this post was submitted on 22 Sep 2025
103 points (96.4% liked)
Technology
75472 readers
2575 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
xn--gckvb8fzb
マリウス.com
Very interesting, today I learnt something cool and new ty
I've heard it's a security feature not ro render unicode in the url because otherwise people could use Unicode lookalike characters to spoof a domain.
The problem with that line of reasoning is that it ruins what's arguably the most important feature of DNS: providing human-readable names.
Using lookalike characters to deceive people has been a problem since long before anyone first got the idea to register paypa1.com but no-one ever seriously suggested abandoning human-readable names in order to avoid that problem.
The term "Human" does not include people who primarily read non latin-based languages silly
Note that everything outside of ASCII gets encoded in Punycode, so this also includes most languages written in the Latin script.
Shit, I forgot that Human now just means the native English-speaking world.
Ideally they should show both side by side.
I'm unsure how that'd be useful to any normal user. Let's say the UI shows something like this:
What's the user supposed to do with that information, how would showing the Punycode here help any normal user determine which one of these domains is the right one that they want to visit?
Helping users identify the right domain name and avoid being deceived is surely a very important thing to do, I just find it hard to see how having users read Punycode would ever be a practically useful way to achieve that.
Let's say that I go to google.com. The UI shows
https://google.com/. No punycode because it is plain ascii. Everything is as expected.Now let's say I click on a link for googӏe.com. The ui shows
https://xn--googe-hof.com/ (googӏe.com)I'd be like, holy shit that is a shady URL!That's how I imagine it helping, although I am not a UI expert. There could be a better way. But that googӏe.com scares me -- I can't visually tell that it is not a normal lowercase "l".
P.S. for the URL in question,
https://xn--gckvb8fzb.com/ (マリウス.com)I imagine that if I went to it frequently, I might begin to recognize the punycode, sorta like how people recognize rickroll URLs.But how would an average user know that
xn--googe-hof.comisn't the right one?Because it does not match google.com
But that line of reasoning presupposes both that the right name is in ASCII and that the user knows this. As soon as either one of those isn't true, showing the Punycode no longer is of any help in determining which one is the right one.
For most security - centric websites, the right name is ASCII only.
For any that aren't, people would have the opportunity to become familiar with the correct fingerprint over time and have a chance to notice a difference.
I'm curious to hear if you think there is a better way. What I'm saying is unlikely to ever be implemented in a browser and I'm not trying to convince you or anything, just say why I personally would appreciate it.
Are you perhaps by any chance American?
I think a much better solution would be to shield end users from this problem entirely, by having all registries refuse to register such confusable names, as recommended by Unicode:
https://www.unicode.org/reports/tr46/tr46-34.html#Registries
Yep. Do you all have important URLs with Unicode characters?
I think it would be great if registries screened registrations for confusable names. Even if they did though, I wouldn't expect them to succeed 100%
NGL that is a beautiful website