12 ms·
DuckDuckGo \u202E
- thecosmicfrog 5y agoReminds me of searching for the terms "do a barrel roll", "recursion" or "askew" on Google. I'm sure there's plenty of others.
- bkmeneguello 5y agohttps://xkcd.com/1137/ https://xkcd.com/1137/
- blunte 5y agoWell done. I don't understand this TFA, nor do I understand (fully) the xkcd cell. But I get the connection. Thanks :)
- cipheredStones 5y agoU+202E is a Unicode codepoint, a control character that signals that letters (or other characters) should be printed right-to-left, as in Arabic or Hebrew. What the DDG link illustrates is that when someone searches for information about that codepoint, DDG's autogenerated answer section accidentally _uses_ that control character (reversing the answer text) instead of just printing the codepoint.
- tobz1000 5y agoEaster egg or bug?
- oneplane 5y agobug egg? it's also an instant answer from the community (the little info icon on the right hand side) so perhaps just presented that way due to how it was delivered by that specific community member.
- Waterluvian 5y agoPoe's Law applied to coding easter eggs? :D
- zeepzeep 5y agoThat's the question! (I think it's unintended though)
- rackjack 5y agoEaster bug?
- Sebb767 5y agoI'm not sure whether this is a bug or a feature^Weaster egg
- BitwiseFool 5y agoI'm out of the loop, what kind of Easter Egg is it?
- brimble 5y agoThe text in the instant-answer bar is reversed for this result. Which could plausibly either be on purpose, or a result of the character itself being inserted and not escaped, so having its intended effect.
- pwdisswordfish9 5y agoOversight, probably. By default, the code point is displayed next to that description, and they don’t turn that off for bidirectional control characters. https://duckduckgo.com/?q=u1f4a9 https://duckduckgo.com/?q=u1f4a9 (Yes, I have that one memorized)
- zanderwohl 5y agoIf you look down the page, some preview elements are also reversed. I think this may be accidental.
- deleted 5y ago[deleted]
- benbristow 5y agoReversed: U+202E RIGHT-TO-LEFT OVERRIDE, decimal: 8238, HTML: No visual representation, UTF-8: 0xE2 0x80 0xAE, block: General Punctuation
- hnlmorg 5y agoIf there was ever a clear signal that working with Unicode is incredibly hard, it would be the fact that no one on HN can decide if this is accidental or intentional.
- shockeychap 5y agoThis! Also, https://news.ycombinator.com/item?id=21105625 https://news.ycombinator.com/item?id=21105625
- barbazoo 5y agoAnd some of us don't even get what this is about. Should I be seeing DDG doing something particular here?
- iqanq 5y agoIt's accidental, because other characters are also displayed: https://duckduckgo.com/?q=u20aa https://duckduckgo.com/?q=u20aa
- Retr0id 5y agoIt's intentional, because there is no RTL override in the HTML source, the string is merely reversed.
- 5y ago
- TadeusTaD 5y agoInstantly reminded me of a relevant xkcd: https://xkcd.com/1137/ https://xkcd.com/1137/
- zeepzeep 5y agoHey that's new to me, I'll use this, thanks.
- gunapologist99 5y agoAre there any lists of unicode characters (like the OWASP one) that should be blacklisted from most apps (not just for XSS, but even for desktop apps)? Are there any good security guides/best practices for unicode sanitation?
- harambae 5y agoNot a full security guide, but if you haven't seen this before it's useful to have... https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/big-list-of-naughty-strings.txt https://github.com/danielmiessler/SecLists/blob/master/Fuzzi...
- adamrezich 5y agoI've seen this before but either this is new since last time or I missed it, either way: lol # Human injection # # Strings which may cause human to reinterpret worldview If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.
- p_j_w 5y agoI'm not falling for this one, I know no one misses me!
- wongarsu 5y agoHow are users supposed to write "עבור אל duckduckgo.com כדי לחפש באינטרנט" without \u202E? It's perfectly normal for RTL languages to switch text direction in the middle of a sentence.
- OJFord 5y agoDo you read left RTL, middle LTR, right RTL; or right RTL, middle LTR, left RTL? (Just curious.)
- kroltan 5y agoIt's intentional, if you inspect the `innerText` you'll see it's reversed there too: zero_click_wrapper.innerText.codePointAt(0) Evaluates to 32. And if you think 32 = 0x20 could mean the next one would be 0x2E, then no, codePointAt(1) is 0x55.
