Hacker News Reader

Comment by cryptonector | Hacker News Reader

Unicode certainly has been a source of security vulnerabilities.

Are you overreacting? Unless you were proposing we rip it out, no, you're not.

Unicode isn't going anywhere. That's because the scripts that human languages use aren't going anywhere. And people do mix scripts, too.

There are answers though. First, Unicode has been a learning experience, and we're still all learning. Second, one of the outputs of all that learning that has happened so far is UTR #36 (https://www.unicode.org/reports/tr36/), which does cover a lot of these things.

View on HN

ASCII certainly has been a source of security vulnerabilities.

Examples?

I mean, obXkcd: https://xkcd.com/327/

But spelling out what you had in mind would be helpful here.

\n, \r, \v \0, ", ', </script>, &, %, 1 vs I vs l, O vs 0, etc.

Thanks.

Still, a limited set.

Yes, errors are made and occur. They're reasonably easy to code defensively against.

Unicode ... vastly expands the attack interface.

ASCII is part of Unicode, so for Unicode it's also «a limited set. Yes, errors are made and occur. They're reasonably easy to code defensively against».

> Unicode ... vastly expands the attack interface.

Limit yourself to 0..9 to be safe.

Are you aware of the maximum number of Unicode codepoints which can exist, offhand?

And how that compares to the number of 7-bit ASCII characters?

And how many special cases would have to be considered?

Scale matters.

The risks:reward ratio from 7-bit ASCII is low and manageable. The expressive capability is high. No, it's not a perfect representation for all languages. It is, however, a sufficient one, where common understanding is necessary.

The low number of ASCII symbols forces developers to reuse them for all purposes. The number of security holes with ASCII characters is order(s?) of magnitude larger than with Unicode. The problem of apple vs appIe (all Latin) vs аррІе(all Cyrillic) vs elppa (all Latin in reverse) is well known.

In practice, re-use is a relatively limited problem.

At 128 vs. 10^20 possible codepoints, many in Unicode with side effects, the problem of deceptive or unintended use is exceedingly high in Unicode.

With far too many special cases to hold in human working memory, or even reasonably within most code-bases.

Reply on news.ycombinator.com