7 ms·
Off-topic, but it would be nice if HN could properly parse the Punycode encoding of internationalized domain names, so rather than the URL appearing as xn--rpa.
by MontyCarloHall 4y ago
Off-topic, but it would be nice if HN could properly parse the Punycode encoding of internationalized domain names, so rather than the URL appearing as xn--rpa.cc, it appeared properly as ʞ.cc
- gibolt 4y agoShowing the real url, followed by the Punycode url in brackets would be even better
- donatj 4y agoInterestingly it's not even showing in Chrome for me. Shows fine in Safari. I wonder if Chrome considers the upside down "LATIN SMALL LETTER TURNED K" potentially deceptive. They've apparently got a whole document about what Chrome will and won't display https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i...
- DyslexicAtheist 4y agothere are tools like dnscrypt-proxy or nfq which allow you to sinkhole any punicode dns domains (before DoH became a thing) and I'm glad that some browsers still show this as xn-- as it's now the only defense that stands between users clicking on hxxps://аррӏе.com instead of https://apple.com https://apple.com punicode was a terrible idea to allow in DNS.
- MontyCarloHall 4y ago>punicode was a terrible idea to allow in DNS This is a very western-centric viewpoint. Most of the world does not use the Latin alphabet as its primary writing system.
- DyslexicAtheist 4y agoit is a security centric view point not a "Western" one.
- MontyCarloHall 4y agoThe solution is prohibiting characters that can easily be confused (across all writing systems), not banning Punycode altogether.
- Beltalowda 4y agoOr just allow only using a single script. A domain in all Cyrillic: great! Mixing Latin & Cyrillic: nono. In practice, browsers already check for this and display the "raw" punycode if they detect mixed script usage, but I wish such domains would not be registrable at all. These checks are somewhat complex and difficult, and easy to get wrong.
- duskwuff 4y ago> Or just allow only using a single script. This would still let some homographs through. In particular, Cyrillic has a lot of characters which are confusingly similar to, or even indistinguishable from, Latin characters (e.g. "авсекморѕтѵху").
- Beltalowda 4y agoRight; you can construct "арр.com" or "аррꙆе.com" from that limited subset. Those should be valid domains though IMHO; maybe show the used script in the address bar? I think users might be confused by that though and/or just ignore it, so idk. Then again, displaying "xn--80a6aa.com" and "xn--80ak6aa9058r.com" is pretty confusing too.
- lupire 4y agoUnicode domain names are a security threat, due to homographs.
- kevin_thibedeau 4y agoUpgrade to Firefox and you'll only see the punycode.
- hoseja 4y agoI specifically want to see unicode and firefox isn't letting me.
- seszett 4y agoAs far as I know, most browsers only display the Unicode character on a whitelisted set of TLDs that have rules to prevent homographs. .cc isn't part of this list and I only see the punycode.