- nneonneo 5y ago`innerText` doesn't include the RTL marker, probably due to the fact that it is supposed to reflect the "rendered" appearance of the element (i.e. deleting certain invisible characters). However, `textContent` shows the RTL marker as expected. I'm on the side of this being an unintentional effect.
- missblit 5y ago> `innerText` doesn't include the RTL marker I'm too under the weather to dig into this, but this might be a mismatch between Firefox and the spec. I don't see in the spec [1][2] where this character could be removed since it shouldn't count as whitespace for whitespace processing. It looks like in Chrome `innerText` contains the override. And the innerText spec is only 6 or so years old (!) so it wouldn't be too surprising if there were was a lingering incompatibility. [1] https://html.spec.whatwg.org/multipage/dom.html#the-innertext-idl-attribute https://html.spec.whatwg.org/multipage/dom.html#the-innertex... [2] https://drafts.csswg.org/css-text/#white-space-processing https://drafts.csswg.org/css-text/#white-space-processing
- echelon 5y agoYou still have to be mindful of \u202e in anything new that you're writing, but browsers do a much better job of not having it bleed across elements like they did back in the 2000s. Back in the era of forums that didn't support unicode correctly (2005ish?), it was trollish fun to post messages containing \u202E and watch the UI and all subsequent messages and elements get messed up. (One stray \u202E would flip the entire page contents following it.) I never took it to a level of abuse since it was easy to remove and then ban offenders, but it was fun in a one-off thread, and it always had great reactions. I patched my own software to handle it, but I don't recall anyone really abusing it in a widespread manner. (Contrast this with the era of prolific and widely abused AOL/AIM exploits that would kill your IM client with malformed messages.) IIRC, a bunch of messaging clients also didn't (or still don't) handle \u202e termination and it sometimes bled into new messages and even the text input box. That was pretty horrible and unfixable without restarting. Obligatory XKCD: https://xkcd.com/1137/ https://xkcd.com/1137/ Some shenanigans in the wild: https://www.reddit.com/r/Unicode/comments/hc1rxi/i_put_a_right_to_left_override_character_in_my/ https://www.reddit.com/r/Unicode/comments/hc1rxi/i_put_a_rig... https://twitter.com/mkolsek/status/1237123571341803522 https://twitter.com/mkolsek/status/1237123571341803522 (These are way tamer than the effects used to be.) (Also, HN filters it out. I tried to have some fun. :P)
- ocdtrekkie 5y agoI have seen it used maliciously in the wild. Email attachments like invoice.tab.pdf are actually Batch files named invoice.fdp.bat with this character inserted.
- splch 5y agoOh that's cute! Translation for anyone curious / lazy: Punctuation General :block ,0xAE 0x80 0xE2 :8-UTF ,representation visual No :HTML ,8238 :decimal ,OVERRIDE LEFT-TO-RIGHT 202E+U Love the demos :)
- Jerrrry 5y agoStacking combining diacritics[1] is also fun, to make extremely tall text. Also fun is enumerating all the characters in the Private Character section[2] to see what UI symbols are able to be inserted into unintended places. [1] https://www.unicode.org/charts/PDF/U0300.pdf https://www.unicode.org/charts/PDF/U0300.pdf [2] http://www.unicode.org/faq/private_use.html http://www.unicode.org/faq/private_use.html https://www.unicode.org/charts/PDF/UE000.pdf https://www.unicode.org/charts/PDF/UE000.pdf
- cbarrick 5y agohttps://en.wikipedia.org/wiki/Zalgo_text https://en.wikipedia.org/wiki/Zalgo_text
- zeepzeep 5y agoI always wondered how people get these funny Twitter names, thx!
- hanche 5y ago> Stacking combining diacritics is also fun, to make extremely tall text. A bit OT, but here is a classic example of that (the much upvoted stack overflow post on parsing html with regex): https://stackoverflow.com/a/1732454 https://stackoverflow.com/a/1732454
- lucideer 5y agoEveryone here is asking if this is an "intentional easter-egg" or an "accidental bug" But what about accidentally working-as-intended? Sure it's a little trickier to read, but it's certainly not a "bug" that will cause any damage / danger / instability / etc.
- gambler 5y agoProblem is, this behavior is so outside of the range of common expectations, it's really hard to say if it's harmless or not and what are the worst cases for (ab)using it.
