Comment on Smartphones are Designed to Fail Us (and We Have to Change That)

• lennivelkant@discuss.tchncs.de ⁨1⁩ ⁨day⁩ ago

  To clarify, I meant that from the devs’ perspective: The effort of individually vetting every single character for possible confusion is immense, and the end result would still be just as western-centric. Imagine having a domain name in Greek where some characters are replaced because they might be confused for Latin characters. Or, conversely, having a few characters replaced by similar Latin ones for an attack, which your solution wouldn’t catch.

  The result would also still be unreliable even for Westerners. If some other character set you didn’t vet also contains similar looking characters, there’s a new surface for attack.

  To properly close that security gap would be an immense arms race… or you could simply shut down the entire attack vector.

  So when you consider the importance of protecting gullible people from insidious attacks and the complexity of trying to allow non-Latin characters without creating openings, the question “How widespread are non-Latin URLs in my target audience and is it critical that they be rendered in their native script?” becomes a calculation of cost and benefit.

  It’s a shit compromise to deal with the shit fact that some people being assholes ruins good things for the rest of us who aren’t.

  source

  • princessnorah@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago

    All of your points are quite valid. Personally, I would go for a whitelist over a blacklist.

    source

    • lennivelkant@discuss.tchncs.de ⁨1⁩ ⁨day⁩ ago

      For some character sets with a lot of different characters like the Han Unicode representation, that could be cumbersome. Granted, Han might not be a great risk for confusion so you might just whitelist them collectively, but my point is that the approach would have to be more nuanced and complex. Ultimately, humans are complex and so are their languages.

      source