Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I failed to make LinkedIn fix their broken international domain URL parser

helmstedt.dk

Post reply on HN
Print view View original

11–20 of 94 posts

Re: I failed to make LinkedIn fix their broken international domain URL parser

#11

Post by Svip »

diggan wrote: post #10
teddyh wrote: post #6

Earlier quoted context omitted.

What’s the problem? That certificate is only valid for coronaprover.dk, not coronaprøver.dk or xn--coronaprver-ngb.dk.

The problem is that Brave fails when you navigate to "coronaprøver.dk" while both Chrome and Firefox works when you go there. Although Firefox and Chrome redirects to two different sites, they don't present a certificate error, while Brave does.

That's not my experience. Going to https://xn--coronaprver-ngb.dk/ in Firefox presents the invalid certificate, but going to http://xn--coronaprver-ngb.dk/ redirects me to https://www.coronaprover.dk/. It seems Brave always tries with https, and thus it fails. Not that it is confused by IDN.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#12

Post by robjan »

diggan wrote: post #10
teddyh wrote: post #6

Earlier quoted context omitted.

What’s the problem? That certificate is only valid for coronaprover.dk, not coronaprøver.dk or xn--coronaprver-ngb.dk.

The problem is that Brave fails when you navigate to "coronaprøver.dk" while both Chrome and Firefox works when you go there. Although Firefox and Chrome redirects to two different sites, they don't present a certificate error, while Brave does.

I just successfully navigated to that site in Brave. The only problem was that I had to accept the invalid certificate.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#13

Post by ricardo81 »

"punycode" does seem to break a few things in userland, but obviously should exist for the web to be more useable in more languages.

I've delved into the subject a bit and as someone else has mentioned, "homograph attacks" are a thing.

Looking deeper, it seems each TLD has a set of dictionaries and rules for what is an acceptable combination of characters, and what isn't (to avoid homograph attacks)- and as I understand it, the solution is on a per TLD basis, as in different dictionaries and rules per TLD.

For 3rd parties like LinkedIn, I could understand why they may be averse to embracing IDN domains but for a company of their size and reach, they really should be looking after their wider user base.

For working with IDN domains, I've felt the easiest way to store/process them is to store them as their ASCII value and convert for human consumption.

Tried hunting for a C library that deals with the dictionary issues and was left not entirely sure whether libidn supports them.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#14

Post by lordnacho »

Well it would be nice it it were fixed, but aren't people in Denmark wary of using the three special characters æ, ø and å for this reason?

IIRC it's normal to have borsen.dk instead of børsen.dk, Denmark's equivalent of the FT. And probably a few others as well, I'd expect any website connected to Århus to use some other similar spelling.

Also LinkedIn doesn't seem very easy to deal with in general. I've been trying to find a way to categorize my contacts since forever (personal/business/school), but there doesn't seem to be a way. All the boards where people write have some rep pasting in a standard non-answer.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#15

Post by helstegt »

zeepzeep wrote: post #4

> tried e-mailing their security e-mail (no reply) No wonder, it's not a security issue. At least not yet, have you tried injecting new-lines?

Totally agree. It was just the only e-mail I could find and I was pessimistic about having the issue escalated through customer support. I think Vegard tried his best to help me, though. Once I got the problem escalated, I naively thought they were actually going to fix it.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#17

Post by Cthulhu_ »

lordnacho wrote: post #14

Well it would be nice it it were fixed, but aren't people in Denmark wary of using the three special characters æ, ø and å for this reason? IIRC it's normal to have borsen.dk instead of børsen.dk, Denmark's equivalent of the FT. And probably a few others as well, I'd expect any website connected to Århus to use some other similar spelling. Also LinkedIn doesn't seem very easy to deal with in general. I've been trying…

They shouldn't have to be though; internationalized domain names have been a standard for a decade now. Browsers, DNS servers and web servers should be on top of that.

I mean sure, 10+ years ago they would have used plain ascii domain names, but nowadays they should be free to user their own language and script. At least two thirds of the world population and internet users does not use latin script.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#18

Post by smt88 »

jansommer wrote: post #3

I'm not surprised the author can't convince LinkedIn to change anything. Had a similar experience with Tinder where Paying in their web application using a danish credit card failed because their cc service returned "visadankort", which had to be changed to "visa" through the developer console for the payment to go through. Got tired of that and filed a bug. Oh the battle it took to actually convince them that an ent…

I'd have to assume "supporting Danish credit cards" is lower on their list of revenue-impacting issues than you expect.

If Denmark were a US state, it wouldn't even be in the top 20 in terms of population. If you assume that Denmark has lower usage of Tinder than US, CA, or UK, and then you assume that not all Danish people are paying with Danish credit cards (many of them would be using Play Store subscriptions, which seems like it would bypass the issue you're describing), the affected population is probably really small.

Then you also have to consider that most of Tinder's paying users are heterosexual men, and they know that they can screw those men over without losing their business because Tinder is an irreplaceable marketplace to find women.

With all those assumptions, Tinder isn't being as stupid as they sound, but rather coldly rational.

Re: I failed to make LinkedIn fix their broken international domain URL parser

#19

Post by chuckSu »

jansommer wrote: post #3

I'm not surprised the author can't convince LinkedIn to change anything. Had a similar experience with Tinder where Paying in their web application using a danish credit card failed because their cc service returned "visadankort", which had to be changed to "visa" through the developer console for the payment to go through. Got tired of that and filed a bug. Oh the battle it took to actually convince them that an ent…

Don’t leave us hanging. Did you find your future wifey/hubby/partner :-)

Re: I failed to make LinkedIn fix their broken international domain URL parser

#20

Post by [deleted] »

helstegt wrote: post #15
zeepzeep wrote: post #4

> tried e-mailing their security e-mail (no reply) No wonder, it's not a security issue. At least not yet, have you tried injecting new-lines?

Totally agree. It was just the only e-mail I could find and I was pessimistic about having the issue escalated through customer support. I think Vegard tried his best to help me, though. Once I got the problem escalated, I naively thought they were actually going to fix it.

[deleted]
Post reply on HN