- subroutine 5y agoIt's telling that the description (https://unicode-explorer.com/c/202E https://unicode-explorer.com/c/202E) even acknowledges that 202E is commonly used as an exploit. "The Right-To-Left Override character can be used to force a right-to-left direction withing a text. This is often abused by hackers to disguise file extensions: when using it in the file name my-text.'U+202E'cod.exe, the file name is actually displayed as my-text.exe.doc - so it seems to be a .doc file while in reality it is an .exe file."
- thrdbndndn 5y agoI don't get your take. Even the most strict definition of bug doesn't imply it has to "cause any damage / danger / instability / etc." to be one. And I won't call it "work as intended" when the purpose of this feature is to provide an answer for human to read, and it failed on that.
- evolve2k 5y agoI'd warmly beg to differ, I personally think it's illustrating how it is supposed to work, most elloquently.
- willcipriano 5y agoI propose "accidental feature" for this sort of thing.
- gambler 5y agoExtremely bad design. This kind of complexity should have been moved to some kind of post-processing spec rather than core Unicode. It's already causing issues and will cause more. The more universal something is, the more effort should be applied to keeping it simple.
- mananaysiempre 5y ago... It’s not clear how? Except by telling every speaker of Arabic and Hebrew saying they want some of that delicious “plain text” action to go screw themselves (there are no purely-RTL texts, only bidirectional ones, not least because of the Indic numerals). AFAIU (at least from the full-length horror novel that is the CDRA) IBM tried presentation-order (and no-complex-shaping) RTL text for decades and gave up, so Unicode bidi is essentially the result of said giving up (and the “Arabic Presentation Forms” block the foul-smelling corpse of the idea). Specify the dominant direction of your user-input-containing elements, people, and/or enclose the input in U+2068 FSI ... U+2069 PDI (after balancing outstanding bidi controls inside).
- gambler 5y ago> Except by telling every speaker of Arabic and Hebrew saying they want some of that delicious “plain text” action to go screw themselves The problem is not with Arabic or Hebrew. The problem is that this modifier affects other languages and characters in a way the vast majority of people clearly wouldn't expect (otherwise the story wouldn't make it to the front page). > Specify the dominant direction of your user-input-containing elements, people, and/or enclose the input in U+2068 FSI ... U+2069 PDI (after balancing outstanding bidi controls inside). The level of arrogance packed in this sentence is just mind-boggling. There are many other "Easter eggs" in various basic technologies. I can assure you that no matter how high of an opinion you have about yourself, if you write any production code at all, you are guaranteed to be using something that contains other Easter egg design decisions. You're not aware of them, you're not mitigating them and therefore whether they will explode on you is mostly just a matter of luck. Minimizing "Easter egg" design decisions is the only long-term viable way to get complexity in our already complex environment under control.
- soheil 5y agoWhat's next, searching for the word death causes you to die?
- soheil 5y agoWhere does DDG get its search result? Do they scrape Google? If so how do they not bet banned both technically and legally?
- thesuitonym 5y agoThey have their own web crawlers, as well as a deal with Bing (And perhaps others)
- sp332 5y agohttps://help.duckduckgo.com/duckduckgo-help-pages/results/sources/ https://help.duckduckgo.com/duckduckgo-help-pages/results/so...
- heartbeats 5y agoWhy can't I just disable RTL on my system? I do not speak a word of Arabic. There is no circumstance in which my life will be materially improved by correct RTL text rendering. I might want proper display of individual characters so I can copy-paste them, but I have no use for RTL text. On the other hand, RTL causes a lot of unpleasant problems like this. Why can't I simply coerce all foreign languages into LTR?
- amelius 5y ago> This is often abused by hackers to disguise file extensions: when using it in the file name my-text.'U+202E'cod.exe, the file name is actually displayed as my-text.exe.doc So every programmer has to know about and support U+202E, but not filesystem programmers?
- tedunangst 5y agoWhat do you want the filesystem programmer to do?
- foxfluff 5y agoif (!isascii(c)) panic("stupid user");
- mananaysiempre 5y agoесли (!кои(с)) авост(«тупой оператор»); You wouldn’t want to live in that world, would you? I know I wouldn’t, and I have that as my native script and most of my filesystem in Latin. I’ve spent my childhood with a computer that ran a VGA-chargen-reprogramming hack at startup and later had to maintain a website stored in an encoding designed to preserve legibility after Latinization through amputation of the 8th bit (in case you’ve ever wondered where the illogical order of KOI-8 comes from). I do not want that world back, however fondly I remember my 286.
