new country comes around and gets assigned the ISO 3166-1 alpha-2 country code “ux”. A more probable course of events would be “tux” being registered as a new gTLD.
- dweekly 6y agoWell, for the low low price of $185k and a bunch of paperwork you could be the proud new owner of .tux: https://newgtlds.icann.org/en/applicants/agb/guidebook-full-04jun12-en.pdf https://newgtlds.icann.org/en/applicants/agb/guidebook-full-... As it looks like that TLD is not currently issued: https://data.iana.org/TLD/tlds-alpha-by-domain.txt https://data.iana.org/TLD/tlds-alpha-by-domain.txt
- macintux 6y agoI oft rue my failure to be vastly wealthy.
- judge2020 6y agohttp://ai./ http://ai./ as well
- deleted 6y ago[deleted]
- rakic 6y agoHow about $12, like https://ꑮ.com https://xn--bj8a.com or ꑮ.com (which currently resolves in Safari on macOS and iOS only).
- jagged-chisel 6y agoAlso resolves in Firefox on macOS
- mahathu 6y agoThis is a cool looking website, but I don't think I'd ever use their service without knowing the people behind it or even where their office is located. Also I believe without an imprint this site is not GDPR compliant. The domain resolved for me in Chrome on macOS though!
- jpxw 6y agoClicking this link crashes my HN client on iOS
- mdpye 6y agoI can highlight the domain and open fine in Firefox on android. It doesn't render as the unicode glyph in the address bar after resolution though
- askvictor 6y agoResolves and loads fine on Firefox and Chrome on Windows 10
- Ndymium 6y agoNote that you are responsible for checking some company and trademark registers for clashes with existing names before registering a .fi domain. With a quick check there is at least one trademark close enough that it could theoretically cause you a headache, though I doubt they care. My brother's old .fi domain was taken by a company with the same name (because they have priority) and they didn't even do anything with it...
- dividedbyzero 6y agoWhere do you check for such things?
- Giorgi 6y agoIs there list somewhere which symbols decompose into characters? (other than that 4 character symbol example)
- fegu 6y ago4 character names were readily available when Norway eased regulations. I bought a couple just last year when (.no) opened for 2-letter domains. Some are still available, I believe.
- wartijn_ 6y agoDo you do anything with them or are you just keeping them for fun or future profits?
- lepouet 6y agoIn French, Ⅷ.fi is pronounced "wifi".
- blunte 6y agoIf you don't mind mixing one letter with one number, and then you choose a 2-letter TLD, you obviously can have a a very short and still inexpensive domain.
- maxrmk 6y agoI tried to go one character smaller, by using the combined unicode character "⒕", in an attempt to eliminate the ".". I combined it with the "ms" TLD, which can also be represented a the single character. Unfortunately all the browsers I tested refuse to treat it as a domain name without a full stop, so I'm stuck using the three character http://⑭.㎳/ http://xn--1rh.xn--ryk/ instead of the two character http://⒕㎳/ http://xn--6sh056c/ I was hoping for. On the bright side, even the three character version is unlinkable on facebook -- it just redirects me to http://invalid.invalid/ http://invalid.invalid/. I'll take that as a win. I still managed to get a pretty cool domain name for around $40, and it was definitely fun to mess around with this idea. EDIT: Interestingly, HN has automatically punycoded the URLs. That should be ⑭.㎳ and ⒕㎳
- karthik_m21 6y agoIs there any site where I could get a list of single character or a double character domain names ?