Hacker News Reader

Comment by mmanfrin | Hacker News Reader

The first ad I saw for Crypto was an ad for Bitmain -- it flashed through my ad blocker enough for me to turn off the blocker to see it. It was Bitmain, advertising a miner back in stock. Clicked it, saw it in stock, then thankfully went back to the fb comments to see someone mention it was a Punycode domain -- was a complete phishing site. There was an 'a' that was actually some other glyph that had a small, nearly pixel-sized dot that made it something other than an 'a'.

I am flabbergasted at why fb would allow punycode domains (especially when the domain listed under the ad was the 'real' domain).

View on HN

If they would have the same rules as browsers this basically wouldn't be an issue. Those rules are along the lines of "don't mix character sets unless under a ccTLD for that character set". See here: https://www.chromium.org/developers/design-documents/idn-in-...

> I am flabbergasted at why fb would allow punycode domains (especially when the domain listed under the ad was the 'real' domain).

The problem is that there are actual, real sites that advertise on Facebook that use Punycode domains.

e.g. Bücher.de for a while did so, although now their punycode domain redirects to buecher.de they still use the brandname "Bücher.de" everywhere in their advertising.

And then there's sites like Flüge.de where a competitor of them owns the non-punycode domain Fluege.de, so of course they can't stop using the punycode domain, but you also wouldn't want visitors to see the ugly punycode domain and get confused.

Requiring non-punycode domains is a very anglomerican view of the web. It's as arbitrary as restricting domains to be only in hexadecimal.

EDIT: I originally included links to the sites in this comment, but every time I try to edit them in, HN just responds with Error 502 - if I don't include them, everything works fine. So you'll need to copy-paste them to the URL bar

Learning dvorak and playing around with its compose key, I was amazed by the vast characters that there actually exists.

For a, you also have: äāȧą

I would fall for a domain like that.

Sadly, you can't blacklist all punycode domains as some are legits in languages where accents are used

So allow those for the TLDs where it makes sense. Keeping them out of .com seems like a reasonable trade off.

Each TLD registry is able to choose their own policy for IDN. Responsible ones all have homograph rules to avoid this issue. But what you're missing is that .com is not Main Street or the big Mall, .com is that sketchy market where you can buy anything and the operators just take a fixed fee for each stall and turn a blind eye. So the policies for .com are deliberately as lax as possible to get the most people possible paying a fee.

Thus, any policies about protecting consumers, avoiding security problems, anything like that, won't come from .com and indeed it's operators will fight such things because they mean less income.

.com is supposed to be international. US-only content belongs in .us.

The decorated letters are in the easy to spot side. Check some texts on http://unicode.org/cldr/utility/confusables.jsp to see more extreme examples.

Wow: paypal vs 𝗉𝖺𝗒𝗉𝖺𝗅.

Google does the same:

https://twitter.com/Caust1c/status/948680008112816128

You have pretty garbage ad blocker if it loads the ad then hides it instead of just never wasting resources to load the ad in the first place.

Some blockers are specifically created like that. Their rational is a combination of letting the website owners (who embedded the ads) get their money and hiding that they're using a blocker.

Do you have any examples of these types of blockers? I couldn't find any.

You can actually configure uBlock Origin to block like this, https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-...

FWIW most (but certainly not all) ads are sold in a pay-per-click model, increasing the number of delivered ads only lines the ad network's pockets (who sells them to advertisers as pay-per-view).

I never was in that line of business but afaik websites pay to AD platforms per banners displayed. So looking at AD and not interacting with it in any way is a net loss for a website who placed that AD.

Reply on news.ycombinator.com