- foxfluff 5y agoI probably wouldn't mind it if were the lingua franca in computing.
- mananaysiempre 5y ago> I probably wouldn't mind it if were the lingua franca in computing. And in programming, I don’t! It’s more like a weird pidgin lignua celto-germano-franca with funky morphology, but I love it nevertheless. I’ve read the Unicode identifiers spec, and frankly, however much I like my Agda with that special Unicode maths sauce, I’m not sure I’d be better off with that in my compiler. A old and grizzled plant worker who needs a new computer-operated lathe, though, will rightfully tell me to take a hike if I try to sell him a machine that only speaks and accepts a foreign language, and his boss will support him. (It depends on the country: a French person will look down on you if you don’t try to speak their native language to them, and a Norse one will think you’re looking down on them if you do.) I might be able to hold out for a couple of decades, but ultimately, my computer will speak the lingua franca to computing professionals and the native language to users, or somebody else will build one that does. This means user-facing, user-specified identifiers such as file names will need to support at least these two languages—and given a requirement for exchanging data in a global network, essentially every other one as well. You might try to tell users they’re supposed to use some other kind of identifier, but given these are still going to need to be human-readable, integrity-critial, equality-supporting, globally-exchangeable identifiers, I don’t see how that does anything except rename the problem.
- ryukoposting 5y agoAnd somehow, the "external link" icon is outside the scope of Unicode.
- joelbondurant4 5y ago
- jfk13 5y agoSimilarly, if I try https://www.google.com/search?q=u202e https://www.google.com/search?q=u202e, the second result I currently get (YMMV) is from https://unicode-table.com/ https://unicode-table.com/, and almost the entire snippet shows up backwards in the search results.
- jefftk 5y agoIt's backwards on the original too: https://unicode-table.com/en/202E/ https://unicode-table.com/en/202E/
- dmoy 5y agoYup the meta description field as written is flipped in the serp What is even more hilarious is if you copy/paste out of the developer tools, that is also backwards after pasting.
- kathoum 5y agohttps://unicodeplus.com/U+202E https://unicodeplus.com/U+202E too. You can see the point where it switches from Left-To-Right to Right-To-Left.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- chris_wot 5y ago"This Instant Answer was made by the DuckDuckHack Community. Developer: Cosimo Streppone Developer: mintsoft"
- stubish 5y agoOur programming languages might need a unicode aware string concatenation operator, similar to locale aware capitalization. Joining LTR text to RTL text seems like it should result in combined LTR + RTL text, not letting the LTR marker override and change meaning.
- account42 5y agoIt does look like HTML supports this via the <bdo> tag [0]: data:text/html,<bdo>&%23x202E;reversed</bdo> not reversed So I guess this should be used to wrap any user-supplied text that allows arbitrary unicode. Or using Unicode: data:text/html,&%23x2068;&%23x202E;reversed&%23x2069; not reversed [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/bdo https://developer.mozilla.org/en-US/docs/Web/HTML/Element/bd...
- dheera 5y ago damnit hn
- d13 5y agoCan anyone explain what this is all about? I’m looking at the link and threads and have absolutely no idea what’s supposed to be significant here
- perlgeek 5y agothe Unicode codepoint with hex value 202E says "from here on, render the rest of the text from right to left" (something that's useful for Arabic scripts, for example). Duckduckgo shows infos about the codepoint and the codepoint itself in a box between the search field and the actual results, and in it, the text is rendered reversed (right to left), because that's what the codepoint tells the browser to do (and DDG doesn't have extra logic yet to either inject another "now render from left to right again" marker, or otherwise prevents it from messing up the info box).
- d13 5y agoThank you!!
- cryptojournal 5y agoHahahah #metoo!
- bncy 5y agoUmm, there's a little info button to the right that says that this 'quick' answer was proposed by DuckDuckHack community author.
- avnigo 5y agoThe funny thing is that search queries preceded by a backslash on DuckDuckGo are supposed to take you to the first search result, but that functionality seems to be buggy anyway: https://www.reddit.com/r/duckduckgo/comments/sp9e5r/backslash_does_not_actually_go_to_first_result/ https://www.reddit.com/r/duckduckgo/comments/sp9e5r/backslas...
- f3rnando 5y agoAlso known as "Top Gun"