Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can we believe our eyes? Misleading people with Unicode.

blogs.technet.com

Post reply on HN
Print view View original

101–110 of 128 posts

Re: Can we believe our eyes? Misleading people with Unicode.

#101

Post by dagw »

nxn wrote: post #62
shrikant wrote: post #38

Earlier quoted context omitted.

I wonder why you say it was hard to find - it's always been under the View tab in Folder Options. Maybe because of the Control Panel revamp, or the fact that the menu-bar is hidden by default in Explorer windows?

I've been using Windows 7 at work for about a year, and I had absolutely no idea that the menu will show up when I hit the alt key until exactly 2 days ago. Every time I needed something from it I'd just rummage around all the visible menus, not find it, curse my head off and open up the command prompt. I'm not sure which will look dumber as a consequence of this post: me or the Windows 7 UI.

Don't feel too bad. I've been using Windows 7 since shortly after it came out and I had no idea until I just read your post.

Re: Can we believe our eyes? Misleading people with Unicode.

#102

Post by spicyj »

cbr wrote: post #86
mcantor wrote: post #51

It's funny to think that a hapless vimmer who happens to be running Windows would have never noticed this, because they would simply have typed ":edit $SYSTEMROOT\system32\drivers\etc\hosts" and gotten the real file. (This isn't a "look how cool command line junkies are" comment; I was just musing.)

tab completion

On sane systems, tab completion refuses to complete if there is more than one potential completion. Unfortunately, I seem to remember that Windows does some silly thing where it cycles through the possibilities…

Re: Can we believe our eyes? Misleading people with Unicode.

#103

Post by yuvipanda »

jerf wrote: post #97
yuvipanda wrote: post #77

Earlier quoted context omitted.

Is this 'really, really paranoid' library available somewhere?

Not yet. But it'll be in Haskell anyhow, so you're probably not actually interested :) There are other such libraries for other languages, poke around. See for instance http://htmlpurifier.org/ .

Even more intriguing. What exactly were you writing in Haskell that needed a super-paranoid html sanitizer? Yet another web server/blog/cms? Or something way more cooler?

Re: Can we believe our eyes? Misleading people with Unicode.

#104

Post by xentronium »

pavel_lishin wrote: post #72
xentronium wrote: post #60

Earlier quoted context omitted.

Filenames can contain multiscript code points. E.g.: "Архив.gz" (Archive.gz)

But do default windows ones? I think (hope?) that the hosts file is hosts on every system, no matter which country or locale you selected - instead of, say, хозяин. Perhaps limit system folders and files to ascii-only. Doesn't solve any of the picjpg.exe issues, but it's a start.

To be honest, I don't think it solves the problem of system file being modified by a process of unknown origin.

Re: Can we believe our eyes? Misleading people with Unicode.

#105

Post by pnathan »

spicyj wrote: post #102
cbr wrote: post #86

Earlier quoted context omitted.

tab completion

On sane systems, tab completion refuses to complete if there is more than one potential completion. Unfortunately, I seem to remember that Windows does some silly thing where it cycles through the possibilities…

Your memory is correct. Sad to say. :-(

Re: Can we believe our eyes? Misleading people with Unicode.

#106

Post by Rygu »

username3 wrote: post #59
Rygu wrote: post #3

I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ‮ppa.emorhCelgooG

Go to ‮ http://www.yahoo.com/q=google+oohay=q?/moc.elgoog.www//:ptth :ta elgooG

This is really dangerous. Luckily the status bar reveals the real URL. However it's still dangerous when you use a visually trusted address like Gmail:

‮ http://nyan.cat/?0/u/liam/moc.elgoog.liam//:sptth

Re: Can we believe our eyes? Misleading people with Unicode.

#107

Post by jleader »

recoiledsnake wrote: post #91
byrneseyeview wrote: post #64

This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://ww…

Even better: http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...

That one at least triggers a "Did you mean...", which the site: version avoids (because Google doesn't try to spell-correct site names).

Re: Can we believe our eyes? Misleading people with Unicode.

#108

Post by groby_b »

xtacy wrote: post #71
bzbarsky wrote: post #63

Earlier quoted context omitted.

It behaves funny in a very "simple" way. Selections have this little problem where you move your mouse over the visual representation but the selection is in the logical representation. So say your logical text is this: ltr LTR. where the capital letters are RTL chars (whether because they're actually RTL or because of an RLO in the char stream). That is, the above represents the reading order. Visually this would lo…

Ah, that makes sense. I didn't think that text selection defines end points and everything between the endpoints (in the physical text) is highlighted. So, if you have: Hi RLO elgooG ^ select ^ I expected (everything between the logical end points selected): Hi Google ^^^^^^^ (selected) In other words, I expected text selection to obey RLO character as well.

Nope - selection is on logical text, not on visual text. For tons of "fun" reasons. If you want an afternoon of madness, read the Chrome or WebKit sources relating to BiDi text.

If that's not enough pain, read http://unicode.org/reports/tr9/ (the unicode BiDi algorithm)

If you're still liking it, I know a few people who'd love to hire you :)

Re: Can we believe our eyes? Misleading people with Unicode.

#109

Post by est »

fferen wrote: post #99

A while ago I compiled a list of unicode characters that looked like letters, to get past curse filters. Not comprehensive, because I just manually skimmed through a unicode table, but here it is if anyone cares: Wide letters: Ａ Ｂ Ｃ Ｄ Ｅ Ｆ Ｇ Ｈ Ｉ Ｊ Ｋ Ｌ Ｍ Ｎ Ｏ Ｐ Ｑ Ｒ Ｓ Ｔ Ｕ Ｖ Ｗ Ｘ Ｙ Ｚ ａ ｂ ｃ ｄ ｅ ｆ ｇ ｈ ｉ ｊ ｋ ｌ ｍ ｎ ｏ ｐ ｑ ｒ ｓ ｔ ｕ ｖ ｗ ｘ ｙ ｚ Better looking letters: ϲ р с Ѕ І А В Е М Н О Р С а е о ѕ і ԛ Anyone know of a better res…

Someone need to write a scanner that compare Unicode fonts visually and list the most alike characters.

Re: Can we believe our eyes? Misleading people with Unicode.

#110

Post by nitrogen »

SiVal wrote: post #93
byrneseyeview wrote: post #64

This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://ww…

The wide variety of exploits such as these suggests that we need to integrate character spoofing into the general malware detection system on devices, which evolves over time (in the way that virus checkers evolve, with lots of human input) to deal with known or anticipated problems. I'm thinking of a system that combines aspects of virus checking, malware detection, bayesian spam filtering, and spell checking. A Uni…

I would augment the human-generated tables of confusable characters with something like OCR run on each font to detect similarly-shaped characters. The algorithm could provide a score indicating how similar any two characters are (or maybe how similar a given character is to all other characters, combined with statistical frequency of that character), which could be weighted and incorporated in a malware detection heuristic.
Post reply on HN