
Add '127.0.0.1 xn–9q8h' to /etc/hosts gives you "localghost" - DyslexicAtheist
https://twitter.com/rfreebern/status/1214560971185778693
======
jackewiehose
It took me a while to get the joke because I didn't recognize that white ghost
on a white background. I take this as another example why these non-ascii urls
are a bad idea for security.

~~~
icebraining
It's not white, it's the blueish grey #E1E8ED. You need a better monitor :)

~~~
paulddraper
Fails all contrast measures abysmally: [https://contrast-ratio.com/#%23E1E8ED-
on-white](https://contrast-ratio.com/#%23E1E8ED-on-white)

And this is despite that fact that the actual "font color" is #14171A with
excellent contrast: [https://contrast-ratio.com/#%2314171A-on-
white](https://contrast-ratio.com/#%2314171A-on-white)

But these bizarre characters don't respond the text color and thus utterly
unpredictable in their legibility.

~~~
icebraining
The use of the color is quite different from a regular character, so measuring
by the same yardstick makes no sense. This is a blob of color, not just some
thin lines.

> these bizarre characters

At least on Twitter.com, they're not characters, they're SVG images.

~~~
paulddraper
PNG, but yes.

~~~
icebraining
Maybe it differs based on the browser? Shows up as
[https://abs-0.twimg.com/emoji/v2/svg/1f47b.svg](https://abs-0.twimg.com/emoji/v2/svg/1f47b.svg)
to me.

~~~
paulddraper
[https://abs.twimg.com/emoji/v2/72x72/1f47b.png](https://abs.twimg.com/emoji/v2/72x72/1f47b.png)
¯\\_(ツ)_/¯

------
shawkinaw
This is using Punycode encoding, see
[https://en.m.wikipedia.org/wiki/Emoji_domain](https://en.m.wikipedia.org/wiki/Emoji_domain).

~~~
jackewiehose
Why is this even a thing?

~~~
tialaramex
There are a bunch of different human writing systems. All of them are weird
because they were invented by humans, most of them are _very_ weird indeed
because they were invented by humans a long time ago and then gradually
mutated.

The Latin system is the one you're using here. It's very popular. Most humans
in the integrated tribes are somewhat familiar with it‡. It has twenty six
"letters" and then twenty six more "capital letters" which look different but
mean almost the same thing for some reason, and then a bunch more symbols that
aren't quite letters although some (apostrophe, ampersand) have a better claim
than others. But other popular systems include Han, which has a shitload of
logograms, and Cyrillic and Greek which have different letters than Latin and
different rules about how letters work.

Anyway, the people who invented DNS only or primarily used the Latin system
and they weren't much into capital letters. So, their system doesn't treat
capital letters as different and only has one set of twenty six Latin letters,
ten digits, a dash and an underscore for some reason.

But, lots of people who do NOT have Latin as the primary or only writing
system found this annoying to work with. They wanted to use their writing
system with DNS especially once the Web came along and popularized the
Internet.

Punycode is a way to use some reserved nonsense-looking Latin text in any DNS
label to mean that actually this DNS name should be displayed as some Unicode
text. Unicode encodes all popular human writing systems (and lots of unpopular
ones) fairly well, so this sorts the problem out. Specifically Punycode
reserves Latin names that start xn-- for this purpose. By only caring about
display this avoids changing anything in the technical underpinnings. Only
user-facing code needed to change, every other layer is unaltered.

The rules about IDNs say that a registry (such as .com) should have rules to
ensure the names in that registry are unambigous and meaningful. But in
practice the purpose of the .com registry in particular is to make as much
money as possible regardless of the consequences. So you can register any name
you please and they won't stop you even if it's deliberately confusing.

‡ None of the extant unintegrated tribes have writing. This probably doesn't
mean anything important.

~~~
downerending
Perhaps ironically, URLs were never meant for human consumption in the first
place. You were meant to "travel" to various sites via search indices, etc.
(Think Google.)

Viewed in that light, restricting DNS names to ASCII as a way to reduce bugs,
security issues, etc., makes a lot of sense.

~~~
ncmncm
Search engines happened remarkably late. Nobody understood how easy search
engines would be.

People thought you would follow links from directory pages linked from your
"home page", hence the house symbol still seen in browsers. Yahoo! is a
leftover of an attempt at a directory.

~~~
downerending
Indeed--this is what was meant by "indices".

It's kind of like XML. It was never meant to be seen by human eyes, except in
a few debugging scenarios. Unfortunately, that intention was ignored, and now
we have a usability disaster. (At least in the case of XML, it can just die.)

~~~
lokedhs
I agree with what you said about XML. But in its stead we have a lot of JSON
which is several respects is even worse.

The worst part of it is that it doesn't have a stable definition for numbers,
making it impossible to guarantee you're getting the same value back if you
encode and then decode a number. Reliably preserving the data you serialise
using it should be a primary feature for an encoding format. JSON can't even
do that.

~~~
gowld
Why do you need a stable serialization for an unstable data type? Use a string
of you want stability.

~~~
lokedhs
The point is that a 64-bit integer is stable in the language I'm using (which
is most languages).

