6 ms·

thаmеr is not thamer. The space of all unicode characters is too big for you to look for every single possible "looks like" pair. Unicode, as unpopular an opi

thаmеr is not thamer. The space of all unicode characters is too big for you to look for every single possible "looks like" pair. Unicode, as unpopular an opinion as this is, should only be used for presentation and not storage. Anything past ascii is a security vulnerability.

jfim 4y ago
> Unicode, as unpopular an opinion as this is, should only be used for presentation and not storage. Anything past ascii is a security vulnerability. While at it, we should also ban the letters I and L as they can be confused. People who have those letters in their name can just request a name change. /s Leave Unicode alone for the vast majority of the world whose language isn't actually writable using ASCII.
- thrown_22 4y ago
  https://en.wikipedia.org/wiki/File:QWERTY_1878.png https://en.wikipedia.org/wiki/File:QWERTY_1878.png Notice some keys missing there? The difference is that we have a few good quality fonts, like liberation mono, which let you tell the difference between l and 1 and 0 and O. There can't be a font which does that for the whole of unicode space because a and а are by definition the same glyph.
  - jfim 4y ago
    What's your proposal for differentiating between mais (but) and maïs (corn), or between café (French, Spanish) and cafè (Catalan) using ASCII? How would one write an ideographic language using ASCII?
    - iforgotpassword 4y ago
      > What's your proposal for differentiating between mais (but) and maïs (corn), or between café (French, Spanish) and cafè (Catalan) using ASCII? Context, but... > How would one write an ideographic language using ASCII? ... We're talking about security sensitive context. Users can write stories with all the Unicode they want, just don't use it for identifiers like user and channel names. Reddit got it right.
      - jfim 4y ago
        So channel names like "le canard enchaîné" or 美味しい食べる are completely verboten from your perspective.
        raverbashing 4y ago
        Do you know who has it even worse? Spotify Because of course this band from "part of the world" has the same name as "other band from a different part of the world" or even from the same country and they have nothing to do with each other (because why google before naming your band - but I digress)
  - blooalien 4y ago
    You don't need a human to even look at it until after an "AI" has already flagged it as "something fishy" worthy of human attention, and even then the font don't matter so much, because you'd be using some fancy scripting or tools to be pointing out to the user what exactly is potentially "fishy" about it. Seemingly insurmountable task becomes common "drudge-work" with the aid of some cleverly scripted tools. It's actually what computers are good at. Automating and simplifying repetitive tasks over large data sets. Something that Google's people should be well aware of and able to fairly easily implement. You could even script the tools such that the humans tasked with checking on the flagged materials would be helping further the training of the AI through their responses to the individual situations for less false positives, and more accurate flagging going forward, making the humans' jobs easier as they continue to do it.
    - thrown_22 4y ago
      Now you've just made name changes unbearbly slow for everyone to supposedly make like better for people who already have access to a keyboard with latin characters on it. If people can manage maths with greek letters they can manage logins with latin letters.
  - noirscape 4y ago
    You can like, just normalize the input on the backend when scanning for spam. Every spamfilter I've ever used that's worth a damn does that. Sometimes you get slightly odd syntax (I once configured one that replaces A with a 4 so it could detect common fake uses), but this is a solvable issue.
- rurban 4y ago
  No, foreign names do exist. they problem is how to disallow confusables then. and this is solved by UTS 39, without needing to compare against all existing names. https://unicode.org/reports/tr39/ https://unicode.org/reports/tr39/ and use the secure subset of UTS 31. you can eg use my libu8ident, and please dont use the broken confusables list.
bagels 4y ago
Render to pixels. If they look about the same, but are different, that is a high signal for spam.
- thrown_22 4y ago
  Ноw wоuld уоu knоw whаt уоu ѕhоuld bе rеndеrіng аgаіnѕt tо сhесk аhеаd оf tіmе? The majority of the above sentence is not valid Latin characters for example.
  - bagels 4y ago
    All of the usernames, to detect lookalikes.
    - thrown_22 4y ago
      That's an n^2 problem. For every new used you'd need to compare them to every already existing user. Do you think you ought to be charged $5 for every attempted registration? >Mole is too close to Moie, please select another user name. Your bank account has already been charged.
      - bagels 4y ago
        It's not n^2. It's a lot better than that.
        thrown_22 4y ago
        for i in users: for j in users: if same_as(i,j): reject(i) else: accept(i) That is literally the definition of n^2.

