5 ms·

The is a horrendously horrible idea, for the same reason why unicode domain names are a bad idea. Domain names are important because they provide a reasonable

The is a horrendously horrible idea, for the same reason why unicode domain names are a bad idea. Domain names are important because they provide a reasonable amount of trust. If I type http://apple.com http://apple.com, I'm 99.99999% certain that I've connected to Apple's website. This gets nasty with unicode, because a person can spam your email account and get you to click on a URL which looks very similar to something like apple.com, but really points to a malicious site (thank you cyrillic characters). Hash based domain names would be even worse. You have no idea what site is lurking behind some big string of hex digits. You could argue that a person should just compare the hash to some known set of hashes, but that's a. cumbersome and b. unrealistic. If it's done by humans, it's error prone (a malicious site could spoof the first few chars to point to their site), and if it's done by computers, what's the point? You've now effectively created a really shitty replacement for DNS.

mjolk 13y ago
>The is a horrendously horrible idea, for the same reason why unicode domain names are a bad idea. So, you suggest that non english speakers should just "learn it" to use DNS?
- Patrick_Devine 13y ago
  Until we can figure out something that doesn't suck, yes. Look, I'm sympathetic with a huge chunk of the world's population having to deal with a (potentially) unfamiliar character set, but what can you do about it? There has to be some standard that everyone can agree to which doesn't compromise the integrity of the net.
  - jawns 13y ago
    This might at first sound like a xenophobic, anglocentric position, but it actually makes quite a bit of sense. There are a number of instances in which it is advantageous / critical to adopt a lingua franca -- that is, a single language that everyone in the world agrees to use for a particular purpose. In the case of domain names, Patrick is right: If we allow characters that appear to be one thing but are actually another, it opens up a whole bunch of evil possibilities.
    - mtrimpe 13y ago
      There is some middle ground between opening up all of UniCode and just Latin characters. It seems that generally a subset of sufficiently distinct characters should mostly suffice. I don't think e.g. Latin, Hebrew and Chinese have much visual overlap.
      - b3n 13y ago
        This is already a solved problem in every major browser. They will show mixed script domains as punycode instead of their unicode equivalent[1][2]. ICANN does not even allow all unicode characters[3]. There's so much FUD going around. [1] http://www.chromium.org/developers/design-documents/idn-in-google-chrome http://www.chromium.org/developers/design-documents/idn-in-g... [2] http://www.mozilla.org/en-US/about/governance/policies/security-group/tld-idn/ http://www.mozilla.org/en-US/about/governance/policies/secur... [3] https://tools.ietf.org/html/rfc5892 https://tools.ietf.org/html/rfc5892
        Patrick_Devine 13y ago
        Great links. I'm not sure I'd go so far as to say it's a "solved problem" when there are four different behaviours from four separate browsers, but I'm glad each browser is taking homograph attacks seriously. In the first link, I compared Chrome and Firefox and they do work differently.
    - jessedhillon 13y ago
      Couldn't this also be mitigated by making all domains mandatorily delegated from a national ccTLD? Eliminate/redirect apple.com to apple.com.us, then make sure it conforms to the rules for US domains (Latin character set only, etc) whereas apple.com.ru comes under the rules of the Russian registrar?
      - VMG 13y ago
        I prefer an unfractioned internet
  - mjolk 13y ago
    > I'm sympathetic with a huge chunk of the world's population having to deal with a (potentially) unfamiliar character set, but what can you do about it? Well, seeing as that "huge chunk" is a large majority, then the solution isn't "learn english because I'm used to typing URLs _this_ way." I understand that English is the current lingua franca, but it's aggressive to expect everyone to deal with it just to use the internet. Why not use our country tlds? It might mean that ICANN has to actually do some work, but I think that the uppermost tld for countries should actually be reserved for suffixes. e.g. apple.us #should have never been sold apple.com.us #there, none of that scary unicode apple.com.ru #same unicode problem abound (but at least it addresses the first issue)
    - lukehorvat 13y ago
      Who says you have to learn English?
  - nettletea 13y ago
    Punycode.
- ars_technician 13y ago
  The alphabet isn't restricted to English. Also, see: punycode.
  - dlsx 13y ago
    Yet, we can all agree the Greek alphabet was first. It is important to be first, because those who are first define the market. The market was defined in English, and what Patrick is saying, unfortunately for non-native English character set readers, is true. They would need to invent their own separate internet, as your rebuttal suggests.
- memracom 13y ago
  I hate to break it to you but Unicode domain names are here and have been for a while. For instance this English language page has a couple of graphs about registrations in the .РФ domain. http://кто.рф http://кто.рф Note that you can't just type it in because kto.p? is not the right letters and that last one is obviously not on your keyboard. But cut and paste should work fine.
- joesb 13y ago
  What is there to learn? Learning to type English character? We are not requiring them to learn English. Using phone number doesn't require you to "learn" Math.
Snail_Commando 13y ago
That's pretty harsh, although you may be entirely correct. I'm not smart enough to know. Please remember that the author did this for fun and despite whatever flaws it may have, it is still interesting to think about. Is it impossible to overcome the flaws you pointed out? Is there a way to abstract away the risk from the end user? Are there other applications for this where trust is not an issue? At risk of sounding like an idiot, could some sort of distributed proof-of-work/proof-of-stake protocol alleviate some of the trust problem?
minor_nitwit 13y ago
I think the popularity of url shorteners shows that people are willing to click on links where they have no idea what is lurking behind an unintelligible string. As for the apple site, there are other (better) systems in place for supplying identity information than just the url.
snowwrestler 13y ago
Unicode domain names are no more dangerous than HTML emails, which can also be used to fool people into clicking links that look like one site but go to another. Unicode or not, if you type in apple.com on your English keyboard, you will go to the website of Apple, Inc. (Unless your DNS cache has been poisoned.)
- ceejayoz 13y ago
  > Unicode domain names are no more dangerous than HTML emails, which can also be used to fool people into clicking links that look like one site but go to another. Except in the case of a carefully selected unicode domain, the address bar will say 'www.paypal.com', not 'www.paypallolimstealingyourlogin.com'.

mjolk 13y ago

>The is a horrendously horrible idea, for the same reason why unicode domain names are a bad idea. So, you suggest that non english speakers should just "learn it" to use DNS?

