Re:Impersonating the brave.com website to deliver malware
by dnzkw on Sunday August 01, 2021 @07:16AM
(#28025458)
Punycode should be permanently disabled. No upsides at all.
[ Parent
| on HN ]
Re:Impersonating the brave.com website to deliver malware
by rspoerri on Sunday August 01, 2021 @07:34AM
(#28025548)
Did you read the text at all? The world speaks more then english.
Just 13% of the world speaks english. It is not a reference for how we do or should write on the web.
It would maybe make sense to restrict url display to the computers language setting.
Re:Impersonating the brave.com website to deliver malware
by unobatbayar on Sunday August 01, 2021 @09:19AM
(#28026066)
The software world is dominated by English language, especially American English.
It does make sense to permanently disable Punycode.
Re:Impersonating the brave.com website to deliver malware
by dnzkw on Sunday August 01, 2021 @07:36AM
(#28025555)
That's good in theory. The reality is that punycode never took off anywhere in the world.
Unless you're proposing we let it live in case someone somewhere ever uses it. Then, sure.
Re:Impersonating the brave.com website to deliver malware
by tialaramex on Sunday August 01, 2021 @12:00PM
(#28027244)
How does the popularity of https://en.wikipedia.org/wiki/.%D1%80%D1%84 square with your theory that it "never took off anywhere in the world" ?
Of course that registry actually has a sane punycode policy, so such impersonations are impossible there, whereas they're happening all the time in .com. Maybe time to re-evaluate your idea of "reality" versus "theory".
Re:Impersonating the brave.com website to deliver malware
by tomjen3 on Sunday August 01, 2021 @07:32AM
(#28025543)
Not for English speaking people, as a Dane it is nice to be able to use our actual alphabet to spell words, even if the letters weren't in the ASCII alphabet.
Though why you should be able to purchase .com domains with punycode, I don't know.
Re:Impersonating the brave.com website to deliver malware
by tialaramex on Sunday August 01, 2021 @11:45AM
(#28027106)
Each TLD gets to set its own rules for name registration under that TLD. In particular they all have punycode policies. For example a country which uses a Latin alphabet with a handful of extra characters might requires names under its ccTLD to be from that alphabet, and not, for example, Cyrillic. Or a TLD operated on behalf of a region dominated by one writing system might require names to use that writing system. The attention of TLD registry operators was drawn to the need to prevent the exact types of fraud we're seeing here.
The .com TLD registry's priority is profit at any cost. A crook's money is just as good as anybody else's, right?
Re:Impersonating the brave.com website to deliver malware
by zinekeller on Sunday August 01, 2021 @07:35AM
(#28025552)
It's funny that both in the Ars comments and here someone talks about punycode.