My opinion is that a serialisation format that explicitly makes something as
fundamental as the representation of numbers unspecified is not useful as a
data representation format.

------
IHLayman
I hate to be a spoilsport, but this is a good reminder that
[https://en.wikipedia.org/wiki/IDN_homograph_attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)
is still possible in some domains and with some browsers and CLI tools,
although some of the easier tricks to detect have been mitigated.

~~~
DyslexicAtheist
if you run pihole or a local dnsmasq/unbound it should be possible to mitigate
it by sinkholing any unicode domains, e.g. with dnsmasq (requires a patch
[https://github.com/spacedingo/dnsmasq-
regexp_2.76](https://github.com/spacedingo/dnsmasq-regexp_2.76)) you can do
this:

    
    
      address=/:xn--*:/0.0.0.0
    

does anyone know if something like this is possible with unbound?

~~~
rahuldottech
But... What about legit unicode domains? I own a couple that I use for
personal projects or file sharing.

~~~
kylek
I've never seen a legit unicode domain personally, but, is this not compatible
with whitelisting specific domains? (in pihole, anyways...)

~~~
LadyCailin
I have, but I live in Norway, where we have æøå in the standard alphabet. I
suspect it’s more common still in Asian countries, because at least in
Norwegian, there are standard ascii replacements for all the extra letters, å
= aa, ø = oe, æ = ae

~~~
Nullabillity
Here in Sweden I have never encountered a single legit IDN domain.

~~~
Symbiote
I know [http://www.xn--sknetrafiken-ucb.se](http://www.skånetrafiken.se), but
like many it just redirects to an ASCII version. (Does it look weird seeing
"Skane" when you know it ought to be "Skaane"?)

Similarly for a power company, [http://xn--rsted-uua.dk](http://ørsted.dk),
just a redirect, but they do use it on adverts and my electricity bill.

Some that don't redirect: [http://xn--mgk--jra.dk/](http://mgk-ø.dk/)
[https://www.xn---strm-uuae.dk/](https://www.ø-strøm.dk/) [https://xn--
magnusbrth-85a.se/](https://magnusbråth.se/)

(HN has converted the displayed URLs to Punycode, presumably as a quick
security measure without reference to the reasonable characters for each TLD.)

------
billpg
I wanted to make a new website using emojis instead of "www" as a joke about
the number of syllables. ("Angry Face Angry Face Angry Face" takes the same
amount of time to say "www".)

Browsers kept insisting on showing this as xn--b38haa.crankybill.com, so I
went with "grr" instead.

------
banana_giraffe
Interesting, both Chrome and Firefox seem to show the Punycode encoding after
I enter the emoji in the URL for me.

Do browsers always show the Punycode encoding, or do they show the encoded
glyphs only in some scenarios? I can't find examples of Punycode in the wild
used by normal websites.

~~~
londons_explore
I believe the config of which glyphs to show depends on the TLD. There is a
hardcoded list of which character ranges are acceptable per TLD, and if any
characters are outside those ranges, the xn-- form is shown instead.

------
AndyMcConachie
Not all unicode characters are valid IDN labels. For example, emojis are not
valid in IDN labels.

~~~
daxterspeed
Valid or not several emoji domains have existed since 2001
[https://en.wikipedia.org/wiki/Emoji_domain](https://en.wikipedia.org/wiki/Emoji_domain)

~~~
WorldMaker
As with so many things domain name related, what is or is not valid varies by
and is determined by registrar. The biggest registrars (.com, .net, .org as
three examples) generally have a lot of restrictions on IDNs, whereas many
countries can afford to allow just about the full gamut of Unicode if they
wish.

------
netsharc
Hmm, I wonder if that's going to be the next battle field for URLs: Facebook
will try to register its logo as an emoji, and you'd just need to go to
[http://[f]](http://\[f\]) to open their site.

There already is an emoji for apple (the fruit, not the company). Oh the
horrors. I should start an emoji NIC!

~~~
manifestsilence
These would be less than convenient to type, but perhaps as we go more and
more towards a non-typing web where a walled-garden start page and predefined
links lead to the most popular sites with a click, these URLs will become
fashionable. I think if so, this will herald the impending death of the human-
read and typed URL in favor of start page links and search results.

~~~
kick
There are more mobile users than there are desktop users, and for them it's
just the same to type.

~~~
htfu
How is switch to emoji input -> press search box -> start typing apple ->
press apple symbol and so on “just the same” as app<CR>?

~~~
kick
You don't have to search. Just hit the apple emoji. If you use it frequently,
it'll probably be on the front. If not, it takes two seconds to hit the
category it's in and then press it.

~~~
htfu
Because apple happens to start with an a. Ok fine, specifically for apple.com
it's almost the same. But that's not really the point I was arguing.

------
nottorp
And how do i type that in the address bar?

~~~
billpg
If you use Windows, [Logo]+[.]

~~~
wongarsu
That's a neat trick. It even has kaomoji and useful symbols ╰( _°▽°_ )╯

~~~
Avamander
This sounds like the modern version of this
[http://bash.org/?835030](http://bash.org/?835030) quote.

------
markandrewj
Ghost in the shell...

------
huxflux
This made my day!