Patrick_Devine 13y ago
Until we can figure out something that doesn't suck, yes. Look, I'm sympathetic with a huge chunk of the world's population having to deal with a (potentially) unfamiliar character set, but what can you do about it? There has to be some standard that everyone can agree to which doesn't compromise the integrity of the net.
- jawns 13y ago
  This might at first sound like a xenophobic, anglocentric position, but it actually makes quite a bit of sense. There are a number of instances in which it is advantageous / critical to adopt a lingua franca -- that is, a single language that everyone in the world agrees to use for a particular purpose. In the case of domain names, Patrick is right: If we allow characters that appear to be one thing but are actually another, it opens up a whole bunch of evil possibilities.
  - mtrimpe 13y ago
    There is some middle ground between opening up all of UniCode and just Latin characters. It seems that generally a subset of sufficiently distinct characters should mostly suffice. I don't think e.g. Latin, Hebrew and Chinese have much visual overlap.
    - b3n 13y ago
      This is already a solved problem in every major browser. They will show mixed script domains as punycode instead of their unicode equivalent[1][2]. ICANN does not even allow all unicode characters[3]. There's so much FUD going around. [1] http://www.chromium.org/developers/design-documents/idn-in-google-chrome http://www.chromium.org/developers/design-documents/idn-in-g... [2] http://www.mozilla.org/en-US/about/governance/policies/security-group/tld-idn/ http://www.mozilla.org/en-US/about/governance/policies/secur... [3] https://tools.ietf.org/html/rfc5892 https://tools.ietf.org/html/rfc5892
      - Patrick_Devine 13y ago
        Great links. I'm not sure I'd go so far as to say it's a "solved problem" when there are four different behaviours from four separate browsers, but I'm glad each browser is taking homograph attacks seriously. In the first link, I compared Chrome and Firefox and they do work differently.
  - jessedhillon 13y ago
    Couldn't this also be mitigated by making all domains mandatorily delegated from a national ccTLD? Eliminate/redirect apple.com to apple.com.us, then make sure it conforms to the rules for US domains (Latin character set only, etc) whereas apple.com.ru comes under the rules of the Russian registrar?
    - VMG 13y ago
      I prefer an unfractioned internet
- mjolk 13y ago
  > I'm sympathetic with a huge chunk of the world's population having to deal with a (potentially) unfamiliar character set, but what can you do about it? Well, seeing as that "huge chunk" is a large majority, then the solution isn't "learn english because I'm used to typing URLs _this_ way." I understand that English is the current lingua franca, but it's aggressive to expect everyone to deal with it just to use the internet. Why not use our country tlds? It might mean that ICANN has to actually do some work, but I think that the uppermost tld for countries should actually be reserved for suffixes. e.g. apple.us #should have never been sold apple.com.us #there, none of that scary unicode apple.com.ru #same unicode problem abound (but at least it addresses the first issue)
  - lukehorvat 13y ago
    Who says you have to learn English?
- nettletea 13y ago
  Punycode.
ars_technician 13y ago
The alphabet isn't restricted to English. Also, see: punycode.
- dlsx 13y ago
  Yet, we can all agree the Greek alphabet was first. It is important to be first, because those who are first define the market. The market was defined in English, and what Patrick is saying, unfortunately for non-native English character set readers, is true. They would need to invent their own separate internet, as your rebuttal suggests.
memracom 13y ago
I hate to break it to you but Unicode domain names are here and have been for a while. For instance this English language page has a couple of graphs about registrations in the .РФ domain. http://кто.рф http://кто.рф Note that you can't just type it in because kto.p? is not the right letters and that last one is obviously not on your keyboard. But cut and paste should work fine.
joesb 13y ago
What is there to learn? Learning to type English character? We are not requiring them to learn English. Using phone number doesn't require you to "learn" Math.

Snail_Commando 13y ago

That's pretty harsh, although you may be entirely correct. I'm not smart enough to know. Please remember that the author did this for fun and despite whatever flaws it may have, it is still interesting to think about. Is it impossible to overcome the flaws you pointed out? Is there a way to abstract away the risk from the end user? Are there other applications for this where trust is not an issue? At risk of sounding like an idiot, could some sort of distributed proof-of-work/proof-of-stake protocol alleviate some of the trust problem?

minor_nitwit 13y ago

I think the popularity of url shorteners shows that people are willing to click on links where they have no idea what is lurking behind an unintelligible string. As for the apple site, there are other (better) systems in place for supplying identity information than just the url.

snowwrestler 13y ago

Unicode domain names are no more dangerous than HTML emails, which can also be used to fool people into clicking links that look like one site but go to another. Unicode or not, if you type in apple.com on your English keyboard, you will go to the website of Apple, Inc. (Unless your DNS cache has been poisoned.)

ceejayoz 13y ago
> Unicode domain names are no more dangerous than HTML emails, which can also be used to fool people into clicking links that look like one site but go to another. Except in the case of a carefully selected unicode domain, the address bar will say 'www.paypal.com', not 'www.paypallolimstealingyourlogin.com'.