5 ms·

I tried opening viii.fi (no special characters), and that also directs to this website. How did that happen?

• dmd 6y ago
  That browser behavior is literally the entire point of the article!
  • 1f60c 6y ago
    Please keep the guidelines[0] in mind when posting and commenting. Thanks. [0]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
• jrochkind1 6y ago
  Cause `viii.fi` is indeed what OP registered. They are counting on browsers to turn `Ⅷ.fi` into `viii.fi` before resolving, by running `Ⅷ.fi` through a unicode denormalization routine first. That may be a standard thing to do with unicode in domain names, run it through the standard unicode denormalization first? Understanding what browsers are "supposed" to do with unicode in domain names (and URLs generally) is very confusing for me. I would be curious to learn more about what standards govern how browsers handle unicode in domain names, the history of it, how compliant browsers are, etc. I also don't entirely understand the goal here -- the original `Ⅷ.fi` isn't actually only two bytes in any encoding... what is the value of having something that shows up as two "glyphs" even though it's more bytes and denormalizes to something else with a yet different number of bytes?
  • JoshTriplett 6y ago
    Some sites limit the number of bytes of input. Some sites limit the number of Unicode characters of input. For instance, Twitter's 280-character (formerly 140-character) limit is Unicode characters, not bytes.
  • jfk13 6y ago
    For your weekend reading pleasure: Internationalized Domain Names (IDN) FAQ (https://unicode.org/faq/idn.html https://unicode.org/faq/idn.html) Unicode® Technical Standard #46: UNICODE IDNA COMPATIBILITY PROCESSING (https://www.unicode.org/reports/tr46/ https://www.unicode.org/reports/tr46/) Internationalized Domain Names for Applications (IDNA): Background, Explanation, and Rationale (http://tools.ietf.org/html/rfc5894 http://tools.ietf.org/html/rfc5894) Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework (http://tools.ietf.org/html/rfc5890 http://tools.ietf.org/html/rfc5890) Internationalized Domain Names in Applications (IDNA) Protocol (http://tools.ietf.org/html/rfc5891 http://tools.ietf.org/html/rfc5891) The Unicode Code Points and Internationalized Domain Names for Applications (IDNA) (http://tools.ietf.org/html/rfc5892 http://tools.ietf.org/html/rfc5892) Right-to-Left Scripts for Internationalized Domain Names for Applications (IDNA) (http://tools.ietf.org/html/rfc5893 http://tools.ietf.org/html/rfc5893)
  • fireattack 6y ago
    I don't get it then. Since browser already turns it into ascii format before resolving, how would it work in XSS for server-side max length limitation as he mentioned in his other article, "Minimum Viable XSS" [1]? [1] https://shkspr.mobi/blog/2016/03/minimum-viable-xss/ https://shkspr.mobi/blog/2016/03/minimum-viable-xss/
    • jrochkind1 6y ago
      Yeah, I don't really get that either; I don't understand the value of these denormalizing domain names to XSS.