jfim 4y ago

> Unicode, as unpopular an opinion as this is, should only be used for presentation and not storage. Anything past ascii is a security vulnerability. While at it, we should also ban the letters I and L as they can be confused. People who have those letters in their name can just request a name change. /s Leave Unicode alone for the vast majority of the world whose language isn't actually writable using ASCII.

thrown_22 4y ago
https://en.wikipedia.org/wiki/File:QWERTY_1878.png https://en.wikipedia.org/wiki/File:QWERTY_1878.png Notice some keys missing there? The difference is that we have a few good quality fonts, like liberation mono, which let you tell the difference between l and 1 and 0 and O. There can't be a font which does that for the whole of unicode space because a and а are by definition the same glyph.
- jfim 4y ago
  What's your proposal for differentiating between mais (but) and maïs (corn), or between café (French, Spanish) and cafè (Catalan) using ASCII? How would one write an ideographic language using ASCII?
  - iforgotpassword 4y ago
    > What's your proposal for differentiating between mais (but) and maïs (corn), or between café (French, Spanish) and cafè (Catalan) using ASCII? Context, but... > How would one write an ideographic language using ASCII? ... We're talking about security sensitive context. Users can write stories with all the Unicode they want, just don't use it for identifiers like user and channel names. Reddit got it right.
    - jfim 4y ago
      So channel names like "le canard enchaîné" or 美味しい食べる are completely verboten from your perspective.
      - raverbashing 4y ago
        Do you know who has it even worse? Spotify Because of course this band from "part of the world" has the same name as "other band from a different part of the world" or even from the same country and they have nothing to do with each other (because why google before naming your band - but I digress)
- blooalien 4y ago
  You don't need a human to even look at it until after an "AI" has already flagged it as "something fishy" worthy of human attention, and even then the font don't matter so much, because you'd be using some fancy scripting or tools to be pointing out to the user what exactly is potentially "fishy" about it. Seemingly insurmountable task becomes common "drudge-work" with the aid of some cleverly scripted tools. It's actually what computers are good at. Automating and simplifying repetitive tasks over large data sets. Something that Google's people should be well aware of and able to fairly easily implement. You could even script the tools such that the humans tasked with checking on the flagged materials would be helping further the training of the AI through their responses to the individual situations for less false positives, and more accurate flagging going forward, making the humans' jobs easier as they continue to do it.
  - thrown_22 4y ago
    Now you've just made name changes unbearbly slow for everyone to supposedly make like better for people who already have access to a keyboard with latin characters on it. If people can manage maths with greek letters they can manage logins with latin letters.
- noirscape 4y ago
  You can like, just normalize the input on the backend when scanning for spam. Every spamfilter I've ever used that's worth a damn does that. Sometimes you get slightly odd syntax (I once configured one that replaces A with a 4 so it could detect common fake uses), but this is a solvable issue.
rurban 4y ago
No, foreign names do exist. they problem is how to disallow confusables then. and this is solved by UTS 39, without needing to compare against all existing names. https://unicode.org/reports/tr39/ https://unicode.org/reports/tr39/ and use the secure subset of UTS 31. you can eg use my libu8ident, and please dont use the broken confusables list.

bagels 4y ago

Render to pixels. If they look about the same, but are different, that is a high signal for spam.

thrown_22 4y ago
Ноw wоuld уоu knоw whаt уоu ѕhоuld bе rеndеrіng аgаіnѕt tо сhесk аhеаd оf tіmе? The majority of the above sentence is not valid Latin characters for example.
- bagels 4y ago
  All of the usernames, to detect lookalikes.
  - thrown_22 4y ago
    That's an n^2 problem. For every new used you'd need to compare them to every already existing user. Do you think you ought to be charged $5 for every attempted registration? >Mole is too close to Moie, please select another user name. Your bank account has already been charged.
    - bagels 4y ago
      It's not n^2. It's a lot better than that.
      - thrown_22 4y ago
        for i in users: for j in users: if same_as(i,j): reject(i) else: accept(i) That is literally the definition of n^2.